Merge remote-tracking branch 'XRPLF/develop' into ximinez/directory

* XRPLF/develop:
  fix: Update PermissionedDEX invariant domain tracking for valid offer replacement (7387)
  feat: Check default fields are not default when serializing (6267)
  test: Migrate csf and xrpld-consensus Beast non-JTx tests to GTest (7046)
  test: Modularize Peerfinder component and migrate Peerfinder tests from Beast to GTest and GMock (7054)
  test: Add an RAII class to manage the env.parseFailureExpected flag (7669)
  build: Use custom libc in a devshell by default (7852)
  feat: Add fixCleanup3_4_0 amendment (no functionality yet) (7854)
  ci: Add llvm-tools-preview to rust toolchain (7853)
  ci: Update CI image (7850)
  ci: Update XRPLF/actions (7849)
  chore: Clean up grammar in PR template (7846)
  build: Create versioned compiler/tooling symlinks in nix environments (7844)
  ci: Use rust-overlay to bring Rust into nix (7837)

.clang-tidy

@@ -75,8 +75,6 @@ Checks: "-*,
 # readability-static-accessed-through-instance,        # this check is probably unnecessary. It makes the code less readable
 # ---
 
-FormatStyle: file
-
 CheckOptions:
   bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
   bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
@@ -85,8 +83,6 @@ CheckOptions:
 
   readability-braces-around-statements.ShortStatementLines: 2
   readability-identifier-naming.MacroDefinitionCase: UPPER_CASE
-  readability-identifier-naming.NamespaceCase: lower_case
-  readability-identifier-naming.InlineNamespaceCase: lower_case
   readability-identifier-naming.ClassCase: CamelCase
   readability-identifier-naming.StructCase: CamelCase
   readability-identifier-naming.UnionCase: CamelCase

.codecov.yml

@@ -1,32 +1,10 @@
 codecov:
   require_ci_to_pass: true
-  # The C++ and Rust uploads land minutes apart; without this gate Codecov
-  # publishes a near-zero total from whichever one arrives first.
-  notify:
-    after_n_builds: 2
-    wait_for_ci: true
 
 comment:
   behavior: default
   layout: reach,diff,flags,tree,reach
-  show_carryforward_flags: true
-  after_n_builds: 2
-
-# C++ and Rust coverage upload from independent workflows under the `cpp` and
-# `rust` flags; carryforward keeps one language's total when only the other reran.
-flag_management:
-  default_rules:
-    carryforward: true
-  individual_flags:
-    - name: cpp
-      carryforward: true
-      paths:
-        - include/
-        - src/
-    - name: rust
-      carryforward: true
-      paths:
-        - crates/
+  show_carryforward_flags: false
 
 coverage:
   range: "70..85"

.cspell.config.yaml

@@ -7,7 +7,6 @@ ignorePaths:
   - cmake/**
   - LICENSE.md
   - .clang-tidy
-  - nix/check-tools/*.txt # generated, and full of Nix store hashes
 language: en
 allowCompoundWords: true # TODO (#6334)
 ignoreRandomStrings: true
@@ -69,7 +68,6 @@ words:
   - Buildx
   - canonicality
   - canonicalised
-  - cctools
   - changespq
   - checkme
   - choco
@@ -111,7 +109,6 @@ words:
   - disablerepo
   - distro
   - doxyfile
-  - dsymutil
   - dxrpl
   - elgamal
   - enabled
@@ -135,7 +132,6 @@ words:
   - godexsoft
   - gpgcheck
   - gpgkey
-  - Hinnant
   - hotwallet
   - hwaddress
   - hwrap
@@ -169,8 +165,6 @@ words:
   - llection
   - LOCALGOOD
   - logwstream
-  - Lombrozo
-  - lresolv
   - lseq
   - lsmf
   - ltype
@@ -180,6 +174,7 @@ words:
   - MPTAMM
   - MPTDEX
   - Merkle
+  - Metafuncton
   - misprediction
   - missingok
   - mptbalance
@@ -207,7 +202,6 @@ words:
   - nftokens
   - nftpage
   - nikb
-  - Nikolaos
   - nixfmt
   - nixos
   - nixpkgs
@@ -224,7 +218,6 @@ words:
   - Nyffenegger
   - onlatest
   - ostr
-  - otool
   - oxalica
   - pargs
   - partitioner
@@ -254,15 +247,11 @@ words:
   - Raphson
   - rcflags
   - replayer
-  - repodata
-  - repomd
   - rerandomize
   - rerandomization
   - rerandomized
   - rerandomizes
   - rerere
-  - retargeted
-  - retargets
   - retriable
   - RIPD
   - ripdtop
@@ -298,7 +287,6 @@ words:
   - sles
   - soci
   - socidb
-  - Sonatype
   - sponsee
   - sponsees
   - SRPMS
@@ -318,7 +306,6 @@ words:
   - summands
   - superpeer
   - superpeers
-  - Swatinem
   - takergets
   - takerpays
   - ters
@@ -374,16 +361,12 @@ words:
   - wthread
   - xbridge
   - xchain
-  - xcrun
   - ximinez
   - XMACRO
-  - xored
   - xrpkuwait
   - xrpl
   - xrpld
   - xrplf
   - xxhash
   - xxhasher
-  - zstdio
   - CGNAT
-  - ungated

.envrc

@@ -1,10 +1 @@
-watch_file nix/*.nix
-
-# Pinned Rust toolchain, read by nix/packages.nix via fromRustupToolchainFile.
-watch_file rust-toolchain.toml
-
-# The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
-# change in there has to invalidate direnv's cached environment.
-watch_dir conan
-
 use flake

.github/actions/cargo-cache/action.yml

@@ -1,39 +0,0 @@
-name: Use cargo artifacts cache
-description: >
-  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
-  when saving the cache, rust-cache deletes all binaries that were already
-  present there, which on persistent self-hosted runners wipes the tools
-  installed by prepare-runner. Harmless on ephemeral runners, but kept
-  consistent everywhere.
-
-inputs:
-  workspaces:
-    description: "Workspaces to cache, as 'workspace -> target' lines."
-    required: false
-    default: crates
-  key:
-    description: "Additional part of the cache key."
-    required: false
-    default: ""
-  cache-directories:
-    description: "Additional non-workspace directories to cache."
-    required: false
-    default: ""
-  save-if:
-    description: >
-      Condition for saving the cache after the job. Defaults to save only from develop branch
-    required: false
-    default: ${{ github.ref == 'refs/heads/develop' }}
-
-runs:
-  using: composite
-
-  steps:
-    - name: Use cargo artifacts cache
-      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-      with:
-        cache-bin: "false"
-        cache-directories: ${{ inputs.cache-directories }}
-        key: ${{ inputs.key }}
-        save-if: ${{ inputs.save-if }}
-        workspaces: ${{ inputs.workspaces }}

.github/actions/generate-version/action.yml

@@ -0,0 +1,44 @@
+name: Generate build version number
+description: "Generate build version number."
+
+outputs:
+  version:
+    description: "The generated build version number."
+    value: ${{ steps.version.outputs.version }}
+
+runs:
+  using: composite
+  steps:
+    # When a tag is pushed, the version is used as-is.
+    - name: Generate version for tag event
+      if: ${{ startsWith(github.ref, 'refs/tags/') }}
+      shell: bash
+      env:
+        VERSION: ${{ github.ref_name }}
+      run: echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
+
+    # When a tag is not pushed, then the version (e.g. 1.2.3-b0) is extracted
+    # from the BuildInfo.cpp file and the shortened commit hash appended to it.
+    # We use a plus sign instead of a hyphen because Conan recipe versions do
+    # not support two hyphens.
+    - name: Generate version for non-tag event
+      if: ${{ !startsWith(github.ref, 'refs/tags/') }}
+      shell: bash
+      run: |
+        echo 'Extracting version from BuildInfo.cpp.'
+        VERSION="$(cat src/libxrpl/protocol/BuildInfo.cpp | grep "versionString =" | awk -F '"' '{print $2}')"
+        if [[ -z "${VERSION}" ]]; then
+            echo 'Unable to extract version from BuildInfo.cpp.'
+            exit 1
+        fi
+
+        echo 'Appending shortened commit hash to version.'
+        SHA='${{ github.sha }}'
+        VERSION="${VERSION}+${SHA:0:7}"
+
+        echo "VERSION=${VERSION}" >>"${GITHUB_ENV}"
+
+    - name: Output version
+      id: version
+      shell: bash
+      run: echo "version=${VERSION}" >>"${GITHUB_OUTPUT}"

.github/actions/release-info/action.yml

@@ -1,44 +0,0 @@
-name: Release info
-description: "Derive the version, release channel and package release number for this build."
-
-outputs:
-  version:
-    description: "The build version number."
-    value: ${{ steps.version.outputs.version }}
-  channel:
-    description: "The release channel this build belongs to."
-    value: ${{ steps.release_info.outputs.channel }}
-  pkg_release:
-    description: "The package release number: 1 for a tag, <run number>.<commit date>git<short commit hash> otherwise."
-    value: ${{ steps.release_info.outputs.pkg_release }}
-
-runs:
-  using: composite
-  steps:
-    # A tag names its own version. Anything else takes it from BuildInfo.cpp and
-    # appends the commit hash as build metadata, joined with a plus sign because a
-    # Conan version cannot contain two hyphens.
-    - name: Determine version
-      id: version
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        REF_NAME: ${{ github.ref_name }}
-        SHA: ${{ github.sha }}
-      run: |
-        if [[ "${IS_TAG}" == "true" ]]; then
-            version="${REF_NAME}"
-        else
-            version="$(awk -F'"' '/versionString =/ { print $2 }' src/libxrpl/protocol/BuildInfo.cpp)"
-            if [[ -z "${version}" ]]; then
-                echo "Unable to read versionString from BuildInfo.cpp." >&2
-                exit 1
-            fi
-            version="${version}+${SHA:0:7}"
-        fi
-
-        echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
-
-    - name: Determine release channel and package release
-      id: release_info
-      uses: XRPLF/actions/release-info@7cc0e4a8d9d0b838f92c48d312856b190341bbba

.github/actions/setup-nix-env/action.yml

@@ -1,70 +0,0 @@
-name: Setup Nix environment
-description: "Build the flake's CI environment and put its tools on PATH."
-
-# The environment from nix/ci-env.nix, the same one the Linux CI images bake in
-# (see nix/docker). Exported onto PATH rather than entered with `nix develop`:
-# the composite actions below run plain `bash` and would escape a dev shell.
-
-runs:
-  using: composite
-
-  steps:
-    - name: Build the CI environment
-      id: build
-      shell: bash
-      env:
-        # --out-link doubles as a GC root for the length of the job.
-        OUT_LINK: ${{ runner.temp }}/xrpld-ci-env
-      run: |
-        # --extra-experimental-features: flakes may not be on in the runner's nix.conf.
-        nix --extra-experimental-features "nix-command flakes" \
-            build .#default --out-link "${OUT_LINK}" --print-build-logs
-        echo "path=$(readlink -f "${OUT_LINK}")" >>"${GITHUB_OUTPUT}"
-
-    - name: Export the environment
-      shell: bash
-      env:
-        ENV_PATH: ${{ steps.build.outputs.path }}
-      run: |
-        echo "${ENV_PATH}/bin" >>"${GITHUB_PATH}"
-
-        # Already KEY=VALUE per line. See `darwinEnv` in nix/ci-env.nix.
-        ENV_FILE="${ENV_PATH}/share/xrpld-ci-env/env"
-        if [ -f "${ENV_FILE}" ]; then
-            cat "${ENV_FILE}" >>"${GITHUB_ENV}"
-        fi
-
-        # XrplSanity.cmake otherwise rejects a Nix compiler as one that leaked.
-        echo "XRPL_DEVSHELL=ci-env" >>"${GITHUB_ENV}"
-
-        # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
-        # own trust store, and pinning would break TLS to hosts relying on it.
-
-        # In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
-        # prepare-runner hands the system toolchain - but under its own name:
-        # that Conan is a different version, and the two would migrate each
-        # other's cache.
-        echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
-
-    # Config, profiles and remote, exactly as the dev shell sets them up on
-    # entry; the `setup-conan` action is skipped for this toolchain.
-    - name: Setup Conan
-      shell: bash
-      run: ./conan/init.sh
-
-    # `Check tools` runs later but swallows failures; a bad export would just
-    # build with the system toolchain.
-    - name: Verify the toolchain resolves into the Nix store
-      shell: bash
-      run: |
-        for tool in clang clang++ cmake ninja conan; do
-            path="$(command -v "${tool}" || true)"
-            echo "${tool} -> ${path:-<not found>}"
-            case "${path}" in
-                /nix/store/*) ;;
-                *)
-                    echo "::error::${tool} does not resolve into the Nix store"
-                    exit 1
-                    ;;
-            esac
-        done

.github/dependabot.yml

@@ -4,8 +4,7 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
-      - .github/actions/cargo-cache/
-      - .github/actions/release-info/
+      - .github/actions/generate-version/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/
     schedule:
@@ -16,23 +15,3 @@ updates:
     commit-message:
       prefix: "ci: [DEPENDABOT] "
     target-branch: develop
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-
-  - package-ecosystem: cargo
-    directory: /crates
-    schedule:
-      interval: weekly
-      day: monday
-      time: "04:00"
-      timezone: Etc/GMT
-    commit-message:
-      prefix: "chore: [DEPENDABOT] "
-    target-branch: develop
-    open-pull-requests-limit: 10
-    groups:
-      rust-dependencies:
-        patterns:
-          - "*"

.github/pull_request_template.md

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
 If there is a relevant task or issue, please link it here.
 -->
 
-## Context of Change
+### Context of Change
 
 <!--
 Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
 If there is a spec or design document for this feature, please link it here.
 -->
 
-## API Impact
+### API Impact
 
 <!--
 Please check [x] relevant options, delete irrelevant ones.

.github/scripts/levelization/results/ordering.txt

@@ -130,9 +130,12 @@ test.ledger > xrpl.json
 test.ledger > xrpl.ledger
 test.ledger > xrpl.protocol
 test.nodestore > test.jtx
+test.nodestore > test.unit_test
 test.nodestore > xrpl.basics
+test.nodestore > xrpl.config
 test.nodestore > xrpld.core
 test.nodestore > xrpl.nodestore
+test.nodestore > xrpl.protocol
 test.nodestore > xrpl.rdb
 test.overlay > test.jtx
 test.overlay > test.unit_test

.github/scripts/rename/binary.sh

@@ -49,7 +49,7 @@ ${SED_COMMAND} -i -E 's@ripple/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' BUILD.md
 ${SED_COMMAND} -i -E 's@xrpld \(`xrpld`\)@xrpld@g' BUILD.md
 ${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' CONTRIBUTING.md
-${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/install.md
+${SED_COMMAND} -i -E 's@XRPLF/xrpld@XRPLF/rippled@g' docs/build/install.md
 
 popd
 echo "Processing complete."

.github/scripts/rename/docs.sh

@@ -77,8 +77,8 @@ ${SED_COMMAND} -i 's/Ripple integrators/XRPL developers/' README.md
 ${SED_COMMAND} -i 's/sanitizer-configuration-for-rippled/sanitizer-configuration-for-xrpld/' docs/build/sanitizers.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/levelization/README.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' .github/scripts/strategy-matrix/generate.py
-${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/install.md
-${SED_COMMAND} -i 's@github.com/XRPLF/xrpld@github.com/XRPLF/rippled@g' docs/install.md
+${SED_COMMAND} -i 's@/rippled@/xrpld@g' docs/build/install.md
+${SED_COMMAND} -i 's@github.com/XRPLF/xrpld@github.com/XRPLF/rippled@g' docs/build/install.md
 ${SED_COMMAND} -i 's/rippled/xrpld/g' docs/Doxyfile
 ${SED_COMMAND} -i 's/ripple_basics/basics/' include/xrpl/basics/CountedObject.h
 ${SED_COMMAND} -i 's/<ripple/<xrpl/' include/xrpl/protocol/AccountID.h

.github/scripts/rename/namespace.sh

@@ -46,6 +46,9 @@ for DIRECTORY in "${DIRECTORIES[@]}"; do
     done
 done
 
+# Special case for NuDBFactory that has ripple twice in the test suite name.
+${SED_COMMAND} -i -E 's/(BEAST_DEFINE_TESTSUITE.+)ripple(.+)/\1xrpl\2/g' src/test/nodestore/NuDBFactory_test.cpp
+
 DIRECTORY=$1
 find "${DIRECTORY}" -type f -name "*.md" | while read -r FILE; do
     echo "Processing file: ${FILE}"

.github/scripts/strategy-matrix/generate.py

@@ -7,13 +7,7 @@ from pathlib import Path
 
 THIS_DIR = Path(__file__).parent.resolve()
 
-_BASE_CMAKE_ARGS = [
-    "-Dtests=ON",
-    "-Dwerr=ON",
-    "-Dxrpld=ON",
-    "-Dwextra=ON",
-    "-Drust=ON",
-]
+_BASE_CMAKE_ARGS = ["-Dtests=ON", "-Dwerr=ON", "-Dxrpld=ON", "-Dwextra=ON"]
 
 # Maps sanitizer names (as used in cmake) to short config-name suffixes.
 _SANITIZER_SUFFIX: dict[str, str] = {
@@ -23,19 +17,6 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 }
 
 
-def config_name(
-    distro: str,
-    compiler: str,
-    build_type: str,
-    arch: str,
-    suffix: str = "",
-    sanitizer: str = "",
-) -> str:
-    """Name a config. Its artifacts are named after it, so packaging reuses this."""
-    parts = [s for s in [suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s]
-    return "-".join([f"{distro}-{compiler}-{build_type.lower()}-{arch}", *parts])
-
-
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
@@ -50,41 +31,22 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 
 
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
-# built for pull requests by default; the full matrix adds the rest.
-#
-# Configs may also opt into 'benchmark' to smoke-run the benchmarks, or carry a
-# 'package' map to be packaged as well. Note that either applies to every entry
-# a config expands into, so only set them on configs that expand to a single
-# combination.
-
-
-@dataclasses.dataclass
-class PackageConfig:
-    """The 'package' map of a config whose binaries are also packaged."""
-
-    type: str  # "deb" or "rpm"; has to match what the image provides
-    # The packaging container image: a vanilla distro image, not the nix image
-    # the config itself builds in.
-    image: str
+# built for pull requests by default; the full matrix adds the rest. Packaging
+# configs declare it too, but packaging is gated in the workflow, not by it.
 
 
 @dataclasses.dataclass
 class LinuxConfig:
-    """One entry in a linux.json 'configs' array."""
+    """One entry in linux.json's 'configs' or 'package_configs' arrays."""
 
     compiler: list[str]
     build_type: list[str]
     arch: list[str]
     minimal: bool
-    benchmark: bool = False  # if true, smoke-run the benchmarks after testing
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
-    package: PackageConfig | None = None  # set to also package this config
-
-    def __post_init__(self) -> None:
-        if isinstance(self.package, dict):
-            self.package = PackageConfig(**self.package)
+    image: str = ""  # only used by package_configs entries
 
 
 @dataclasses.dataclass
@@ -93,16 +55,22 @@ class LinuxFile:
 
     image_tag: str
     configs: dict[str, list[LinuxConfig]]  # distro → configs
+    package_configs: dict[str, list[LinuxConfig]]  # distro → packaging configs
 
     @classmethod
     def load(cls, path: Path) -> "LinuxFile":
         data = json.loads(path.read_text())
+
+        def parse(section: dict) -> dict[str, list[LinuxConfig]]:
+            return {
+                distro: [LinuxConfig(**c) for c in cfgs]
+                for distro, cfgs in section.items()
+            }
+
         return cls(
             image_tag=data["image_tag"],
-            configs={
-                distro: [LinuxConfig(**c) for c in cfgs]
-                for distro, cfgs in data["configs"].items()
-            },
+            configs=parse(data["configs"]),
+            package_configs=parse(data.get("package_configs", {})),
         )
 
 
@@ -113,11 +81,7 @@ class PlatformConfig:
     build_type: list[str]
     minimal: bool
     build_only: bool = False  # if true, skip tests (e.g. macos/Windows Debug)
-    benchmark: bool = False  # if true, smoke-run the benchmarks after testing
     extra_cmake_args: str = ""
-    # "" is the runner's system compiler, "nix" the flake's CI environment.
-    # macOS only: Linux always builds in a Nix image, Windows has no Nix.
-    toolchain: str = ""
 
     def __post_init__(self) -> None:
         if isinstance(self.build_type, str):
@@ -161,23 +125,20 @@ class MatrixEntry:
     cmake_args: str
     cmake_target: str
     build_only: bool
-    benchmark: bool
     build_type: str
     architecture: Architecture
     sanitizers: str
     image: str = ""  # container image; empty for macOS/Windows (runs natively)
     compiler: str = ""  # compiler name ("gcc" or "clang"); empty for macOS/Windows
-    toolchain: str = ""  # "nix" for the flake's CI environment; see PlatformConfig
 
 
 @dataclasses.dataclass
 class PackagingEntry:
     """One entry in the generated packaging strategy matrix."""
 
-    xrpld_artifact_name: str
-    validator_keys_artifact_name: str
+    artifact_name: str
     image: str
-    package_type: str  # "deb" or "rpm"; drives the format-specific steps
+    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps
 
 
 # ---------------------------------------------------------------------------
@@ -218,9 +179,13 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                 effective_sanitizers,
                 effective_archs.items(),
             ):
-                name = config_name(
-                    distro, compiler, build_type, arch, cfg.suffix, sanitizer
-                )
+                name = f"{distro}-{compiler}-{build_type.lower()}-{arch}"
+                suffix_parts = [
+                    s for s in [cfg.suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s
+                ]
+                if suffix_parts:
+                    name += "-" + "-".join(suffix_parts)
+
                 entries.append(
                     MatrixEntry(
                         config_name=name,
@@ -228,7 +193,6 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                         cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                         cmake_target="all",
                         build_only=False,
-                        benchmark=cfg.benchmark,
                         build_type=build_type,
                         architecture=arch_info,
                         sanitizers=sanitizer,
@@ -240,33 +204,22 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 
 
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
-    """Generate the packaging matrix from the configs that carry a 'package' map.
+    """Generate the packaging matrix from a LinuxFile's package_configs section.
 
-    Packaging consumes the binaries that config's build job uploaded, so the
-    artifact names come from the same config name, and a packaged config is one
-    that passes -Dvalidator_keys=ON.
-
-    Packaging itself runs in vanilla distro images (debian:trixie, almalinux:10)
-    instead of the nix-based build images, because deb/rpm tooling (debhelper,
-    rpm-build) is taken from the distro's archive rather than from nixpkgs.
+    Packaging uses vanilla distro images (debian:bookworm, ubi9, …) instead of
+    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
+    is taken from the distro's archive rather than from nixpkgs. Each config
+    entry carries its own 'image'.
     """
     entries = []
-    for distro, configs in linux.configs.items():
+    for distro, configs in linux.package_configs.items():
         for cfg in configs:
-            if cfg.package is None:
-                continue
-            for compiler, build_type, arch in itertools.product(
-                cfg.compiler, cfg.build_type, cfg.arch
-            ):
-                # The packaging workflow hardcodes an amd64 runner.
-                assert arch == "amd64", f"cannot package {distro} on {arch}"
-                name = config_name(distro, compiler, build_type, arch, cfg.suffix)
+            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
                 entries.append(
                     PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{name}",
-                        validator_keys_artifact_name=f"validator-keys-{name}",
-                        image=cfg.package.image,
-                        package_type=cfg.package.type,
+                        artifact_name=f"xrpld-{distro}-{compiler}-{build_type.lower()}-amd64",
+                        image=cfg.image,
+                        distro=distro,
                     )
                 )
 
@@ -286,20 +239,15 @@ def expand_platform_matrix(pf: PlatformFile, minimal: bool) -> list[MatrixEntry]
         if minimal and not cfg.minimal:
             continue
         for build_type in cfg.build_type:
-            name = f"{platform_name}-{arch}-{build_type.lower()}"
-            if cfg.toolchain:
-                name += f"-{cfg.toolchain}"
             entries.append(
                 MatrixEntry(
-                    config_name=name,
+                    config_name=f"{platform_name}-{arch}-{build_type.lower()}",
                     cmake_args=get_cmake_args(build_type, cfg.extra_cmake_args),
                     cmake_target="install" if is_windows else "all",
                     build_only=cfg.build_only,
-                    benchmark=cfg.benchmark,
                     build_type=build_type,
                     architecture=Architecture(platform=pf.platform, runner=pf.runner),
                     sanitizers="",
-                    toolchain=cfg.toolchain,
                 )
             )
     return entries

.github/scripts/strategy-matrix/linux.json

@@ -1,23 +1,13 @@
 {
-  "image_tag": "sha-473fe44",
+  "image_tag": "sha-3122de8",
   "configs": {
     "ubuntu": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Debug"],
-        "arch": ["amd64"],
-        "minimal": true,
-        "suffix": "coverage",
-        "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
-      },
       {
         "compiler": ["clang"],
         "build_type": ["Release"],
         "arch": ["amd64"],
-        "minimal": true,
-        "benchmark": true
+        "minimal": true
       },
-
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
@@ -39,6 +29,14 @@
         "sanitizers": ["address", "undefinedbehavior"]
       },
 
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Debug"],
+        "arch": ["amd64"],
+        "minimal": true,
+        "suffix": "coverage",
+        "extra_cmake_args": "-DUNIT_TEST_REFERENCE_FEE=500 -Dcoverage=ON -Dcoverage_format=xml -DCODE_COVERAGE_VERBOSE=ON -DCMAKE_C_FLAGS=-O0 -DCMAKE_CXX_FLAGS=-O0"
+      },
       {
         "compiler": ["clang"],
         "build_type": ["Debug"],
@@ -65,17 +63,32 @@
       }
     ],
 
+    "debian": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false
+      }
+    ],
+
+    "rhel": [
+      {
+        "compiler": ["gcc"],
+        "build_type": ["Release"],
+        "arch": ["amd64"],
+        "minimal": false
+      }
+    ]
+  },
+  "package_configs": {
     "debian": [
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON",
-        "package": {
-          "type": "deb",
-          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10"
-        }
+        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
       }
     ],
 
@@ -85,11 +98,7 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON",
-        "package": {
-          "type": "rpm",
-          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-49cdc10"
-        }
+        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
       }
     ]
   }

.github/scripts/strategy-matrix/macos.json

@@ -12,19 +12,6 @@
       "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
       "build_only": true,
       "minimal": false
-    },
-    {
-      "build_type": "Release",
-      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
-      "toolchain": "nix",
-      "minimal": false
-    },
-    {
-      "build_type": "Debug",
-      "extra_cmake_args": "-DCMAKE_POLICY_VERSION_MINIMUM=3.5",
-      "toolchain": "nix",
-      "build_only": true,
-      "minimal": false
     }
   ]
 }

.github/workflows/build-nix-images.yml

@@ -12,9 +12,7 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   pull_request:
     paths:
@@ -25,9 +23,7 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
-      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
   workflow_dispatch:
 
@@ -60,7 +56,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -6,13 +6,13 @@ on:
       - develop
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install-packaging-tools.sh"
-      - "package/docker/**"
+      - "package/Dockerfile"
+      - "package/install-packaging-tools.sh"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "bin/install-packaging-tools.sh"
-      - "package/docker/**"
+      - "package/Dockerfile"
+      - "package/install-packaging-tools.sh"
   workflow_dispatch:
 
 concurrency:
@@ -33,17 +33,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # Newest of each distro: these images only wrap pre-built binaries, so
-        # they set no floor for consumers. build_pkg.py pins the RPM dist tag.
         distro:
           - name: debian
-            base_image: debian:trixie
-          # AlmaLinux rather than UBI, which does not ship rpm-sign.
+            base_image: debian:bookworm
           - name: rhel
-            base_image: almalinux:10
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+            base_image: registry.access.redhat.com/ubi9/ubi:latest
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
-      dockerfile: package/docker/Dockerfile
+      dockerfile: package/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
       push: ${{ github.event_name == 'push' }}

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -1,80 +0,0 @@
-name: Cargo audit
-
-on:
-  schedule:
-    # 06:32 UTC every Monday.
-    - cron: "32 6 * * 1"
-  push:
-    branches:
-      - "develop"
-      - "release/*"
-    paths:
-      - "crates/**/Cargo.toml"
-      - "crates/Cargo.lock"
-      - ".github/workflows/cargo-audit.yml"
-  pull_request:
-    paths:
-      - "crates/**/Cargo.toml"
-      - "crates/Cargo.lock"
-      - ".github/workflows/cargo-audit.yml"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-    working-directory: crates
-
-permissions:
-  contents: read
-
-jobs:
-  audit:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    permissions:
-      contents: read
-      # Needed to open an issue on scheduled failures.
-      issues: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Run cargo audit
-        id: audit
-        continue-on-error: true
-        run: |
-          set -o pipefail
-          cargo audit | tee /tmp/cargo-audit.txt
-
-      - name: Prepare issue body
-        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        run: |
-          {
-              echo "## \`cargo audit\` found advisories"
-              echo
-              echo '```'
-              cat /tmp/cargo-audit.txt
-              echo '```'
-              echo
-              echo "---"
-              echo "*This issue was automatically created by the cargo-audit workflow.*"
-          } >/tmp/cargo-audit-issue.md
-
-      - name: Create issue
-        if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
-        uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
-        with:
-          title: "cargo audit found vulnerabilities"
-          body_file: /tmp/cargo-audit-issue.md
-          labels: "Bug,Security"
-
-      - name: Fail if advisories were found
-        if: ${{ steps.audit.outcome != 'success' }}
-        run: |
-          echo "cargo audit found advisories!"
-          cat /tmp/cargo-audit.txt
-          exit 1

.github/workflows/check-pr-description.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Write PR body to file
         env:

.github/workflows/check-tools.yml

@@ -1,114 +0,0 @@
-# Verifies the committed snapshots of `bin/check-tools.sh` output for each Nix
-# environment (see nix/check-tools/). If the environment changes — a new image
-# tag, an updated flake.lock, a different tool list — without the matching
-# snapshot being regenerated and committed, this workflow fails so the drift is
-# caught in review.
-#
-# To regenerate the snapshots, see nix/check-tools/README.md.
-name: Check tools
-
-on:
-  pull_request:
-    paths:
-      - ".github/workflows/check-tools.yml"
-      - ".github/scripts/strategy-matrix/linux.json"
-      - "bin/check-tools.sh"
-      - "nix/**"
-      - "flake.nix"
-      - "flake.lock"
-      - "rust-toolchain.toml"
-  push:
-    branches:
-      - "develop"
-    paths:
-      - ".github/workflows/check-tools.yml"
-      - ".github/scripts/strategy-matrix/linux.json"
-      - "bin/check-tools.sh"
-      - "nix/**"
-      - "flake.nix"
-      - "flake.lock"
-      - "rust-toolchain.toml"
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  # The nix-nixos image tag is pinned alongside the build matrix in linux.json,
-  # so snapshots are checked against the exact image CI builds against.
-  linux-image-tag:
-    runs-on: ubuntu-latest
-    outputs:
-      tag: ${{ steps.tag.outputs.tag }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Read nix image tag
-        id: tag
-        run: echo "tag=$(jq -r .image_tag .github/scripts/strategy-matrix/linux.json)" >>"${GITHUB_OUTPUT}"
-
-  # One job for all environments; they differ only in whether the tools come
-  # from the nix-nixos container (Linux) or `nix develop` (macOS).
-  check-tools:
-    needs: linux-image-tag
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-latest
-            snapshot: nix/check-tools/nix-ubuntu-amd64.txt
-            nix_develop: false
-          - runner: ubuntu-24.04-arm
-            snapshot: nix/check-tools/nix-ubuntu-arm64.txt
-            nix_develop: false
-          - runner: macos-26-apple-clang-21
-            snapshot: nix/check-tools/macos.txt
-            nix_develop: true
-    runs-on: ${{ matrix.runner }}
-    # Linux runs inside the pinned nix-nixos image; macOS runs natively and uses
-    # the flake's dev shell instead (see the run step below).
-    container: ${{ !matrix.nix_develop && format('ghcr.io/xrplf/xrpld/nix-ubuntu:{0}', needs.linux-image-tag.outputs.tag) || null }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
-      - name: Regenerate snapshot
-        env:
-          CHECK_TOOLS_SKIP_CLONE: "1"
-          # check-tools.sh skips some macOS tools when CI is set; the snapshots
-          # capture the full `nix develop` environment, so unset it here.
-          CI: ""
-        run: |
-          if [ "${{ matrix.nix_develop }}" = "true" ]; then
-              # `nix develop` prints the dev-shell greeting first; keep only the
-              # check-tools.sh output (from the "Detected OS:" line onward).
-              nix --extra-experimental-features "nix-command flakes" develop \
-                  -c bash bin/check-tools.sh | sed -n '/^Detected OS:/,$p' >"${{ matrix.snapshot }}"
-          else
-              bash bin/check-tools.sh >"${{ matrix.snapshot }}"
-          fi
-
-      - name: Verify snapshot is up to date
-        run: |
-          if ! git diff --exit-code -- "${{ matrix.snapshot }}"; then
-              echo "::error::${{ matrix.snapshot }} is out of date. Regenerate it (see nix/check-tools/README.md) and commit the result."
-              exit 1
-          fi
-
-      - name: Upload regenerated snapshot
-        if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: check-tools-${{ runner.os }}-${{ runner.arch }}
-          path: ${{ matrix.snapshot }}

.github/workflows/on-pr.yml

@@ -52,7 +52,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Determine changed files
         # This step checks whether any files have changed that should
         # cause the next jobs to run. We do it this way rather than
@@ -77,28 +77,22 @@ jobs:
 
             # Keep the paths below in sync with those in `on-trigger.yml`.
             .github/actions/build-deps/**
-            .github/actions/release-info/**
+            .github/actions/generate-version/**
             .github/actions/setup-conan/**
-            .github/actions/setup-nix-env/**
             .github/scripts/strategy-matrix/**
             .github/workflows/reusable-build-test-config.yml
             .github/workflows/reusable-build-test.yml
-            .github/workflows/reusable-check-autogen.yml
             .github/workflows/reusable-clang-tidy.yml
             .github/workflows/reusable-package.yml
-            .github/workflows/reusable-rust.yml
             .github/workflows/reusable-strategy-matrix.yml
             .github/workflows/reusable-test.yml
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
-            bin/check-nix-store-refs.sh
             bin/check-tools.sh
-            bin/default-loader-path.sh
             cfg/**
             cmake/**
             conan/**
-            crates/**
             external/**
             include/**
             src/**
@@ -106,9 +100,6 @@ jobs:
             CMakeLists.txt
             conanfile.py
             conan.lock
-            flake.lock
-            flake.nix
-            nix/**
             LICENSE.md
             package/**
             README.md
@@ -134,11 +125,6 @@ jobs:
     outputs:
       go: ${{ steps.go.outputs.go == 'true' }}
 
-  check-autogen:
-    needs: should-run
-    if: ${{ needs.should-run.outputs.go == 'true' }}
-    uses: ./.github/workflows/reusable-check-autogen.yml
-
   check-levelization:
     needs: should-run
     if: ${{ needs.should-run.outputs.go == 'true' }}
@@ -175,13 +161,6 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  rust:
-    needs: should-run
-    if: ${{ needs.should-run.outputs.go == 'true' }}
-    uses: ./.github/workflows/reusable-rust.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
   package:
     needs: [should-run, build-test]
     # Packaging consumes the debian/rhel release binaries, which are only built
@@ -220,12 +199,10 @@ jobs:
   passed:
     if: failure() || cancelled()
     needs:
-      - check-autogen
       - check-levelization
       - check-rename
       - clang-tidy
       - build-test
-      - rust
       - package
       - upload-recipe
       - notify-clio

.github/workflows/on-tag.yml

@@ -1,9 +1,5 @@
-# When a versioned tag is pushed, this workflow:
-#
-#   - uploads the libxrpl recipe to the Conan remote
-#   - builds and tests the release binaries
-#   - builds the DEB and RPM packages
-#   - publishes those packages to the XRPLF package repositories
+# This workflow uploads the libxrpl recipe to the Conan remote and builds
+# release packages when a versioned tag is pushed.
 name: Tag
 
 on:
@@ -28,7 +24,7 @@ jobs:
       remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
 
   build-test:
-    if: ${{ github.repository_owner == 'XRPLF' }}
+    if: ${{ github.repository == 'XRPLF/rippled' }}
     uses: ./.github/workflows/reusable-build-test.yml
     strategy:
       fail-fast: true
@@ -41,12 +37,6 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   package:
-    if: ${{ github.repository_owner == 'XRPLF' }}
+    if: ${{ github.repository == 'XRPLF/rippled' }}
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
-    with:
-      publish: true
-    secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
-      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}

.github/workflows/on-trigger.yml

@@ -15,28 +15,22 @@ on:
 
       # Keep the paths below in sync with those in `on-pr.yml`.
       - ".github/actions/build-deps/**"
-      - ".github/actions/release-info/**"
+      - ".github/actions/generate-version/**"
       - ".github/actions/setup-conan/**"
-      - ".github/actions/setup-nix-env/**"
       - ".github/scripts/strategy-matrix/**"
       - ".github/workflows/reusable-build-test-config.yml"
       - ".github/workflows/reusable-build-test.yml"
-      - ".github/workflows/reusable-check-autogen.yml"
       - ".github/workflows/reusable-clang-tidy.yml"
       - ".github/workflows/reusable-package.yml"
-      - ".github/workflows/reusable-rust.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
       - ".github/workflows/reusable-test.yml"
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
-      - "bin/check-nix-store-refs.sh"
       - "bin/check-tools.sh"
-      - "bin/default-loader-path.sh"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
-      - "crates/**"
       - "external/**"
       - "include/**"
       - "src/**"
@@ -44,9 +38,6 @@ on:
       - "CMakeLists.txt"
       - "conanfile.py"
       - "conan.lock"
-      - "flake.lock"
-      - "flake.nix"
-      - "nix/**"
       - "LICENSE.md"
       - "package/**"
       - "README.md"
@@ -75,9 +66,6 @@ defaults:
     shell: bash
 
 jobs:
-  check-autogen:
-    uses: ./.github/workflows/reusable-check-autogen.yml
-
   clang-tidy:
     uses: ./.github/workflows/reusable-clang-tidy.yml
     permissions:
@@ -103,11 +91,6 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
-  rust:
-    uses: ./.github/workflows/reusable-rust.yml
-    secrets:
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
   upload-recipe:
     needs: build-test
     # Only run when pushing to the develop branch.
@@ -120,11 +103,3 @@ jobs:
   package:
     needs: build-test
     uses: ./.github/workflows/reusable-package.yml
-    with:
-      # Packages are built on every trigger; only develop pushes in XRPLF/rippled
-      # publish them, matching upload-recipe above.
-      publish: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
-    secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
-      signing_key: ${{ secrets.NEXUS_PACKAGES_PRIVATE_KEY }}

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -3,12 +3,6 @@ name: Build and test configuration
 on:
   workflow_call:
     inputs:
-      benchmark:
-        description: "Whether to smoke-run the benchmarks after testing."
-        required: false
-        type: boolean
-        default: false
-
       build_only:
         description: 'Whether to only build or to build and test the code ("true", "false").'
         required: true
@@ -69,12 +63,6 @@ on:
         type: string
         default: ""
 
-      toolchain:
-        description: 'Where the toolchain comes from ("nix" to build the flake CI environment on the runner, empty for the system one). macOS only: Linux always builds in a Nix image, and Nix has no Windows support.'
-        required: false
-        type: string
-        default: ""
-
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -112,32 +100,23 @@ jobs:
       # header files are copied into separate directories by CMake, which will
       # otherwise result in cache misses.
       CCACHE_SLOPPINESS: include_file_ctime,include_file_mtime
-      # Determine if coverage, voidstar and validator-keys should be enabled.
+      # Determine if coverage and voidstar should be enabled.
       COVERAGE_ENABLED: ${{ contains(inputs.cmake_args, '-Dcoverage=ON') }}
       VOIDSTAR_ENABLED: ${{ contains(inputs.cmake_args, '-Dvoidstar=ON') }}
-      VALIDATOR_KEYS_ENABLED: ${{ contains(inputs.cmake_args, '-Dvalidator_keys=ON') }}
       SANITIZERS_ENABLED: ${{ inputs.sanitizers != '' }}
-      # The binaries reusable-package.yml consumes. A private repository skips
-      # them except on a tag push, which is what produces its release packages.
-      PACKAGING_ARTIFACTS_ENABLED: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
     steps:
       - name: Cleanup workspace (macOS and Windows)
         if: ${{ runner.os == 'macOS' || runner.os == 'Windows' }}
         uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4
 
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
-      # Before any step that uses a build tool, composite actions included.
-      - name: Setup Nix environment
-        if: ${{ inputs.toolchain == 'nix' }}
-        uses: ./.github/actions/setup-nix-env
-
       - name: Set ccache log file
         if: ${{ inputs.ccache_enabled && runner.debug == '1' }}
         run: echo "CCACHE_LOGFILE=${{ runner.temp }}/ccache.log" >>"${GITHUB_ENV}"
@@ -162,21 +141,7 @@ jobs:
         with:
           compiler: ${{ inputs.compiler }}
 
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-        with:
-          cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          key: ${{ inputs.config_name }}
-          # two workspaces here because build artifacts are located in 2 places:
-          # - crates/target when cargo is called directly
-          # - build/cargo when cargo is called by cmake
-          workspaces: |
-            crates
-            crates -> ${{ runner.os == 'Windows' && format('../{0}/x64/{1}/cargo', env.BUILD_DIR, inputs.build_type) || format('../{0}/cargo', env.BUILD_DIR) }}
-
-      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
-        if: ${{ inputs.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ inputs.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -205,9 +170,9 @@ jobs:
               ..
 
       # Export the sanitizer options before any instrumented binary runs. The
-      # build step below invokes instrumented dependency tools (protoc, grpc),
-      # so setting UBSAN_OPTIONS here lets the UBSan suppression list silence
-      # their diagnostics too, not just at test time.
+      # protocol code-gen and build steps below invoke instrumented dependency
+      # tools (protoc, grpc), so setting UBSAN_OPTIONS here lets the UBSan
+      # suppression list silence their diagnostics too, not just at test time.
       # GITHUB_WORKSPACE (not the github.workspace context) is used so the path
       # resolves correctly inside the container job.
       - name: Set sanitizer options
@@ -225,6 +190,32 @@ jobs:
           echo "UBSAN_OPTIONS=include=${SUPP}/runtime-ubsan-options.txt:suppressions=${SUPP}/ubsan.supp" >>${GITHUB_ENV}
           echo "LSAN_OPTIONS=include=${SUPP}/runtime-lsan-options.txt:suppressions=${SUPP}/lsan.supp" >>${GITHUB_ENV}
 
+      - name: Check protocol autogen files are up-to-date
+        working-directory: ${{ env.BUILD_DIR }}
+        env:
+          MESSAGE: |
+
+            The generated protocol wrapper classes are out of date.
+
+            This typically happens when the macro files or generator scripts
+            have changed but the generated files were not regenerated.
+
+            To fix this:
+              1. Run: cmake --build . --target setup_code_gen
+              2. Run: cmake --build . --target code_gen
+              3. Commit and push the regenerated files
+        run: |
+          set -e
+          cmake --build . --target setup_code_gen
+          cmake --build . --target code_gen
+          DIFF=$(git -C .. status --porcelain -- include/xrpl/protocol_autogen src/tests/libxrpl/protocol_autogen)
+          if [ -n "${DIFF}" ]; then
+              echo "::error::Generated protocol files are out of date"
+              git -C .. diff -- include/xrpl/protocol_autogen src/tests/libxrpl/protocol_autogen
+              echo "${MESSAGE}"
+              exit 1
+          fi
+
       - name: Build the binary
         working-directory: ${{ env.BUILD_DIR }}
         env:
@@ -240,24 +231,6 @@ jobs:
               --target "${CMAKE_TARGET}" \
               2>&1 | tee "${GITHUB_WORKSPACE}/build.log"
 
-      # Nothing may reference the store, so whole trees are checked - the Conan
-      # cache included, since what it holds is what gets uploaded and reused.
-      - name: Check the build output for Nix store references (Nix toolchain)
-        if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${BUILD_DIR}"
-
-      - name: Check the Conan cache for Nix store references (Nix toolchain)
-        if: ${{ inputs.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
-
-      # Only what PatchNixBinary.cmake retargets: the toolchain in the Linux
-      # images always references the store. Same condition it uses.
-      - name: Check for Nix store references (Linux)
-        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
-        run: |
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpld"
-          ./bin/check-nix-store-refs.sh "${BUILD_DIR}/xrpl_tests"
-
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
         run: |
@@ -268,7 +241,7 @@ jobs:
           fi
 
       - name: Upload the binary (Linux)
-        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && runner.os == 'Linux' }}
+        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: xrpld-${{ inputs.config_name }}
@@ -276,22 +249,6 @@ jobs:
           retention-days: 3
           if-no-files-found: error
 
-      - name: Run the validator-keys tests
-        if: ${{ env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        working-directory: ${{ env.BUILD_DIR }}
-        run: ./validator-keys --unittest
-
-      - name: Upload the validator-keys binary
-        if: ${{ env.PACKAGING_ARTIFACTS_ENABLED == 'true' && env.VALIDATOR_KEYS_ENABLED == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: validator-keys-${{ inputs.config_name }}
-          path: |
-            ${{ env.BUILD_DIR }}/validator-keys
-            ${{ env.BUILD_DIR }}/validator-keys-LICENSE
-          retention-days: 3
-          if-no-files-found: error
-
       - name: Upload the test binary (Linux)
         if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -309,7 +266,7 @@ jobs:
           ./xrpld --definitions | python3 -m json.tool >server_definitions.json
 
       - name: Upload server definitions
-        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'ubuntu-gcc-debug-amd64-coverage' }}
+        if: ${{ github.event.repository.visibility == 'public' && inputs.config_name == 'debian-gcc-release-amd64' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: server-definitions
@@ -369,21 +326,13 @@ jobs:
 
           LD_PRELOAD="$PRELOAD" ./xrpld --unittest --unittest-jobs "${BUILD_NPROC}" 2>&1 | tee "${GITHUB_WORKSPACE}/unittest.log"
 
-      - name: Run Rust tests
-        if: ${{ !inputs.build_only }}
-        working-directory: crates
-        run: cargo nextest run --workspace --all-features --locked --no-tests=warn
-
       # Smoke-run every benchmark module with a single repetition to confirm the
       # benchmarks still build and execute. This is a correctness check, not a
-      # performance measurement, so there is nothing to gain from repeating it
-      # across configurations: it is opted into by a single config in the
-      # strategy matrix (see the 'benchmark' flag in the JSON files), which
-      # keeps it off instrumented builds (sanitizers/coverage/voidstar), where
-      # it would be slow and meaningless, off Debug builds, where it is much
-      # slower, and off Windows, where the `install` target does not build them.
+      # performance measurement, so it is skipped for instrumented builds
+      # (sanitizers/coverage/voidstar), where it would be slow and meaningless,
+      # and on Windows, where the `install` target does not build them.
       - name: Run the benchmarks
-        if: ${{ inputs.benchmark }}
+        if: ${{ !inputs.build_only && runner.os != 'Windows' && env.SANITIZERS_ENABLED == 'false' && env.COVERAGE_ENABLED != 'true' && env.VOIDSTAR_ENABLED != 'true' }}
         working-directory: ${{ env.BUILD_DIR }}
         run: |
           rc=0
@@ -438,14 +387,13 @@ jobs:
               --target coverage
 
       - name: Upload coverage report
-        if: ${{ github.repository_owner == 'XRPLF' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
+        if: ${{ github.repository == 'XRPLF/rippled' && !inputs.build_only && env.COVERAGE_ENABLED == 'true' }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           disable_search: true
           disable_telem: true
           fail_ci_if_error: true
           files: ${{ env.BUILD_DIR }}/coverage.xml
-          flags: cpp
           plugins: noop
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true

.github/workflows/reusable-build-test.yml

@@ -40,7 +40,6 @@ jobs:
       fail-fast: ${{ github.event_name == 'merge_group' }}
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
     with:
-      benchmark: ${{ matrix.benchmark }}
       build_only: ${{ matrix.build_only }}
       build_type: ${{ matrix.build_type }}
       ccache_enabled: ${{ inputs.ccache_enabled }}
@@ -51,6 +50,5 @@ jobs:
       config_name: ${{ matrix.config_name }}
       sanitizers: ${{ matrix.sanitizers }}
       compiler: ${{ matrix.compiler || '' }}
-      toolchain: ${{ matrix.toolchain || '' }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/reusable-check-autogen.yml

@@ -1,76 +0,0 @@
-# This workflow checks that the generated protocol wrapper classes are
-# up-to-date with the macro files and generator scripts they are produced from,
-# see more info in include/xrpl/protocol_autogen/README.md.
-name: Check autogen
-
-# This workflow can only be triggered by other workflows.
-on: workflow_call
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}-autogen
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  BUILD_DIR: build/codegen
-
-jobs:
-  autogen:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
-        with:
-          python-version: "3.13"
-
-      # Code generation is pure Python, so the standalone project below offers
-      # the same targets as the main build without needing its dependencies or
-      # a compiler, which keeps this job down to a few seconds.
-      - name: Configure CMake
-        run: cmake -S cmake/codegen -B "${BUILD_DIR}"
-
-      - name: Install code generation dependencies
-        run: cmake --build "${BUILD_DIR}" --target setup_code_gen
-
-      - name: Generate code
-        run: cmake --build "${BUILD_DIR}" --target code_gen
-
-      - name: Check for differences
-        env:
-          MESSAGE: |
-
-            The generated protocol wrapper classes are out of date.
-
-            This typically happens when the macro files or generator scripts
-            have changed but the generated files were not regenerated.
-
-            Run the following from the repository root, then commit and push
-            the regenerated files. This needs neither the dependencies nor a
-            compiler. See include/xrpl/protocol_autogen/README.md for more info.
-
-              cmake -S cmake/codegen -B build/codegen
-              cmake --build build/codegen --target setup_code_gen
-              cmake --build build/codegen --target code_gen
-
-            In an already configured build directory, the 'setup_code_gen' and
-            'code_gen' targets do the same thing.
-        run: |
-          # Record untracked files in the index without staging their contents,
-          # so that classes generated for a newly added transaction or ledger
-          # entry type show up in the diff below rather than silently as an
-          # empty one.
-          git add --intent-to-add .
-          DIFF=$(git status --porcelain)
-          if [ -n "${DIFF}" ]; then
-              # Print the differences to give the contributor a hint about what to
-              # expect when running code generation on their own machine.
-              git diff
-              echo "${MESSAGE}"
-              exit 1
-          fi

.github/workflows/reusable-check-levelization.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check levelization
         run: python .github/scripts/levelization/generate.py
       - name: Check for differences

.github/workflows/reusable-check-rename.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Check definitions
         run: .github/scripts/rename/definitions.sh .
       - name: Check copyright notices

.github/workflows/reusable-clang-tidy.yml

@@ -27,23 +27,23 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-473fe44"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-3122de8"
     permissions:
       contents: read
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
         with:
           enable_ccache: false
 
@@ -59,12 +59,6 @@ jobs:
         with:
           compiler: ${{ env.COMPILER }}
 
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-        with:
-          cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
-
       - name: Setup Conan
         uses: ./.github/actions/setup-conan
 
@@ -86,13 +80,13 @@ jobs:
               -Dwerr=ON \
               -Dxrpld=ON \
               -Dverify_headers=ON \
-              -Drust=ON \
               ..
 
-      - name: Build clang-tidy prerequisites
+      # clang-tidy needs headers generated from proto files
+      - name: Build libxrpl.libpb
         working-directory: ${{ env.BUILD_DIR }}
         run: |
-          ninja -j ${{ steps.nproc.outputs.nproc }} tidy_prerequisites
+          ninja -j ${{ steps.nproc.outputs.nproc }} xrpl.libpb
 
       - name: Run clang tidy
         id: run_clang_tidy
@@ -101,7 +95,7 @@ jobs:
           TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'include src tests' }}
         run: |
           set -o pipefail
-          run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -format -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
+          run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
 
       - name: Print filtered clang-tidy errors
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}

.github/workflows/reusable-package.yml

@@ -1,40 +1,17 @@
-# Build, verify and publish Linux packages from the pre-built xrpld and
-# validator-keys artifacts, in three stages:
-#
-#   - 'package' builds and signs one format per config that carries a "package"
-#     map in linux.json; that map names the container image and the format
-#   - 'test-install' installs what was built on a range of distros and runs the
-#     binaries there, so a package that cannot be installed never reaches Nexus
-#   - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
-#     unless 'publish: true'
-#
-# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
+# Build Linux packages (DEB and RPM) from pre-built binary artifacts.
+# Discovers which configurations to package from linux.json (configs in
+# "package_configs") and fans out one job per distro. Only linux/amd64 is
+# supported; the runner is hardcoded in the job below.
 name: Package
 
 on:
   workflow_call:
     inputs:
-      publish:
-        description: "Whether to publish the packages after building them."
-        required: false
-        type: boolean
-        default: false
-      nexus_url:
-        description: "The base URL of the Nexus instance hosting the deb and rpm repositories."
+      pkg_release:
+        description: "Package release number. Increment when repackaging the same executable."
         required: false
         type: string
-        default: https://packages.xrplf.org
-
-    secrets:
-      remote_username:
-        description: "The username of a Nexus account with write access to the repositories."
-        required: false
-      remote_password:
-        description: "The password or token for that Nexus account."
-        required: false
-      signing_key:
-        description: "Armoured PGP private key used to sign the RPMs. Required when publishing."
-        required: false
+        default: "1"
 
 defaults:
   run:
@@ -42,7 +19,6 @@ defaults:
 
 env:
   BUILD_DIR: build
-  PACKAGE_DIR: packages
 
 jobs:
   generate-matrix:
@@ -51,7 +27,7 @@ jobs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -65,191 +41,11 @@ jobs:
 
   package:
     needs: [generate-matrix]
-    if: ${{ github.event.repository.visibility == 'public' || startsWith(github.ref, 'refs/tags/') }}
+    if: ${{ github.event.repository.visibility == 'public' }}
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    name: "${{ matrix.xrpld_artifact_name }}"
-    permissions:
-      contents: read
-    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: ${{ matrix.image }}
-    timeout-minutes: 10
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
-      - name: Download pre-built xrpld binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ matrix.xrpld_artifact_name }}
-          path: ${{ env.BUILD_DIR }}
-
-      - name: Download pre-built validator-keys binary
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ matrix.validator_keys_artifact_name }}
-          path: ${{ env.BUILD_DIR }}
-
-      - name: Make binaries executable
-        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
-
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
-
-      - name: Build package
-        env:
-          PACKAGE_TYPE: ${{ matrix.package_type }}
-          PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
-          CHANNEL: ${{ steps.release_info.outputs.channel }}
-        run: |
-          ./package/build_pkg.py \
-              --package-type "${PACKAGE_TYPE}" \
-              --build-dir "${BUILD_DIR}" \
-              --pkg-release "${PKG_RELEASE}" \
-              --channel "${CHANNEL}"
-
-      # Before the upload, so the artifact, the tested package and the published
-      # package are the same bytes.
-      - name: Sign RPM
-        if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
-        env:
-          PKG_SIGNING_KEY: ${{ secrets.signing_key }}
-        run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
-
-      # Split from the debug symbols, which are an order of magnitude larger, so
-      # that test-install downloads only what it installs.
-      - name: Upload package artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg
-          path: |
-            ${{ env.BUILD_DIR }}/debbuild/xrpld_*.deb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-[0-9]*.rpm
-          if-no-files-found: error
-
-      - name: Upload debug symbol artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
-          path: |
-            ${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.deb
-            ${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.ddeb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-debuginfo-*.rpm
-          if-no-files-found: error
-
-  # Every distro family the packages target, oldest release first, so both ends
-  # of the dependency range they declare are exercised.
-  test-install:
-    needs: [package]
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - package_type: deb
-            image: debian:11
-          - package_type: deb
-            image: debian:12
-          - package_type: deb
-            image: debian:13
-          - package_type: deb
-            image: ubuntu:20.04
-          - package_type: deb
-            image: ubuntu:22.04
-          - package_type: deb
-            image: ubuntu:24.04
-          - package_type: deb
-            image: ubuntu:26.04
-
-          - package_type: rpm
-            image: almalinux:9
-          - package_type: rpm
-            image: almalinux:10
-          - package_type: rpm
-            image: rockylinux/rockylinux:9
-          - package_type: rpm
-            image: rockylinux/rockylinux:10
-          - package_type: rpm
-            image: registry.access.redhat.com/ubi9/ubi
-          - package_type: rpm
-            image: registry.access.redhat.com/ubi10/ubi
-    name: "install ${{ matrix.package_type }} on ${{ matrix.image }}"
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    container: ${{ matrix.image }}
-    timeout-minutes: 5
-
-    steps:
-      # Both formats land in one directory; the step below picks its own by
-      # extension, so this stays independent of the artifact names.
-      - name: Download package artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: "*-pkg"
-          merge-multiple: true
-          path: ${{ env.PACKAGE_DIR }}
-
-      - name: Find the package
-        id: find
-        env:
-          PACKAGE_TYPE: ${{ matrix.package_type }}
-        run: |
-          package="$(find "${PACKAGE_DIR}" -type f -name "*.${PACKAGE_TYPE}" -print -quit)"
-          test -n "${package}" || {
-              echo "no .${PACKAGE_TYPE} found in ${PACKAGE_DIR}" >&2
-              exit 1
-          }
-          echo "package=${package}" >>"${GITHUB_OUTPUT}"
-
-      - name: Install the DEB
-        if: ${{ matrix.package_type == 'deb' }}
-        env:
-          DEBIAN_FRONTEND: noninteractive
-          PACKAGE: ${{ steps.find.outputs.package }}
-        run: |
-          # Stock Debian and Ubuntu images carry no package lists, so apt has
-          # nothing to resolve the systemd dependency from until it fetches them.
-          apt-get update -qq
-          apt-get install -y "./${PACKAGE}"
-
-      - name: Install the RPM
-        if: ${{ matrix.package_type == 'rpm' }}
-        env:
-          PACKAGE: ${{ steps.find.outputs.package }}
-        run: dnf install -y "./${PACKAGE}"
-
-      - name: Run xrpld
-        run: xrpld --version
-
-      - name: Run validator-keys
-        run: validator-keys --version
-
-      - name: Run rippled, the legacy compatibility symlink
-        run: rippled --version
-
-      - name: Check the service account
-        run: id xrpld
-
-      - name: Check the state directory
-        run: test -d /var/lib/xrpld
-
-      - name: Check the log directory
-        run: test -d /var/log/xrpld
-
-  publish:
-    needs: [generate-matrix, package, test-install]
-    strategy:
-      fail-fast: false
-      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
-    name: "publish ${{ matrix.xrpld_artifact_name }}"
+    name: "${{ matrix.artifact_name }}"
     permissions:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
@@ -258,35 +54,28 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
-      # Both artifacts, so the debug symbols are published alongside the package.
-      - name: Download package artifacts
+      - name: Download pre-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
-          merge-multiple: true
-          path: ${{ env.PACKAGE_DIR }}
+          name: ${{ matrix.artifact_name }}
+          path: ${{ env.BUILD_DIR }}
 
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
+      - name: Make binary executable
+        run: chmod +x "${BUILD_DIR}/xrpld"
 
-      - name: Publish package
+      - name: Build package
         env:
-          CHANNEL: ${{ steps.release_info.outputs.channel }}
-          DRY_RUN_OPTION: ${{ !inputs.publish && '--dry-run' || '' }}
-          NEXUS_URL: ${{ inputs.nexus_url }}
-          NEXUS_USERNAME: ${{ inputs.publish && secrets.remote_username || '' }}
-          NEXUS_PASSWORD: ${{ inputs.publish && secrets.remote_password || '' }}
-        run: |
-          publish_pkg.py \
-              --channel "${CHANNEL}" \
-              --package-dir "${PACKAGE_DIR}" \
-              --nexus-url "${NEXUS_URL}" \
-              ${DRY_RUN_OPTION}
+          PKG_RELEASE: ${{ inputs.pkg_release }}
+        run: ./package/build_pkg.sh
+
+      - name: Upload package artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.artifact_name }}-pkg
+          path: |
+            ${{ env.BUILD_DIR }}/debbuild/*.deb
+            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
+          if-no-files-found: error

.github/workflows/reusable-rust.yml

@@ -1,80 +0,0 @@
-# Clippy, coverage and documentation for the Rust crates in crates/. Each runs
-# as an independent job on a GitHub-hosted runner, but inside the same container
-# image used to build the crates in the C++/Corrosion path, so the toolchain
-# (and therefore the lints, coverage instrumentation and the cargo cache) matches
-# what production builds use.
-#
-# Rust unit tests are deliberately NOT run here. They run as part of the C++
-# build (reusable-build-test-config.yml), which already compiles the crates on a
-# self-hosted runner, so there is no need to provision a toolchain again.
-name: Rust
-
-on:
-  workflow_call:
-    secrets:
-      CODECOV_TOKEN:
-        description: "The Codecov token to use for uploading coverage reports."
-        required: true
-
-defaults:
-  run:
-    shell: bash
-    working-directory: crates
-
-permissions:
-  contents: read
-
-jobs:
-  clippy:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-
-      - name: Run clippy
-        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
-
-  coverage:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-
-      - name: Generate coverage report
-        run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
-
-      - name: Upload coverage report
-        if: ${{ github.repository == 'XRPLF/rippled' }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
-        with:
-          disable_search: true
-          disable_telem: true
-          fail_ci_if_error: true
-          files: crates/lcov.info
-          flags: rust
-          plugins: noop
-          token: ${{ secrets.CODECOV_TOKEN }}
-          verbose: true
-
-  doc:
-    runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Use cargo artifacts cache
-        uses: ./.github/actions/cargo-cache
-
-      - name: Build documentation
-        env:
-          RUSTDOCFLAGS: "-D warnings"
-        run: cargo doc --workspace --no-deps --all-features --locked

.github/workflows/reusable-strategy-matrix.yml

@@ -23,7 +23,7 @@ jobs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

.github/workflows/reusable-upload-recipe.yml

@@ -40,23 +40,18 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-3122de8
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
       CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
-        with:
-          enable_ccache: false
-
-      - name: Determine release info
-        id: release_info
-        uses: ./.github/actions/release-info
+      - name: Generate build version number
+        id: version
+        uses: ./.github/actions/generate-version
 
       - name: Set up Conan
         uses: ./.github/actions/setup-conan
@@ -69,8 +64,8 @@ jobs:
 
       - name: Upload Conan recipe (version)
         run: |
-          conan export . --version=${{ steps.release_info.outputs.version }}
-          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.release_info.outputs.version }}
+          conan export . --version=${{ steps.version.outputs.version }}
+          conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
 
       # When this workflow is triggered by a push event, it will always be when merging into the
       # 'develop' branch, see on-trigger.yml.
@@ -97,4 +92,4 @@ jobs:
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release
 
     outputs:
-      ref: xrpl/${{ steps.release_info.outputs.version }}
+      ref: xrpl/${{ steps.version.outputs.version }}

.github/workflows/upload-conan-deps.yml

@@ -65,18 +65,13 @@ jobs:
         uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4
 
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        uses: XRPLF/actions/prepare-runner@e4b6449d55a61c002d7c3fdfa6c20f721ede0606
         with:
           enable_ccache: false
 
-      # Before any step that uses a build tool, composite actions included.
-      - name: Setup Nix environment
-        if: ${{ matrix.toolchain == 'nix' }}
-        uses: ./.github/actions/setup-nix-env
-
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574
 
@@ -92,9 +87,7 @@ jobs:
         with:
           compiler: ${{ matrix.compiler }}
 
-      # `setup-nix-env` already did this for the Nix toolchain.
       - name: Setup Conan
-        if: ${{ matrix.toolchain != 'nix' }}
         env:
           SANITIZERS: ${{ matrix.sanitizers }}
         uses: ./.github/actions/setup-conan
@@ -113,10 +106,6 @@ jobs:
           log_verbosity: ${{ runner.os == 'Windows' && 'quiet' || 'verbose' }}
           sanitizers: ${{ matrix.sanitizers }}
 
-      - name: Check the Conan cache for Nix store references (Nix toolchain)
-        if: ${{ matrix.toolchain == 'nix' }}
-        run: ./bin/check-nix-store-refs.sh "${CONAN_HOME}"
-
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"

.gitignore

@@ -72,16 +72,11 @@ DerivedData
 /.zed/
 
 # AI tools.
-# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
-# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
-# personal/local variants below are ignored.
 /.agent
 /.agents
 /.augment
-/.claude/settings.local.json
-AGENTS.override.md
-CLAUDE.local.md
-GEMINI.local.md
+/.claude
+/CLAUDE.md
 
 # Python
 __pycache__
@@ -94,6 +89,3 @@ target/
 
 # clangd cache
 /.cache
-
-# Rust build directory
-crates/target

.pre-commit-config.yaml

@@ -62,15 +62,6 @@ repos:
         types_or: [c++, c, proto]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
-  - repo: local
-    hooks:
-      - id: cargo-fmt
-        name: cargo fmt
-        entry: cargo fmt --manifest-path crates/Cargo.toml --all
-        language: system
-        types: [rust]
-        pass_filenames: false # rustfmt formats the whole workspace
-
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
     rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
     hooks:
@@ -82,27 +73,11 @@ repos:
       - id: prettier
         args: [--end-of-line=auto]
 
-  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
-  # so widening these is its own change.
-  - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 7c55798a78262d14b2074abf623d8a992ebb70d4 # frozen: v0.16.2
-    hooks:
-      - id: ruff-check
-        args: [--fix]
-        files: ^package/.*\.py$
-
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
-  - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
-    hooks:
-      - id: mypy
-        args: [--strict]
-        files: ^package/.*\.py$
-
   - repo: https://github.com/scop/pre-commit-shfmt
     rev: 05c1426671b9237fb5e1444dd63aa5731bec0dfb # frozen: v3.13.1-1
     hooks:

AGENTS.md

@@ -1,42 +0,0 @@
-# AGENTS.md
-
-This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
-
-## Build
-
-Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
-
-```bash
-nix develop
-```
-
-For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
-
-Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
-
-## Testing
-
-Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
-
-- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
-- `--unittest-arg` does nothing — don't use it.
-- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
-- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
-
-## Lint/Format
-
-See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
-
-## Code Style
-
-New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
-
-## Architecture
-
-Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
-
-- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
-- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
-- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
-- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
-- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

API-CHANGELOG.md

@@ -22,47 +22,17 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## XRP Ledger server version 3.4.0
+## Unreleased
 
-Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
+This section contains changes targeting a future version.
 
-### Additions in 3.4.0
+### Additions
 
-- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
-
-### Bugfixes in 3.4.0
-
-- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
-- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
-- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
-- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
-- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
-- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
-
-## XRP Ledger server version 3.3.0
-
-[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
-
-### Additions in 3.3.0
-
-- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
-
-## XRP Ledger server version 3.2.1
-
-[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.2.0
-
-[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
-
-### Additions in 3.2.0
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
+  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
 
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
+
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
   - `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
   - `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -70,7 +40,7 @@ This release contains bug fixes only and no API changes.
   - `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
   - `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
 
-### Bugfixes in 3.2.0
+### Bugfixes
 
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -84,24 +54,6 @@ This release contains bug fixes only and no API changes.
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 
-## XRP Ledger server version 3.1.3
-
-[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.1.2
-
-[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
-
-This release contains bug fixes only and no API changes.
-
-## XRP Ledger server version 3.1.1
-
-[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
-
-This release contains bug fixes only and no API changes.
-
 ## XRP Ledger server version 3.1.0
 
 [Version 3.1.0](https://github.com/XRPLF/rippled/releases/tag/3.1.0) was released on Jan 27, 2026.

BUILD.md

@@ -4,14 +4,34 @@
 
 ## Minimum Requirements
 
-For the hardware needed to run a node, see
-[System Requirements](https://xrpl.org/system-requirements.html).
+See [System Requirements](https://xrpl.org/system-requirements.html).
 
-For the software needed to build xrpld, see the
-[environment setup guide](./docs/build/environment.md).
+Building xrpld generally requires Git, Python, Conan, CMake, and a C++
+compiler.
+
+- [Python](https://www.python.org/downloads/)
+- [Conan](https://conan.io/downloads.html)
+- [CMake](https://cmake.org/download/)
+
+You can verify that the required tools are installed and runnable with:
+
+```bash
+./bin/check-tools.sh
+```
+
+`xrpld` is written in the C++23 dialect. The [tested compiler versions][cpp23-support] are:
+
+| Compiler    | Version         |
+| ----------- | --------------- |
+| GCC         | 15.2            |
+| Clang       | 22              |
+| Apple Clang | 21              |
+| MSVC        | 19.44[^windows] |
 
 ## Operating Systems
 
+Please see the [environment setup guide](./docs/build/environment.md) for detailed instructions for all platforms.
+
 ### Linux
 
 The Ubuntu Linux distribution has received the highest level of quality
@@ -22,13 +42,12 @@ Our Linux CI tooling is distro-independent and uses a Nix-based environment, so
 ### macOS
 
 Many `xrpld` engineers use macOS for development.
-The minimum supported version is macOS 15 (Sequoia).
-CI testing is done in macOS 26 (Tahoe), but the build defaults `CMAKE_OSX_DEPLOYMENT_TARGET` to 15.
 
 ### Windows
 
-Windows is used by some engineers for development only, and is not recommended
-for production use.
+Windows is used by some engineers for development only.
+
+[^windows]: Windows is not recommended for production use.
 
 ## Steps
 
@@ -53,25 +72,37 @@ releases](https://github.com/XRPLF/rippled/releases).
 
 ### Set Up Conan
 
-Once your [development environment](./docs/build/environment.md) is ready, set
-Conan up for this repository:
+After you have a [C++ development environment](./docs/build/environment.md) ready with Git, Python,
+Conan, CMake, and a C++ compiler, you may need to set up your Conan profile.
+
+These instructions assume a basic familiarity with Conan and CMake. If you are
+unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
+[Getting Started][conan-getting-started] walkthrough.
+
+#### Profiles
+
+We recommend that you install our Conan profiles:
 
 ```bash
-./conan/init.sh
+conan config install conan/profiles/ -tf $(conan config home)/profiles/
 ```
 
-That installs our [`global.conf`](./conan/global.conf), our Conan
-[profiles](./conan/profiles), and the `xrplf` remote that hosts some of our
-dependencies. It honours `CONAN_HOME` and never deletes an existing Conan home,
-so it is safe to re-run — it only overwrites the files it manages.
+You can check your Conan profile by running:
 
-> [!TIP]
-> In the [Nix development shell](./docs/build/nix.md#conan-configuration) this is
-> already done for you: the script runs on entry.
+```bash
+conan profile show
+```
 
-You can inspect the resulting profile with `conan profile show`. If it is not
-suitable for your environment, create a custom profile and pass it to Conan — see
-[Advanced Conan configuration](./docs/build/advanced_conan.md).
+If the default profile is not suitable for your environment, you can create a custom profile and pass it to Conan.
+More information on customizing Conan can be found in the [Advanced Conan configuration](./docs/build/advanced_conan.md).
+
+#### Add xrplf remote
+
+Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
+
+```bash
+conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
+```
 
 ### Set Up Ccache
 
@@ -214,17 +245,7 @@ cmake --build . --target setup_code_gen  # create venv and install dependencies
 cmake --build . --target code_gen        # regenerate code
 ```
 
-The same targets are also available as a standalone project, which does not
-need the dependencies to be configured first:
-
-```
-cmake -S cmake/codegen -B build/codegen
-cmake --build build/codegen --target setup_code_gen
-cmake --build build/codegen --target code_gen
-```
-
-The regenerated files should be committed alongside your changes. CI verifies
-that they are up-to-date.
+The regenerated files should be committed alongside your changes.
 
 ## Coverage report
 
@@ -236,14 +257,10 @@ which is only enabled when the `coverage` option is set, e.g. with
 Prerequisites for the coverage report:
 
 - [gcovr tool][gcovr] (can be installed e.g. with [pip][python-pip])
-- `gcov` for GCC or `llvm-cov` for Clang, usually installed with the compiler
+- `gcov` for GCC (installed with the compiler by default) or
+- `llvm-cov` for Clang (installed with the compiler by default)
 - `Debug` build type
 
-> [!NOTE]
-> Clang coverage is not available in the [Nix development shell](./docs/build/nix.md#building-xrpld-in-the-nix-shell):
-> its `clang` shells do not ship `llvm-cov`. Use a `gcc` shell instead (`.#gcc`,
-> or `.#gcc-plain` on Linux), which provides a `gcov` matching its compiler.
-
 A coverage report is created when the following steps are completed, in order:
 
 1. `xrpld` binary built with instrumentation data, enabled by the `coverage`
@@ -304,7 +321,6 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 | ---------------- | ------------- | ----------------------------------------------------------------------------- |
 | `assert`         | OFF           | Force enabling assertions.                                                    |
 | `coverage`       | OFF           | Prepare the coverage report.                                                  |
-| `rust`           | OFF           | Build the Rust crates and the C++ code that depends on them.                  |
 | `tests`          | OFF           | Build tests.                                                                  |
 | `unity`          | OFF           | Configure a unity build.                                                      |
 | `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
@@ -317,30 +333,6 @@ memory) since they concatenate sources into fewer translation units. Non-unity
 builds may be faster for incremental builds, and can be helpful for detecting
 `#include` omissions.
 
-### Rust crates
-
-The Rust crates in `crates/` are only part of the build when `rust` is ON. With
-`-Drust=OFF` (the default) the `crates` directory is not added to the build, no
-cxxbridge bindings are generated, and the C++ tests that exercise the Rust
-interop are not compiled — so no Rust toolchain is needed. CI builds always pass
-`-Drust=ON`.
-
-With `-Drust=ON` you need one extra dependency: a Rust toolchain (`cargo`,
-`rustc`) matching the channel pinned in
-[`rust-toolchain.toml`](./rust-toolchain.toml), which compiles the crates and
-generates the cxxbridge bindings. It is provided by the
-[Nix development shell](./docs/build/nix.md), so `-Drust=ON` works there without
-any extra setup; otherwise install it as described in
-[Rust](./docs/build/environment.md#rust).
-
-The crates also have their own Rust unit tests. Those are run with `cargo` and
-need only the Rust toolchain, independently of CMake and of the `rust` option
-(CI runs them with `cargo nextest`):
-
-```bash
-cargo test --manifest-path crates/Cargo.toml --workspace
-```
-
 ### Verifying headers
 
 The regular build only compiles `.cpp` files, so a header is only ever checked
@@ -385,14 +377,10 @@ After any updates or changes to dependencies, you may need to do the following:
 4. [Regenerate lockfile](./docs/build/advanced_conan.md#conan-lockfile).
 5. Re-run [conan install](#build-and-test).
 
-If you are using the Nix development shell, whether prebuilt Conan binaries apply
-depends on your platform — see
-[Prebuilt packages](./docs/build/nix.md#prebuilt-packages).
-
 #### ERROR: Package not resolved
 
 If you're seeing an error like `ERROR: Package 'snappy/1.1.10' not resolved: Unable to find 'snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246' in remotes.`,
-please [set Conan up](#set-up-conan) so the `xrplf` remote is configured, or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
+please [add `xrplf` remote](#add-xrplf-remote) or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
 
 ### `protobuf/port_def.inc` file not found
 
@@ -412,6 +400,7 @@ For example, if you want to build Debug:
 1. For conan install, pass `--settings build_type=Debug`
 2. For cmake, pass `-DCMAKE_BUILD_TYPE=Debug`
 
+[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
 [conan-getting-started]: https://docs.conan.io/en/latest/getting_started.html
 [unity-build]: https://en.wikipedia.org/wiki/Unity_build
 [gcovr]: https://gcovr.com/en/stable/getting-started.html

CLAUDE.md

@@ -1 +0,0 @@
-AGENTS.md

CMakeLists.txt

@@ -13,23 +13,6 @@ if(DEFINED CMAKE_MODULE_PATH)
 endif()
 list(APPEND CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake")
 
-# Must be set before project() because project() consumes it when configuring the compiler and SDK.
-# A user-provided -DCMAKE_OSX_DEPLOYMENT_TARGET still takes precedence.
-#
-# CMAKE_SYSTEM_NAME can't be used before project(), so CMAKE_HOST_SYSTEM_NAME is used instead.
-#
-# When CMAKE_OSX_DEPLOYMENT_TARGET is bumped to >=26.0, FastFloat dependency won't be needed anymore
-if(
-    CMAKE_HOST_SYSTEM_NAME STREQUAL "Darwin"
-    AND NOT DEFINED CMAKE_OSX_DEPLOYMENT_TARGET
-)
-    set(CMAKE_OSX_DEPLOYMENT_TARGET
-        "15.0"
-        CACHE STRING
-        "Minimum macOS deployment version"
-    )
-endif()
-
 project(xrpl)
 set(CMAKE_CXX_EXTENSIONS OFF)
 set(CMAKE_CXX_STANDARD 23)
@@ -104,7 +87,6 @@ include(deps/Boost)
 add_subdirectory(external/antithesis-sdk)
 find_package(date REQUIRED)
 find_package(ed25519 REQUIRED)
-find_package(FastFloat REQUIRED)
 find_package(gRPC REQUIRED)
 find_package(LibArchive REQUIRED)
 find_package(lz4 REQUIRED)
@@ -120,7 +102,6 @@ target_link_libraries(
     xrpl_libs
     INTERFACE
         ed25519::ed25519
-        FastFloat::fast_float
         lz4::lz4
         mpt-crypto::mpt-crypto
         OpenSSL::Crypto
@@ -158,19 +139,11 @@ if(coverage)
     include(XrplCov)
 endif()
 
-add_custom_target(tidy_prerequisites)
-
-if(rust)
-    add_subdirectory(crates)
-endif()
 include(XrplCore)
-
 include(XrplProtocolAutogen)
 include(XrplInstall)
-include(XrplValidatorKeys)
-# Must come after XrplValidatorKeys: the 'package' target depends on the
-# validator-keys target existing.
 include(XrplPackaging)
+include(XrplValidatorKeys)
 
 if(tests)
     include(CTest)

CONTRIBUTING.md

@@ -59,17 +59,6 @@ to an existing XLS. Neither change will be released (in an amendment's
 case, marked as `Supported::yes`) until the corresponding XLS's status
 is `Final`.
 
-## AI coding agents
-
-[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
-
-If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
-
-- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
-- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
-
-Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
-
 ## Before making a pull request
 
 (Or marking a draft pull request as ready.)
@@ -93,7 +82,7 @@ If you create new source files, they must be organized as follows:
   under `include/xrpl`, and source (`.cpp`) files must go under
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
-- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
+- All test source files must go under `src/test`.
 - All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest
@@ -236,9 +225,8 @@ environment, so you don't need to install most of the individual tools
 yourself. The version of each hook sourced from an external repository
 (`clang-format`, `gersemi`, etc.) is pinned in that file, so running the hooks
 locally uses exactly the same versions as CI. A few `local` hooks — most notably
-`clang-tidy` and `cargo fmt` — run tools from your own environment; see
-[Installing clang-tidy](#installing-clang-tidy) and
-[Rust](./docs/build/environment.md#rust) for how to get those.
+`clang-tidy` — run tools from your own environment; see
+[Installing clang-tidy](#installing-clang-tidy) for how to get those.
 
 To get started, install `pre-commit` and enable the git hook scripts:
 
@@ -267,7 +255,6 @@ The hooks configured in this repository include, among others:
 - `clang-tidy` — C++ static analysis (see [Clang-tidy](#clang-tidy)); opt in with `TIDY=1`
 - `fix-include-style`, `fix-pragma-once`, `check-doxygen-style` — C++ hygiene
 - `gersemi` — CMake formatting
-- `cargo fmt` — Rust formatting for the crates in `crates/`
 - `prettier`, `black`, `shfmt` — formatting for JavaScript/JSON/Markdown, Python, and shell
 - `cspell` — spell checking
 
@@ -332,11 +319,7 @@ See the [environment setup guide](./docs/build/environment.md#clang-tidy) for ho
 
 ### Running clang-tidy locally
 
-Before running clang-tidy, you must generate the files it depends on (protobuf headers, and, when the project is configured with `-Drust=ON`, the cxxbridge headers from the Rust crates). Configure the project as described in [`BUILD.md`](./BUILD.md), then build the `tidy_prerequisites` target, which generates all of them:
-
-```bash
-cmake --build build --target tidy_prerequisites
-```
+Before running clang-tidy, you must build the project to generate required files (particularly protobuf headers). Refer to [`BUILD.md`](./BUILD.md) for build instructions.
 
 #### Via pre-commit (recommended)
 
@@ -365,14 +348,12 @@ run-clang-tidy -p build -allow-no-checks src tests
 ```
 
 This will check all source files in the `src`, `include` and `tests` directories using the compile commands from your `build` directory.
-If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix -format` to the above command:
+If you wish to automatically fix whatever clang-tidy finds _and_ is capable of fixing, add `-fix` to the above command:
 
 ```
-run-clang-tidy -p build -quiet -fix -format -allow-no-checks src tests
+run-clang-tidy -p build -quiet -fix -allow-no-checks src tests
 ```
 
-`-format` reformats the fixed code with [`.clang-format`](./.clang-format); without it the fixes are inserted in LLVM style and the `clang-format` hook rewrites them afterwards.
-
 ## Contracts and instrumentation
 
 We are using [Antithesis](https://antithesis.com/) for continuous fuzzing,

README.md

@@ -54,7 +54,6 @@ Here are some good places to start learning the source code:
 | `./docs`   | Source documentation files and doxygen config. |
 | `./cfg`    | Example configuration files.                   |
 | `./src`    | Source code.                                   |
-| `./crates` | Rust source code.                              |
 
 Some of the directories under `src` are external repositories included using
 git-subtree. See those directories' README files for more details.

bin/check-nix-store-refs.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-# Fail if a binary under <path> records a /nix/store path it resolves at run
-# time. See docs/build/nix.md#prebuilt-packages for why that matters.
-#
-# <path> is a file or a directory. macOS: nothing may reference the store, so
-# point it at whole trees. Linux: the toolchain always writes the store into
-# PT_INTERP and RUNPATH, so only at what cmake/PatchNixBinary.cmake retargets.
-#
-# Only Mach-O / ELF is inspected. Static archives hold store paths in debug info
-# alone; the scripts in a Conan cache are all git hook samples and autotools
-# scratch, 36 false positives to 0 real.
-#
-# Usage: bin/check-nix-store-refs.sh <path>
-
-set -euo pipefail
-
-if [ "$#" -ne 1 ]; then
-    echo "usage: $0 <path>" >&2
-    exit 2
-fi
-
-if [ ! -e "$1" ]; then
-    echo "$0: no such path: $1" >&2
-    exit 2
-fi
-
-case "$(uname -s)" in
-    Darwin)
-        format=Mach-O
-        recorded_paths=macho_recorded_paths
-        tool=otool
-        ;;
-    Linux)
-        format=ELF
-        recorded_paths=elf_recorded_paths
-        tool=readelf
-        ;;
-    *)
-        echo "Unsupported OS - skipping the Nix store reference check."
-        exit 0
-        ;;
-esac
-
-# `pipefail` would catch this too, but only as a bare nonzero exit.
-if ! command -v "${tool}" >/dev/null; then
-    echo "$0: ${tool} not found; cannot inspect binaries" >&2
-    exit 2
-fi
-
-# Both list what the file records. `ldd` would answer what this machine resolves
-# now, which is wrong both ways: store paths for a correctly patched binary,
-# silence for a store RUNPATH that resolves nowhere.
-
-# `name` covers LC_ID_DYLIB and LC_LOAD*_DYLIB, `path` covers LC_RPATH.
-macho_recorded_paths() {
-    otool -l "$1" | sed -nE 's#^ *(name|path) ([^ ]*).*#\2#p'
-}
-
-# RPATH and RUNPATH are colon-separated.
-elf_recorded_paths() {
-    readelf -ldW "$1" |
-        sed -nE \
-            -e 's#.*program interpreter: ([^]]*)\].*#\1#p' \
-            -e 's#.*\((RPATH|RUNPATH|NEEDED)\).*\[([^]]*)\].*#\2#p' |
-        tr ':' '\n'
-}
-
-checked=0
-skipped=0
-leaked=0
-
-while IFS= read -r file; do
-    case "$(file -b "${file}" 2>/dev/null)" in
-        *"${format}"*) ;;
-        *)
-            skipped=$((skipped + 1))
-            continue
-            ;;
-    esac
-    checked=$((checked + 1))
-
-    # Filter after extracting, or a search path starting elsewhere ($ORIGIN)
-    # hides the rest. `sed` not `grep`: grep calls "no matches" a failure, and
-    # the `|| true` that would need masks a broken pipeline too.
-    refs="$("${recorded_paths}" "${file}" | sed -n '\#^/nix/store/#p' | sort -u)"
-    if [ -n "${refs}" ]; then
-        leaked=$((leaked + 1))
-        echo "::error file=${file}::references the Nix store at run time"
-        echo "${file}"
-        echo "${refs}" | sed 's/^/    /'
-    fi
-done < <(find "$1" -type f \( -perm -u+x -o -name '*.dylib' -o -name '*.so*' \))
-
-echo "$1: checked ${checked}, skipped ${skipped}, ${leaked} with Nix store references."
-
-if [ "${leaked}" -ne 0 ]; then
-    cat >&2 <<'EOF'
-
-Fixes, in order of preference:
-  - A Conan package built before this check existed: drop it
-    (`conan remove '<name>/*'`) and rebuild.
-  - A binary that should have been retargeted to the system loader: check that
-    cmake/PatchNixBinary.cmake ran for it.
-  - Link the macOS system library instead of the Nix one - see
-    libresolvSystemStub in nix/darwin.nix.
-  - No system library exists (libstdc++): link it statically.
-  - None of the above: pin the toolchain into the package ID, following
-    `user.package:libc_version` in conan/profiles/ci.
-EOF
-    exit 1
-fi

bin/check-tools.sh

@@ -15,14 +15,10 @@
 #   - Windows: the core build tools only (CMake, Conan, Git, Python).
 #              MSVC is expected to be provided separately and is not checked here.
 #
-# Some tools (clang-format, clang-tidy, doxygen, gcovr, gh, git-cliff, gpg,
-# pre-commit, run-clang-tidy) are present in our Linux CI images and in local
-# development setups, but not in the macOS CI environment. They are checked
-# everywhere except when running in CI on macOS.
-#
-# Tools that Nix also exposes under a version-suffixed name (`clang-tidy-22`,
-# `g++-15`, ...) are probed under both names: a suffixed name can break while
-# the plain one still works (see mkVersionedToolLinks in nix/packages.nix).
+# Some tools (clang-format, doxygen, gcovr, gh, git-cliff, gpg, pre-commit,
+# run-clang-tidy) are present in our Linux CI images and in local development
+# setups, but not in the macOS CI environment. They are checked everywhere
+# except when running in CI on macOS.
 #
 # Environment variables:
 #   CI                      if set, skip the tools above when on macOS.
@@ -30,27 +26,12 @@
 
 set -uo pipefail
 
-# Version suffixes of the Nix tool links, tracking nix/packages.nix.
-gcc_version=15
-llvm_version=22
-
 missing=()
 checked=0
 
-# tool_path <name>
-# Fully resolved path of a tool, so the snapshots record which derivation
-# provides it. Prints nothing when it isn't on PATH.
-tool_path() {
-    local path
-    path="$(command -v "$1" 2>/dev/null)" || return 0
-    readlink -f "${path}" 2>/dev/null || printf '%s' "${path}"
-}
-
 # check <name> [probe-command...]
-# Runs the probe (default: "<name> --version"), capturing both stdout and
-# stderr, and prints three lines: the status and name, the first non-blank line
-# of the probe output (its version, or the error when it failed), and the tool's
-# resolved path. Records <name> as missing if it is not found or exits non-zero.
+# Runs the probe (default: "<name> --version") quietly. Records <name> as
+# missing if the command is not found or exits non-zero.
 check() {
     local name="$1"
     shift
@@ -59,18 +40,14 @@ check() {
         probe=("${name}" --version)
     fi
 
+    echo "Checking ${name}..."
     checked=$((checked + 1))
-    local output version path
-    path="$(tool_path "${name}")"
-    if output="$("${probe[@]}" 2>&1)"; then
-        printf '  ✅ %s\n' "${name}"
+    if "${probe[@]}" | head -n 1; then
+        printf '  [ ok ] %s\n' "${name}"
     else
-        printf '  ❌ %s\n' "${name}"
+        printf '  [MISS] %s\n' "${name}"
         missing+=("${name}")
     fi
-    version="$(printf '%s\n' "${output}" | grep -m1 '[^[:space:]]' || true)"
-    printf '     %s\n' "${version:-(no output)}"
-    printf '     %s\n' "${path:-(not found)}"
 }
 
 case "$(uname -s)" in
@@ -102,35 +79,24 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     echo "Development tooling:"
     check ccache
     check clang
-    check "clang-${llvm_version}"
     check clang++
-    check "clang++-${llvm_version}"
     check ClangBuildAnalyzer
     check curl
     check file
     check less
     check make
-    # net-tools netstat reports "net-tools X.Y"; macOS ships BSD netstat with no
-    # version flag, so fall back to a presence marker there.
-    check netstat sh -c 'command -v netstat >/dev/null && { netstat --version 2>&1 | grep -m1 -oE "net-tools [0-9.]+" || echo present; }'
+    check netstat which netstat
     check ninja
-    check perl perl -e 'print "$^V\n"'
+    check perl
     check pkg-config
     check vim
-    check zip bash -c 'zip --version 2>&1 | grep -m1 -oE "Zip [0-9.]+"'
+    check zip
 
     # These tools are present in our Linux CI images and in local development
     # setups, but not in the macOS CI environment. So check them everywhere
     # except when running in CI on macOS.
     if [ "${os}" = "linux" ] || [ -z "${CI:-}" ]; then
-        check clang-apply-replacements
-        check "clang-apply-replacements-${llvm_version}"
         check clang-format
-        check "clang-format-${llvm_version}"
-        # clang-tidy leads --version with the LLVM banner, not the version.
-        tidy_probe="--version | grep -m1 -oE 'LLVM version [0-9.]+'"
-        check clang-tidy sh -c "clang-tidy ${tidy_probe}"
-        check "clang-tidy-${llvm_version}" sh -c "clang-tidy-${llvm_version} ${tidy_probe}"
         check dot
         check doxygen
         check gcovr
@@ -141,7 +107,6 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
         # pre-commit, or its alternative implementation prek
         check pre-commit sh -c 'pre-commit --version || prek --version'
         check run-clang-tidy run-clang-tidy --help
-        check "run-clang-tidy-${llvm_version}" "run-clang-tidy-${llvm_version}" --help
     fi
 fi
 
@@ -156,7 +121,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
     check cargo-audit cargo audit --version
     check cargo-llvm-cov cargo llvm-cov --version
     check cargo-nextest cargo nextest --version
-    check clippy-driver
+    check clippy clippy-driver --version
     check rust-analyzer
     check rustc
     check rustfmt
@@ -168,11 +133,7 @@ if [ "${os}" = "linux" ]; then
     echo
     echo "GCC toolchain:"
     check gcc
-    check "gcc-${gcc_version}"
     check g++
-    check "g++-${gcc_version}"
-    check cpp
-    check "cpp-${gcc_version}"
     check gcov
 
     echo
@@ -197,9 +158,9 @@ else
     checked=$((checked + 1))
     tmp_clone="$(mktemp -d)"
     if git clone --depth 1 https://github.com/XRPLF/actions.git "${tmp_clone}/actions" >/dev/null 2>&1; then
-        printf '  ✅ git clone over HTTPS\n'
+        printf '  [ ok ] git clone over HTTPS\n'
     else
-        printf '  ❌ git clone over HTTPS\n'
+        printf '  [MISS] git clone over HTTPS\n'
         missing+=("git-https-clone")
     fi
     rm -rf "${tmp_clone}"
@@ -207,9 +168,9 @@ fi
 
 echo
 if [ "${#missing[@]}" -eq 0 ]; then
-    echo "✅ All ${checked} checked tools are present and runnable."
+    echo "All ${checked} checked tools are present and runnable."
 else
-    echo "❌ Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
+    echo "Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
     for tool in "${missing[@]}"; do
         echo "  - ${tool}" >&2
     done

bin/pre-commit/clang_tidy_check.py

@@ -144,11 +144,7 @@ def main():
             + files
         )
         canonicalize_fix_paths(Path(fixes_dir))
-        # `FormatStyle` in .clang-tidy does not reach this path,
-        # so ask for the repository style here.
-        applied = subprocess.run(
-            [clang_apply_replacements, "--format", "--style=file", fixes_dir]
-        )
+        applied = subprocess.run([clang_apply_replacements, fixes_dir])
 
     return result.returncode or applied.returncode
 

cfg/xrpld-example.cfg

@@ -488,17 +488,6 @@
 #   Must be a number between 100 and 1000, defaults to 250
 #
 #
-# [max_subscriptions_per_connection]
-#
-#   Maximum number of account, real-time account, and account-history
-#   subscriptions a single client connection may hold at once. Bounds the
-#   per-connection state torn down when the connection disconnects. Book
-#   subscriptions are tracked separately and are not counted here.
-#
-#   Defaults to 100000 if not set; large enough for legitimate power users
-#   such as block explorers.
-#
-#
 # [overlay]
 #
 #   Controls settings related to the peer to peer overlay.
@@ -549,45 +538,6 @@
 #       only be used for local testing and debugging. Do not disable
 #       on mainnet.
 #
-#   max_untrusted_count = <number>
-#
-#       The number of manifests the server keeps for validators it does not
-#       list, and the number it sends and processes in a single peer protocol
-#       message. Once the server holds this many, a manifest for a new
-#       unlisted validator is rejected, so peer gossip cannot grow the cache
-#       without end.
-#
-#       This option can take any value between 50 and 1000, inclusive. If
-#       the option is not present the server uses its built-in value.
-#
-#       The current default (which is subject to change) is 300.
-#
-#   max_trusted_count = <number>
-#
-#       The number of manifests for listed validators to allow for when
-#       sizing peer protocol messages. Manifests for listed validators are
-#       never dropped, whether sending or receiving, because doing so would
-#       delay a validator key change reaching this server. Set this above the
-#       number of validators the server lists.
-#
-#       Together the two counts above set the largest manifest message the
-#       server accepts: bigger messages are discarded without reading them,
-#       and without penalising the sender. Raising either means the server
-#       accepts and sends bigger messages than a peer using the defaults, and
-#       those peers will discard what this server sends. Lowering either below
-#       what peers send makes this server discard their manifest messages,
-#       which it does without recording anything.
-#
-#       This option can take any value between 50 and 1000, inclusive. If
-#       the option is not present the server uses its built-in value.
-#
-#       The current default (which is subject to change) is 300.
-#
-#       NOTE: These two options (max_untrusted_count and max_trusted_count)
-#       are transitional. They exist to bound manifest-message size and cache
-#       growth during the network upgrade. They may be removed in a future
-#       release once the fleet has upgraded, and should not be relied upon as
-#       stable configuration.
 #
 # [transaction_queue] EXPERIMENTAL
 #
@@ -1094,8 +1044,8 @@
 #                           Default is 100.
 #
 #       back_off_milliseconds
-#                           Number of milliseconds to wait between online_delete
-#                           SQL deletion batches to allow other functions
+#                           Number of milliseconds to wait between
+#                           online_delete batches to allow other functions
 #                           to catch up.
 #                           Default is 100.
 #
@@ -1109,22 +1059,10 @@
 #                           The online delete process checks periodically
 #                           that xrpld is still in sync with the network,
 #                           and that the validated ledger is less than
-#                           'age_threshold_seconds' old, and that all
-#                           recent ledgers are available. If not, then continue
+#                           'age_threshold_seconds' old. If not, then continue
 #                           sleeping for this number of seconds and
 #                           checking until healthy.
-#                           Default is 2.
-#
-#       max_waiting_ledgers
-#                           The maximum number of ledgers that may be validated
-#                           while online deletion is waiting for the node to get
-#                           fully synced with the rest of the network. If more than
-#                           this number of ledgers are validated while waiting, then
-#                           online deletion gives up on the current ledger and tries
-#                           again later. Note this only affects situations that cause
-#                           rotation to wait, such as going out of sync, or missing
-#                           ledgers. Forward progress is not penalized. Minimum is 64.
-#                           Default is the online_delete value.
+#                           Default is 5.
 #
 #   Notes:
 #       The 'node_db' entry configures the primary, persistent storage.

cmake/CompilationEnv.cmake

@@ -29,27 +29,6 @@ if(CMAKE_GENERATOR STREQUAL "Xcode")
     set(is_xcode TRUE)
 endif()
 
-# --------------------------------------------------------------------
-# Nix toolchain detection
-# --------------------------------------------------------------------
-# True when the C++ compiler resolves into the Nix store. CMAKE_CXX_COMPILER may
-# be referenced through a symlink outside the store (a Nix profile, a /usr/bin
-# alternative, ...), so resolve the real path before matching.
-set(is_nix_compiler FALSE)
-get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
-if(_cxx_real MATCHES "^/nix/store/")
-    set(is_nix_compiler TRUE)
-endif()
-unset(_cxx_real)
-
-# True inside the Nix CI Docker image, identified by the /nix/ci-env tree it
-# ships (see nix/docker/Dockerfile). The dev shell and bare systems don't have
-# it, so it distinguishes the CI image from other Nix-compiler environments.
-set(is_ci_image FALSE)
-if(EXISTS "/nix/ci-env/bin")
-    set(is_ci_image TRUE)
-endif()
-
 # --------------------------------------------------------------------
 # Operating system detection
 # --------------------------------------------------------------------

cmake/PatchNixBinary.cmake

@@ -1,38 +1,26 @@
 #[===================================================================[
    Patch executables to run in non-Nix environments.
 
-   The Nix toolchain links binaries against an ELF interpreter (loader)
+   The Nix-based CI image links binaries against an ELF interpreter (loader)
    that lives in the Nix store, so the resulting binaries don't run elsewhere
-   (including once installed from the .deb package). `patch_nix_binary` resets
-   the interpreter to the system default loader and drops the rpath, once the
-   binary has been linked.
+   (including once installed from the .deb package). `patch_nix_binary` adds a
+   POST_BUILD step that resets the interpreter to the system default loader and
+   drops the rpath.
 
-   This runs by default for Nix-toolchain builds (determined by whether the compiler resolves under /nix/store/).
-   Those builds are where binaries get a Nix-store loader.
-   It is opted out of by setting the XRPLD_NO_PATCH_NIX_BINARY environment variable —
-   the plain Nix dev shells set it, since their binaries link a newer glibc
-   and must not be retargeted to the system loader.
-
-   Non-Nix builds (a system compiler, already using the system loader) and sanitizer builds
-   (runtime libraries resolved through the rpath) are skipped too.
-   Everywhere else `patch_nix_binary` is a no-op.
-
-   The default loader is resolved by bin/default-loader-path.sh.
+   This is only active inside the Nix-based image, detected by the presence of
+   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
+   is skipped for sanitizer builds, whose runtime libraries are resolved through
+   the rpath. Everywhere else `patch_nix_binary` is a no-op.
 #]===================================================================]
 
 include_guard(GLOBAL)
 
 include(CompilationEnv)
 
-# Resolves the system default ELF loader path for the current architecture.
-set(_loader_path_script "${CMAKE_SOURCE_DIR}/bin/default-loader-path.sh")
+# Provided by the Nix-based CI image; prints the system default ELF loader path.
+set(_loader_path_script "/tmp/loader-path.sh")
 
-if(
-    is_linux
-    AND NOT SANITIZERS_ENABLED
-    AND is_nix_compiler
-    AND NOT DEFINED ENV{XRPLD_NO_PATCH_NIX_BINARY}
-)
+if(is_linux AND NOT SANITIZERS_ENABLED AND EXISTS "${_loader_path_script}")
     execute_process(
         COMMAND "${_loader_path_script}"
         OUTPUT_VARIABLE DEFAULT_LOADER_PATH
@@ -53,38 +41,13 @@ function(patch_nix_binary target)
     if(NOT PATCH_NIX_BINARIES)
         return()
     endif()
-
-    set(patch_command
-        "${PATCHELF_COMMAND}"
-        --set-interpreter
-        "${DEFAULT_LOADER_PATH}"
-        --remove-rpath
-        "$<TARGET_FILE:${target}>"
+    add_custom_command(
+        TARGET ${target}
+        POST_BUILD
+        COMMAND
+            "${PATCHELF_COMMAND}" --set-interpreter "${DEFAULT_LOADER_PATH}"
+            --remove-rpath "$<TARGET_FILE:${target}>"
+        COMMENT "Patching ${target}: set default loader, remove rpath"
+        VERBATIM
     )
-    set(comment "Patching ${target}: set default loader, remove rpath")
-
-    # POST_BUILD is the cheap way to do this: it runs only when the binary is
-    # relinked. It is also only available in the directory that defined the
-    # target, so for a target from elsewhere (e.g. a FetchContent subproject)
-    # fall back to a custom target that runs after the binary is linked. That
-    # one runs on every build, which is harmless because patchelf is idempotent.
-    get_target_property(target_source_dir ${target} SOURCE_DIR)
-    if("${target_source_dir}" STREQUAL "${CMAKE_CURRENT_SOURCE_DIR}")
-        add_custom_command(
-            TARGET ${target}
-            POST_BUILD
-            COMMAND ${patch_command}
-            COMMENT "${comment}"
-            VERBATIM
-        )
-    else()
-        add_custom_target(
-            ${target}-patch-nix
-            ALL
-            COMMAND ${patch_command}
-            COMMENT "${comment}"
-            VERBATIM
-        )
-        add_dependencies(${target}-patch-nix ${target})
-    endif()
 endfunction()

cmake/XrplAddBenchmark.cmake

@@ -1,5 +1,3 @@
-include_guard()
-
 include(isolate_headers)
 
 # Define a benchmark executable for the module `name`.

cmake/XrplCompiler.cmake

@@ -120,10 +120,7 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(
-        common
-        INTERFACE -errorreport:none -machine:X64 -ignore:4099
-    )
+    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
 else()
     target_compile_options(
         common
@@ -174,8 +171,9 @@ else()
     # Clang wrapper supplies those paths itself (via -nostdinc++), so at compile time the
     # flag is unused -> Clang errors under our -Werror. At link time the flag IS consumed
     # (it selects the C++ runtime), so we move it there instead of dropping it entirely.
+    get_filename_component(_cxx_real "${CMAKE_CXX_COMPILER}" REALPATH)
     if(
-        is_nix_compiler
+        _cxx_real MATCHES "^/nix/store/"
         AND is_linux
         AND is_clang
         AND CMAKE_CXX_FLAGS MATCHES "stdlib=libstdc"
@@ -269,50 +267,10 @@ elseif(use_lld)
     )
     if("${LD_VERSION}" MATCHES "LLD")
         target_link_libraries(common INTERFACE -fuse-ld=lld)
-        # remembered for the linker flag probe below
-        set(fuse_ld_flag "-fuse-ld=lld")
     endif()
     unset(LD_VERSION)
 endif()
 
-# Linker warnings are errors where we control the toolchain and the dependencies: CI and the Nix dev shell.
-# On non-Nix macOS we suppress the deployment target warning: an old Conan profile may not pin os.version.
-# Only the new Apple linker understands the flag, so probe the actual linker (lld may be selected above).
-if(is_macos OR is_linux)
-    if(is_ci OR is_nix_compiler)
-        if(is_macos)
-            set(fatal_warnings_flag "-Wl,-fatal_warnings")
-        else()
-            set(fatal_warnings_flag "-Wl,--fatal-warnings")
-        endif()
-        message(
-            STATUS
-            "Treating all linker warnings as errors (${fatal_warnings_flag})"
-        )
-        target_link_options(common INTERFACE "${fatal_warnings_flag}")
-        unset(fatal_warnings_flag)
-    elseif(is_macos)
-        set(silence_flag "-Wl,-deployment_target_mismatches,suppress")
-        set(probe_flags ${fuse_ld_flag} "${silence_flag}")
-        include(CheckLinkerFlag)
-        check_linker_flag(
-            CXX
-            "${probe_flags}"
-            have_deployment_target_mismatches
-        )
-        if(have_deployment_target_mismatches)
-            message(
-                STATUS
-                "Silencing macOS deployment target mismatch warnings (${silence_flag})"
-            )
-            target_link_options(common INTERFACE "${silence_flag}")
-        endif()
-        unset(probe_flags)
-        unset(silence_flag)
-    endif()
-endif()
-unset(fuse_ld_flag)
-
 if(assert)
     foreach(var_ CMAKE_C_FLAGS_RELEASE CMAKE_CXX_FLAGS_RELEASE)
         string(REGEX REPLACE "[-/]DNDEBUG" "" ${var_} "${${var_}}")

cmake/XrplCore.cmake

@@ -51,8 +51,6 @@ target_compile_options(
 
 target_link_libraries(xrpl.libpb PUBLIC protobuf::libprotobuf gRPC::grpc++)
 
-add_dependencies(tidy_prerequisites xrpl.libpb)
-
 # TODO: Clean up the number of library targets later.
 add_library(xrpl.imports.main INTERFACE)
 

cmake/XrplCov.cmake

@@ -44,7 +44,6 @@ setup_target_for_coverage_gcovr(
     EXCLUDE
         "src/test"
         "src/tests"
-        "src/benchmarks"
         "include/xrpl/beast/test"
         "include/xrpl/beast/unit_test"
         "${CMAKE_BINARY_DIR}/pb-xrpl.libpb"

cmake/XrplPackaging.cmake

@@ -1,7 +1,7 @@
 #[===================================================================[
    Linux packaging support: 'package' target.
 
-   The packaging script (package/build_pkg.py) installs to FHS-standard
+   The packaging script (package/build_pkg.sh) installs to FHS-standard
    paths (/usr/bin, /etc/xrpld, etc.) regardless of CMAKE_INSTALL_PREFIX,
    so no prefix guard is needed here.
 #]===================================================================]
@@ -25,33 +25,19 @@ if(NOT (RPMBUILD_EXECUTABLE OR DPKG_BUILDPACKAGE_EXECUTABLE))
     return()
 endif()
 
-if(NOT TARGET xrpld)
-    message(STATUS "xrpld=ON is required; 'package' target not available")
-    return()
-endif()
-
-if(NOT TARGET validator-keys)
-    message(
-        STATUS
-        "validator_keys=ON is required; 'package' target not available"
-    )
-    return()
-endif()
-
-if(DPKG_BUILDPACKAGE_EXECUTABLE)
-    set(pkg_type deb)
-else()
-    set(pkg_type rpm)
-endif()
+set(package_env
+    SRC_DIR=${CMAKE_SOURCE_DIR}
+    BUILD_DIR=${CMAKE_BINARY_DIR}
+    PKG_RELEASE=${pkg_release}
+)
 
 add_custom_target(
     package
     COMMAND
-        ${CMAKE_SOURCE_DIR}/package/build_pkg.py --package-type=${pkg_type}
-        --build-dir=${CMAKE_BINARY_DIR} --pkg-release=${pkg_release}
-        --channel=UNRELEASED
+        ${CMAKE_COMMAND} -E env ${package_env}
+        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-    DEPENDS xrpld validator-keys
-    COMMENT "Building Linux ${pkg_type} package"
+    DEPENDS xrpld
+    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
     VERBATIM
 )

cmake/XrplProtocolAutogen.cmake

@@ -2,22 +2,21 @@
    Protocol Autogen - Code generation for protocol wrapper classes
 #]===================================================================]
 
-# The repository root, derived from the location of this file rather than from
-# the including project, so that the targets below can also be offered on their
-# own by cmake/codegen/CMakeLists.txt.
-get_filename_component(XRPL_ROOT "${CMAKE_CURRENT_LIST_DIR}/.." ABSOLUTE)
-
 set(CODEGEN_VENV_DIR
-    "${XRPL_ROOT}/.venv"
+    "${CMAKE_CURRENT_SOURCE_DIR}/.venv"
     CACHE PATH
     "Path to a Python virtual environment for code generation. A venv will be created here by setup_code_gen and used to run generation scripts."
 )
 
 # Directory paths
-set(MACRO_DIR "${XRPL_ROOT}/include/xrpl/protocol/detail")
-set(AUTOGEN_HEADER_DIR "${XRPL_ROOT}/include/xrpl/protocol_autogen")
-set(AUTOGEN_TEST_DIR "${XRPL_ROOT}/src/tests/libxrpl/protocol_autogen")
-set(SCRIPTS_DIR "${XRPL_ROOT}/cmake/scripts/codegen")
+set(MACRO_DIR "${CMAKE_CURRENT_SOURCE_DIR}/include/xrpl/protocol/detail")
+set(AUTOGEN_HEADER_DIR
+    "${CMAKE_CURRENT_SOURCE_DIR}/include/xrpl/protocol_autogen"
+)
+set(AUTOGEN_TEST_DIR
+    "${CMAKE_CURRENT_SOURCE_DIR}/src/tests/libxrpl/protocol_autogen"
+)
+set(SCRIPTS_DIR "${CMAKE_CURRENT_SOURCE_DIR}/cmake/scripts/codegen")
 
 # Input macro files
 set(TRANSACTIONS_MACRO "${MACRO_DIR}/transactions.macro")
@@ -115,14 +114,14 @@ if(CODEGEN_VENV_DIR)
         setup_code_gen
         COMMAND ${Python3_EXECUTABLE} -m venv "${CODEGEN_VENV_DIR}"
         COMMAND ${CODEGEN_PYTHON} -m pip install -r "${REQUIREMENTS_FILE}"
-        WORKING_DIRECTORY "${XRPL_ROOT}"
+        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
         COMMENT "Creating venv and installing code generation dependencies..."
     )
 else()
     add_custom_target(
         setup_code_gen
         COMMAND ${Python3_EXECUTABLE} -m pip install -r "${REQUIREMENTS_FILE}"
-        WORKING_DIRECTORY "${XRPL_ROOT}"
+        WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
         COMMENT "Installing code generation dependencies..."
     )
 endif()
@@ -140,8 +139,8 @@ add_custom_target(
         -DSFIELDS_MACRO=${SFIELDS_MACRO}
         -DAUTOGEN_HEADER_DIR=${AUTOGEN_HEADER_DIR}
         -DAUTOGEN_TEST_DIR=${AUTOGEN_TEST_DIR} -P
-        "${CMAKE_CURRENT_LIST_DIR}/XrplProtocolAutogenRun.cmake"
-    WORKING_DIRECTORY "${XRPL_ROOT}"
+        "${CMAKE_CURRENT_SOURCE_DIR}/cmake/XrplProtocolAutogenRun.cmake"
+    WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}"
     COMMENT "Running protocol code generation..."
     SOURCES ${ALL_INPUT_FILES}
 )

cmake/XrplSanity.cmake

@@ -36,19 +36,6 @@ elseif(is_gcc)
     endif()
 endif()
 
-# A Nix compiler is only meant to be used from a managed environment: the xrpld
-# dev shell (which exports XRPL_DEVSHELL) or the CI image. Using one from a bare
-# shell usually means a leaked toolchain (picked up via PATH or a Conan profile)
-# and leads to confusing breakage, so fail early with guidance.
-if(is_nix_compiler AND NOT is_ci_image AND NOT DEFINED ENV{XRPL_DEVSHELL})
-    message(
-        FATAL_ERROR
-        "A Nix compiler (${CMAKE_CXX_COMPILER}) is being used outside the xrpld "
-        "dev shell. Enter it with `nix develop` (see docs/build/nix.md) before "
-        "configuring the build."
-    )
-endif()
-
 # check for in-source build and fail
 if("${CMAKE_CURRENT_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
     message(

cmake/XrplSettings.cmake

@@ -32,11 +32,6 @@ endif()
 
 option(benchmark "Build benchmarks" ON)
 
-# When OFF, the crates directory is not added to the build at all: no Rust
-# toolchain is required, no cxxbridge bindings are generated, and the C++ tests
-# that consume those bindings are left out of the build tree.
-option(rust "Build the Rust crates and the C++ code that depends on them" OFF)
-
 # Enabled by default so every header is compiled on its own as the main file of
 # its own compile_commands.json entry - this is what lets clang-tidy (and clangd
 # and IDEs) analyse a header's own includes directly. The per-header objects are

cmake/XrplValidatorKeys.cmake

@@ -5,39 +5,22 @@ option(
 )
 
 if(validator_keys)
-    # Own the install destination below rather than relying on another module
-    # having pulled this in first.
-    include(GNUInstallDirs)
-
-    # Pinned to an exact commit, not a branch: the tool ships inside our
-    # packages, so the same xrpld version must always package the same
-    # validator-keys. Bump this deliberately.
-    set(validator_keys_commit "4c0fb75eec9601c711645998c904507e87e910ae")
-    message(STATUS "Using ValidatorKeys commit: ${validator_keys_commit}")
+    git_branch(current_branch)
+    # default to tracking VK master branch unless we are on release
+    if(NOT (current_branch STREQUAL "release"))
+        set(current_branch "master")
+    endif()
+    message(STATUS "Tracking ValidatorKeys branch: ${current_branch}")
 
     FetchContent_Declare(
         validator_keys
         GIT_REPOSITORY https://github.com/ripple/validator-keys-tool.git
-        GIT_TAG "${validator_keys_commit}"
+        GIT_TAG "${current_branch}"
     )
     FetchContent_MakeAvailable(validator_keys)
-    # The tool's own CMakeLists excludes the target from 'all' when it is built
-    # as a subproject. Undo that, so validator_keys=ON really does build it.
     set_target_properties(
         validator-keys
-        PROPERTIES
-            RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
-            EXCLUDE_FROM_ALL OFF
-            EXCLUDE_FROM_DEFAULT_BUILD OFF
-    )
-    # We ship this binary, so like xrpld it must not keep the Nix store's ELF
-    # loader, or it cannot run on the target distro at all.
-    patch_nix_binary(validator-keys)
-
-    configure_file(
-        "${validator_keys_SOURCE_DIR}/LICENSE"
-        "${CMAKE_BINARY_DIR}/validator-keys-LICENSE"
-        COPYONLY
+        PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
     )
     install(TARGETS validator-keys RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
 endif()

cmake/codegen/CMakeLists.txt

@@ -1,21 +0,0 @@
-#[===================================================================[
-   Protocol Autogen - Standalone project
-
-   Exposes the 'setup_code_gen' and 'code_gen' targets on their own, without
-   configuring the rest of xrpl. Code generation is pure Python, so this needs
-   neither the dependencies nor a compiler, which makes it usable in CI and by
-   contributors who only want to regenerate the protocol wrapper classes:
-
-     cmake -S cmake/codegen -B build/codegen
-     cmake --build build/codegen --target setup_code_gen
-     cmake --build build/codegen --target code_gen
-
-   The targets are identical to the ones offered by the top-level build, since
-   both come from cmake/XrplProtocolAutogen.cmake.
-#]===================================================================]
-
-cmake_minimum_required(VERSION 3.16)
-
-project(xrpl_codegen LANGUAGES NONE)
-
-include("${CMAKE_CURRENT_LIST_DIR}/../XrplProtocolAutogen.cmake")

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,7 +8,6 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
-import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -54,89 +53,28 @@ def create_transaction_parser():
     return macro_parser
 
 
-# Defaults for xrpl::TxSettings members, mirroring
-# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
-# the members that differ from these.
-SETTING_DEFAULTS = {
-    "delegable": "Delegation::NotDelegable",
-    "amendment": "uint256{}",
-    "privileges": "Privilege::NoPriv",
-}
-
-
-def parse_settings(settings_str):
-    """Parse a TxSettings blob into a dict, filling in defaults.
-
-    Args:
-        settings_str: A string like '({.delegable = Delegation::NotDelegable,
-                      .privileges = Privilege::CreateAcct})', or '({})'.
-
-    Returns:
-        A dict with a value for every key in SETTING_DEFAULTS.
-    """
-    body = settings_str.strip()
-    if not (body.startswith("(") and body.endswith(")")):
-        raise ValueError(
-            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
-        )
-    body = body[1:-1].strip()
-    if not (body.startswith("{") and body.endswith("}")):
-        raise ValueError(
-            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
-        )
-    body = body[1:-1]
-
-    # Strip comments, which may be interleaved with the designated initializers.
-    body = re.sub(r"//[^\n]*", "", body)
-
-    settings = dict(SETTING_DEFAULTS)
-    seen = set()
-    # Each entry runs from '.key =' up to the next '.key =' or the end.
-    for key, value in re.findall(
-        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
-    ):
-        if key not in SETTING_DEFAULTS:
-            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
-        settings[key] = " ".join(value.split()).rstrip(",")
-        seen.add(key)
-
-    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
-    # Every '.member' in the blob must have been consumed above.
-    if len(re.findall(r"\.\w+", body)) != len(seen):
-        raise ValueError(f"Could not parse every setting in {settings_str!r}")
-
-    # A blob with content but no designated initializer is positional, which
-    # would otherwise be read as "all defaults" and silently generate the
-    # wrong output.
-    if body.strip() and not seen:
-        raise ValueError(
-            "TxSettings requires designated initializers (.member = value), "
-            f"got {settings_str!r}"
-        )
-
-    return settings
-
-
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment',
-                    '({.privileges = Privilege::CreateAcct})', '({...})']
+                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
+                    'uint256{}', 'createAcct', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 5:
+    if len(args_list) < 7:
         raise ValueError(
-            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    settings = parse_settings(args_list[3])
+    delegable = args_list[3]
+    amendments = args_list[4]
+    privileges = args_list[5]
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -146,9 +84,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": settings["delegable"],
-        "amendments": settings["amendment"],
-        "privileges": settings["privileges"],
+        "delegable": delegable,
+        "amendments": amendments,
+        "privileges": privileges,
         "fields": fields,
     }
 

conan.lock

@@ -12,7 +12,7 @@
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
         "openssl/3.6.3#f806de8933e3bf6f01016c6a888cee2e%1783945160.863288",
         "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/1.0.2#b313cef0c1a493eb970ad185b2e9bab7%1784285108.866483",
+        "mpt-crypto/0.4.0-rc4#ffdba12f2332357f0d8b0ae944cfff52%1784138702.932355",
         "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
         "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
         "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
@@ -20,10 +20,8 @@
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
         "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
         "grpc/1.81.1#f729f6d75992d20f9c72828e9142d62f%1783945160.094135",
-        "fast_float/8.2.10#f6f28d6bb22112078e7dbda611caf681%1782494504.298",
         "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
         "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
-        "corrosion/0.6.1#bfa292df0a957bc70a450ff316cd9435%1786119416.131296",
         "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
         "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
         "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
@@ -36,7 +34,7 @@
         "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
         "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#1727f439cf74e83826ec96d0b4904eee%1784541921.659",
+        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
         "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
         "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",

conan/init.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-# Install our Conan configuration, profiles and the xrplf remote into CONAN_HOME.
-# Safe to re-run; never deletes the Conan home.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
-CONAN_DIR="$(conan config home)"
-
-echo "Installing Conan configuration into ${CONAN_DIR}"
-conan config install "${SCRIPT_DIR}/global.conf"
-conan config install "${SCRIPT_DIR}/profiles" -tf "${CONAN_DIR}/profiles"
-# This script manages these files, so make them read-only - Conan does not
-# preserve the source mode. Only the files: the directories must stay writable
-# for `conan config install` to replace them.
-chmod a-w "${CONAN_DIR}/global.conf"
-find "${CONAN_DIR}/profiles" -type f -exec chmod a-w {} +
-
-echo "Adding the xrplf Conan remote"
-# --index 0: our patched recipes must win over Conan Center.
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/

conan/profiles/default

@@ -1,13 +1,9 @@
 {% set os = detect_api.detect_os() %}
 {% set arch = detect_api.detect_arch() %}
 {% set compiler, version, compiler_exe = detect_api.detect_default_compiler() %}
+{% set compiler_version = version %}
+{% if os == "Linux" %}
 {% set compiler_version = detect_api.default_compiler_version(compiler, version) %}
-{% if os == "Macos" %}
-{# Minimum macOS the dependencies target. #}
-{# Without this, Conan builds each dependency against the (possibly newer) host SDK, so the #}
-{# dependency objects target a newer macOS than the binary and the linker warns. #}
-{# Keep at or below CMAKE_OSX_DEPLOYMENT_TARGET in CMakeLists.txt. #}
-{% set min_macos_version = "15.0" %}
 {% endif %}
 
 [settings]
@@ -22,9 +18,6 @@ compiler.runtime=static
 {% else %}
 compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
 {% endif %}
-{% if os == "Macos" %}
-os.version={{ min_macos_version }}
-{% endif %}
 
 [conf]
 {# The Boost recipe builds with b2, which doesn't use Conan's toolchain files. #}
@@ -48,13 +41,3 @@ tools.build:compiler_executables={'c':'{{ cc_exe }}','cpp':'{{ cxx_exe }}'}
 {# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
 user.package:cppstd_version=23
 tools.info.package_id:confs+=["user.package:cppstd_version"]
-
-{% if os == "Macos" %}
-[buildenv]
-{# os.version adds -mmacosx-version-min to compiler command lines, #}
-{# but Boost.Context's b2 assembly (.S) rule ignores it, #}
-{# so those objects keep the host SDK version and still warn at link time. #}
-{# clang's assembler honors this env var regardless, pinning them. #}
-{# Scoped to boost/* since it is the only gap. #}
-boost/*:MACOSX_DEPLOYMENT_TARGET={{ min_macos_version }}
-{% endif %}

conanfile.py

@@ -28,9 +28,7 @@ class Xrpl(ConanFile):
     }
 
     requires = [
-        "corrosion/0.6.1",
         "ed25519/2015.03",
-        "fast_float/8.2.10",
         "grpc/1.81.1",
         "libarchive/3.8.7",
         "nudb/2.0.9",
@@ -140,7 +138,7 @@ class Xrpl(ConanFile):
         if self.options.jemalloc:
             self.requires("jemalloc/5.3.1")
         self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/1.0.2", transitive_headers=True)
+        self.requires("mpt-crypto/0.4.0-rc4", transitive_headers=True)
         self.requires("protobuf/6.33.5", force=True)
         if self.options.rocksdb:
             self.requires("rocksdb/10.5.1")
@@ -213,7 +211,6 @@ class Xrpl(ConanFile):
             "boost::thread",
             "date::date",
             "ed25519::ed25519",
-            "fast_float::fast_float",
             "grpc::grpc++",
             "libarchive::libarchive",
             "lz4::lz4",

crates/.cargo/config.toml

@@ -1,17 +0,0 @@
-# The Rust static libraries are linked into C++ targets, so the runtime linkage
-# here has to match what the C++ build uses (see cmake/XrplCompiler.cmake).
-#
-# macOS needs nothing: AppleClang cannot link libgcc/libc++ statically, so the
-# C++ build skips those flags on Apple as well.
-
-# Both amd64 and arm64 Linux builds link libgcc statically. This only affects
-# links that rustc itself drives (`cargo test` binaries and the like) — the
-# `staticlib` crates consumed by CMake are archived, not linked, so rustc
-# silently ignores link args for them. Keeping libgcc_s.so.1 off the xrpld link
-# line is handled in crates/CMakeLists.txt instead.
-[target.'cfg(target_os = "linux")']
-rustflags = ["-C", "link-args=-static-libgcc"]
-
-# Windows builds use the static MSVC runtime.
-[target.'cfg(windows)']
-rustflags = ["-C", "target-feature=+crt-static"]

crates/CMakeLists.txt

@@ -1,104 +0,0 @@
-find_package(Corrosion REQUIRED)
-
-corrosion_import_crate(MANIFEST_PATH ${CMAKE_CURRENT_SOURCE_DIR}/Cargo.toml)
-
-# The generated C++ lands in the build tree, so put a .clang-tidy next to it to
-# keep clang-tidy from analyzing code we don't own.
-configure_file(
-    generated.clang-tidy
-    "${CMAKE_CURRENT_BINARY_DIR}/.clang-tidy"
-    COPYONLY
-)
-
-add_custom_target(xrpl_crates)
-add_dependencies(tidy_prerequisites xrpl_crates)
-
-# On macOS, ld warns `ignoring duplicate libraries` when linking a crate.
-# Corrosion is the source of both duplicates it names:
-#
-# * The crate archive and its cxxbridge archive, because
-#   `corrosion_add_cxxbridge` makes the two depend on each other, and CMake
-#   repeats a static library cycle on the link line so single-pass linkers can
-#   resolve it. (LINK_INTERFACE_MULTIPLICITY can only raise that count.)
-# * `-lSystem`, which Corrosion copies from rustc's `native-static-libs` even
-#   though the compiler driver always links libSystem.
-#
-# ld needs neither: it resolves the cycle from one copy of each archive and
-# links libSystem once. So silence the warning rather than rewrite Corrosion's
-# link interface, which the cycle is also part of. The option itself is old —
-# Xcode 15 is only where the warning became the default — and the check below
-# leaves it out on a linker that does not know it.
-if(is_macos)
-    include(CheckLinkerFlag)
-    check_linker_flag(
-        CXX
-        -Wl,-no_warn_duplicate_libraries
-        have_no_warn_duplicate_libraries
-    )
-endif()
-
-function(_unlink_libgcc_s crate)
-    if(NOT (is_linux AND static))
-        return()
-    endif()
-
-    # Corrosion exposes a crate's staticlib as an imported `<crate>-static`
-    # target and puts the native libs in its INTERFACE_LINK_LIBRARIES. If either
-    # of those changes, warn instead of silently letting libgcc_s.so.1 return.
-    set(imported "${crate}-static")
-    if(NOT TARGET ${imported})
-        message(
-            FATAL_ERROR
-            "Corrosion did not create the imported target '${imported}', so "
-            "libgcc_s cannot be removed from the link interface of '${crate}'. "
-            "xrpld will link libgcc_s.so.1 dynamically. Check where Corrosion "
-            "${CORROSION_VERSION} now records `native-static-libs`."
-        )
-        return()
-    endif()
-
-    get_target_property(libs ${imported} INTERFACE_LINK_LIBRARIES)
-    if(NOT "gcc_s" IN_LIST libs)
-        message(
-            WARNING
-            "'gcc_s' was not in the link interface of '${imported}' as "
-            "expected. If the Rust toolchain stopped reporting it this "
-            "workaround is obsolete and can be deleted; otherwise xrpld may "
-            "link libgcc_s.so.1 dynamically. Verify with: "
-            "objdump -p xrpld | grep NEEDED"
-        )
-        return()
-    endif()
-
-    list(REMOVE_ITEM libs gcc_s)
-    set_property(TARGET ${imported} PROPERTY INTERFACE_LINK_LIBRARIES ${libs})
-endfunction()
-
-function(add_xrpl_crate name)
-    cmake_parse_arguments(ARG "" "CRATE" "FILES" ${ARGN})
-    _unlink_libgcc_s(${ARG_CRATE})
-    # `cc` picks its runtime flag from `crt-static` alone, so it compiles a
-    # crate's C++ with `-MT`; Debug needs `-MTd` (to match cmake/XrplCompiler.cmake).
-    if(is_msvc)
-        corrosion_set_env_vars(
-            ${ARG_CRATE}
-            "$<$<CONFIG:Debug>:CXXFLAGS=-MTd>"
-        )
-    endif()
-    corrosion_add_cxxbridge(${name}_cxxbridge CRATE ${ARG_CRATE} FILES
-                            ${ARG_FILES}
-    )
-    # Generated cxxbridge headers don't exist at configure time; CMake 3.28+
-    # validates INTERFACE_SOURCES on consuming targets. Clear it to skip the
-    # existence check — build-time ordering is enforced by the custom commands.
-    set_target_properties(${name}_cxxbridge PROPERTIES INTERFACE_SOURCES "")
-    if(have_no_warn_duplicate_libraries)
-        target_link_options(
-            ${name}_cxxbridge
-            INTERFACE -Wl,-no_warn_duplicate_libraries
-        )
-    endif()
-    add_dependencies(xrpl_crates ${name}_cxxbridge)
-endfunction()
-
-add_xrpl_crate(rs_hello_world CRATE rs_hello_world FILES lib.rs)

crates/Cargo.lock

@@ -1,301 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "cc"
-version = "1.2.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d16d90359e986641506914ba71350897565610e87ce0ad9e6f28569db3dd5c6d"
-dependencies = [
- "find-msvc-tools",
- "shlex",
-]
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "codespan-reporting"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af491d569909a7e4dee0ad7db7f5341fef5c614d5b8ec8cf765732aba3cff681"
-dependencies = [
- "serde",
- "termcolor",
- "unicode-width",
-]
-
-[[package]]
-name = "cxx"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
-dependencies = [
- "cc",
- "cxx-build",
- "cxxbridge-cmd",
- "cxxbridge-flags",
- "cxxbridge-macro",
- "foldhash",
- "link-cplusplus",
-]
-
-[[package]]
-name = "cxx-build"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
-dependencies = [
- "cc",
- "codespan-reporting",
- "indexmap",
- "proc-macro2",
- "quote",
- "scratch",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "cxxbridge-cmd"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
-dependencies = [
- "clap",
- "codespan-reporting",
- "indexmap",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "cxxbridge-flags"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
-
-[[package]]
-name = "cxxbridge-macro"
-version = "1.0.199"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
-dependencies = [
- "indexmap",
- "proc-macro2",
- "quote",
- "syn 3.0.3",
-]
-
-[[package]]
-name = "equivalent"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
-
-[[package]]
-name = "find-msvc-tools"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582"
-
-[[package]]
-name = "foldhash"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
-
-[[package]]
-name = "hashbrown"
-version = "0.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f467dd6dccf739c208452f8014c75c18bb8301b050ad1cfb27153803edb0f51"
-
-[[package]]
-name = "indexmap"
-version = "2.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
-dependencies = [
- "equivalent",
- "hashbrown",
-]
-
-[[package]]
-name = "link-cplusplus"
-version = "1.0.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f78c730aaa7d0b9336a299029ea49f9ee53b0ed06e9202e8cb7db9bae7b8c82"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rs-hello_world"
-version = "0.1.0"
-dependencies = [
- "cxx",
-]
-
-[[package]]
-name = "scratch"
-version = "1.0.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d68f2ec51b097e4c1a75b681a8bec621909b5e91f15bb7b840c4f2f7b01148b2"
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.117",
-]
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "syn"
-version = "3.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "termcolor"
-version = "1.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
-dependencies = [
- "winapi-util",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "unicode-width"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
-
-[[package]]
-name = "winapi-util"
-version = "0.1.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]

crates/Cargo.toml

@@ -1,15 +0,0 @@
-[workspace]
-members = ["hello_world"]
-resolver = "3"
-
-[workspace.dependencies]
-cxx = { version = "1.0.198", features = ["c++20"] }
-
-[workspace.package]
-edition = "2024"
-
-[profile.release]
-opt-level = 3
-overflow-checks = true
-lto = true
-debug = true

crates/generated.clang-tidy

@@ -1,10 +0,0 @@
----
-# Neutralizes clang-tidy for the corrosion/cxxbridge-generated C++. Copied into
-# the crates build directory by crates/CMakeLists.txt, next to the generated
-# sources, so clang-tidy picks it up instead of the top-level configuration.
-#
-# One check is kept enabled to avoid clang-tidy's "no checks enabled" error.
-Checks: "-*,google-readability-todo"
-WarningsAsErrors: ""
-HeaderFilterRegex: ""
-InheritParentConfig: false

crates/hello_world/Cargo.toml

@@ -1,10 +0,0 @@
-[package]
-name = "rs-hello_world"
-version = "0.1.0"
-edition.workspace = true
-
-[lib]
-crate-type = ["staticlib"]
-
-[dependencies]
-cxx.workspace = true

crates/hello_world/src/lib.rs

@@ -1,10 +0,0 @@
-#[cxx::bridge(namespace = "rs::hello_world")]
-mod ffi {
-    extern "Rust" {
-        fn hello_world() -> String;
-    }
-}
-
-pub fn hello_world() -> String {
-    "hello_world".to_string()
-}

docs/build/environment.md

@@ -6,55 +6,22 @@ This document explains how to set one up.
 
 ## Tested compiler versions
 
-`xrpld` is built in the **C++23** dialect by default, so your toolchain has to
-support it — see [compiler support for C++23][cpp23-support].
-The versions currently tested in CI are:
+`xrpld` is built in the **C++23** dialect by default.
+Make sure your toolchain is recent enough — the compiler versions currently tested in CI are:
 
-| Compiler    | Version            |
-| ----------- | ------------------ |
-| GCC         | 15.2               |
-| Clang       | 22                 |
-| Apple Clang | 21                 |
-| MSVC        | Visual Studio 2026 |
+| Compiler    | Version |
+| ----------- | ------- |
+| GCC         | 15.2    |
+| Clang       | 22      |
+| Apple Clang | 17      |
+| MSVC        | 19.44   |
 
 LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
 
-### Older compilers
-
 Older compilers may fail to build the latest `develop` code: the codebase now
 relies on C++23 features and has been adjusted for `clang-tidy`.
 If the latest code doesn't build for you, update your build toolchain first.
 
-If updating isn't an option for you, we do accept pull requests that fix builds
-on older compilers, as long as the change is small and doesn't make the code
-harder to read. What we can't promise is that older compilers will keep working:
-only the versions in the table above are tested in CI, and we won't hold back
-the use of C++23 features or add invasive workarounds to keep an untested
-compiler building. Treat support for anything outside the table as best-effort.
-
-## Required tools
-
-Besides a compiler, building `xrpld` requires:
-
-| Tool                                        | Minimum version |
-| ------------------------------------------- | --------------- |
-| [Git](https://git-scm.com/downloads)        | any recent      |
-| [Python](https://www.python.org/downloads/) | 3.11            |
-| [Conan](https://conan.io/downloads.html)    | 2.17            |
-| [CMake](https://cmake.org/download/)        | 3.16            |
-
-On Linux and macOS, the [Nix development shell](./nix.md) provides all of them
-(see below). On Windows they have to be installed manually.
-
-Building with `-Drust=ON` additionally requires a Rust toolchain, see
-[Rust](#rust). A default build does not, so it is not in the table above.
-
-Once they are in place, verify that everything is installed and runnable with:
-
-```bash
-./bin/check-tools.sh
-```
-
 ## Linux and macOS
 
 The **recommended way** to get a development environment on Linux and macOS is
@@ -72,15 +39,20 @@ Clang. If you instead opt to use your system-wide Apple Clang (via
 below).
 
 See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler and why we recommend Nix
-over a hand-maintained environment.
+details, including how to select a different compiler.
+
+> [!NOTE]
+> Using Nix is not mandatory. Any custom environment (Homebrew packages or
+> anything else) will continue to work, but then it is up to you to keep it in
+> sync with the environment used in CI. Nix unifies the development environment
+> for everyone and synchronizes updates, which is why we recommend it.
 
 ### macOS: managing the Apple Clang version
 
 If you use your system-wide Apple Clang on macOS (via `nix develop .#apple-clang`),
 the compiler version is whatever your installed Xcode (or Command Line Tools)
 provides. The following command should return a version greater than or equal to
-the [tested one](#tested-compiler-versions):
+the [minimum required](#tested-compiler-versions):
 
 ```bash
 clang --version
@@ -117,42 +89,23 @@ building xrpld. You may want to install and pin a specific version of Xcode:
 Nix is not available on Windows, so the required tools have to be installed
 manually:
 
-- [Visual Studio 2026](https://visualstudio.microsoft.com/) with the
+- [Visual Studio 2022](https://visualstudio.microsoft.com/) with the
   **"Desktop development with C++"** workload — this provides MSVC and the
-  "x64 Native Tools Command Prompt". CI configures CMake with the
-  `Visual Studio 18 2026` generator.
+  "x64 Native Tools Command Prompt".
 - [Git for Windows](https://git-scm.com/download/win)
-- Python, Conan, and CMake, at the versions listed in
-  [Required tools](#required-tools).
-- a [Rust toolchain](https://rustup.rs) — only needed to build with
-  `-Drust=ON`, see [Rust](#rust)
+- [Python 3.11](https://www.python.org/downloads/), or higher
+- [Conan 2.17](https://conan.io/downloads.html), or higher
+- [CMake 3.22](https://cmake.org/download/), or higher
 
-## Rust
-
-The repository contains a Rust workspace in [`crates/`](../../crates), whose
-crates are exposed to C++ through [cxx](https://cxx.rs) bindings. It is **not**
-part of a default build: the CMake `rust` option is OFF by default, and with it
-off no Rust toolchain is needed. It is only required when configuring with
-`-Drust=ON` (which is what CI does), see [Options](../../BUILD.md#options).
-
-The toolchain (`cargo`, `rustc`) is pinned to the channel in
-[`rust-toolchain.toml`](../../rust-toolchain.toml) at the repository root. If
-you install Rust with [rustup](https://rustup.rs), that file is picked up
-automatically, and `cargo`/`rustc` in the repository will use the pinned
-version.
-
-Everything else the Rust build needs on the CMake side comes from Conan along
-with the rest of the dependencies, so there is nothing further to install.
+> [!NOTE]
+> Windows is used for development only and is not recommended for production.
 
 ## Clang-tidy
 
 `clang-tidy` is required to run static analysis checks locally (see
 [CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. The version this project uses is listed in
-[Tested compiler versions](#tested-compiler-versions).
+project. This project currently uses `clang-tidy` version 22.
 
-On Linux and macOS, the [Nix development shell](./nix.md) provides that exact
-version out of the box — run it via `run-clang-tidy`. No separate installation
-is needed.
-
-[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
+On Linux and macOS, the [Nix development shell](./nix.md) provides `clang-tidy`
+22 out of the box — run it via `run-clang-tidy`. No separate installation is
+needed.

docs/build/install.md

@@ -1,10 +1,3 @@
-# Installing xrpld 3.3.0 and earlier
-
-> [!IMPORTANT]
-> These instructions apply to xrpld 3.3.0 and earlier, published to
-> repos.ripple.com.
-> For later releases see [install.md](./install.md).
-
 This document contains instructions for installing xrpld.
 The APT package manager is common on Debian-based Linux distributions like
 Ubuntu,
@@ -59,7 +52,7 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
 
 5.  Add the appropriate XRPL repository for your operating system version:
 
-        echo "deb [signed-by=/usr/local/share/keyrings/ripple-key.gpg] https://repos.ripple.com/repos/rippled-deb focal stable" | \
+        echo "deb [signed-by=/usr/local/share/keyrings/ripple-key.gpg] https://repos.ripple.com/repos/xrpld-deb focal stable" | \
             sudo tee -a /etc/apt/sources.list.d/ripple.list
 
     The above example is appropriate for **Ubuntu 20.04 Focal Fossa**. For other operating systems, replace the word `focal` with one of the following:
@@ -113,8 +106,8 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
         enabled=1
         gpgcheck=0
         repo_gpgcheck=1
-        baseurl=https://repos.ripple.com/repos/rippled-rpm/stable/
-        gpgkey=https://repos.ripple.com/repos/rippled-rpm/stable/repodata/repomd.xml.key
+        baseurl=https://repos.ripple.com/repos/xrpld-rpm/stable/
+        gpgkey=https://repos.ripple.com/repos/xrpld-rpm/stable/repodata/repomd.xml.key
         REPOFILE
 
     _Unstable_
@@ -125,8 +118,8 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
         enabled=1
         gpgcheck=0
         repo_gpgcheck=1
-        baseurl=https://repos.ripple.com/repos/rippled-rpm/unstable/
-        gpgkey=https://repos.ripple.com/repos/rippled-rpm/unstable/repodata/repomd.xml.key
+        baseurl=https://repos.ripple.com/repos/xrpld-rpm/unstable/
+        gpgkey=https://repos.ripple.com/repos/xrpld-rpm/unstable/repodata/repomd.xml.key
         REPOFILE
 
     _Nightly_
@@ -137,8 +130,8 @@ The default [prefix][1] is typically `/usr/local` on Linux and macOS and
         enabled=1
         gpgcheck=0
         repo_gpgcheck=1
-        baseurl=https://repos.ripple.com/repos/rippled-rpm/nightly/
-        gpgkey=https://repos.ripple.com/repos/rippled-rpm/nightly/repodata/repomd.xml.key
+        baseurl=https://repos.ripple.com/repos/xrpld-rpm/nightly/
+        gpgkey=https://repos.ripple.com/repos/xrpld-rpm/nightly/repodata/repomd.xml.key
         REPOFILE
 
 2.  Fetch the latest repo updates:

docs/build/nix.md

@@ -7,7 +7,7 @@ This guide explains how to use Nix to set up a reproducible development environm
 ## Benefits of Using Nix
 
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
-- **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment, and CI builds some macOS configurations in it as well
+- **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
 - **Consistent compilers**: The GCC and Clang shells use the same versions as CI
 - **Quick setup**: Get started with a single command
@@ -68,7 +68,7 @@ A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix d
 
 On Linux, `.#gcc` and `.#clang` provide the exact toolchain CI uses:
 the compiler (pinned in [`nix/packages.nix`](../../nix/packages.nix))
-rebuilt against the pinned custom glibc (see [`nix/linux.nix`](../../nix/linux.nix)).
+rebuilt against the pinned custom glibc (see [`nix/compilers.nix`](../../nix/compilers.nix)).
 Building that toolchain the first time is slow unless it is fetched from a Nix binary cache.
 If you don't need the custom glibc, the Linux-only `.#gcc-plain` and `.#clang-plain`
 give you the stock nixpkgs compilers of the same versions.
@@ -120,7 +120,7 @@ nix develop -c "$SHELL"
 >
 > If it doesn't, either adjust your shell configuration so it doesn't override `$PATH`, or use [direnv](#automatic-activation-with-direnv) (below), which loads the environment _after_ your shell config and so takes precedence regardless of the shell you use.
 
-## Building xrpld in the Nix shell
+## Building xrpld with Nix
 
 Once inside the Nix development shell, follow the standard [build instructions](../../BUILD.md#steps). The Nix shell provides all necessary tools (CMake, Ninja, Conan, etc.).
 
@@ -128,100 +128,6 @@ Coverage builds (`-Dcoverage=ON`) work in the `gcc` shell (and `gcc-plain` on Li
 each ships a `gcov` matching its compiler, since Nix's cc-wrapper does not expose one.
 The `clang` shells do not include `llvm-cov`, so use a `gcc` shell for coverage.
 
-Builds of the Rust crates (`-Drust=ON`) also work out of the box: every shell
-provides the Rust toolchain pinned in
-[`rust-toolchain.toml`](../../rust-toolchain.toml) (see
-[Rust](./environment.md#rust)), plus the `cargo-audit`, `cargo-llvm-cov` and
-`cargo-nextest` plugins.
-
-## Conan configuration
-
-The shell runs [`conan/init.sh`](../../conan/init.sh) on entry, so
-[Set Up Conan](../../BUILD.md#set-up-conan) is already done for you. It installs
-into the shell's own Conan home: `CONAN_HOME=~/.conan2-nix`.
-
-### Prebuilt packages
-
-On **Linux**, the binaries on the `xrplf` remote are built in this same Nix
-environment — CI runs in Docker images that bundle the dev shell's toolchain (see
-[`nix/docker`](../../nix/docker)) — so `.#gcc` and `.#clang` can reuse them. The
-`-plain` shells do not match that toolchain's glibc, so binaries from the remote
-are not a reliable match there.
-
-On **macOS**, CI also builds in this Nix environment, in Debug and Release (the
-`macos-arm64-*-nix` configurations — Debug because the profile defaults to it).
-The Nix build resolves to `compiler=clang`, so it gets its own package IDs,
-separate from the Apple Clang ones. The
-[dependency upload](../../.github/workflows/upload-conan-deps.yml) publishes them
-on pushes to `develop` and on manual runs — its nightly run rebuilds everything
-from source but uploads nothing — so once a set has been published `nix develop`
-can reuse it instead of compiling every dependency locally. These configurations
-run outside the reduced pull-request matrix, so label a PR `Full CI build` when it
-touches `flake.lock` or `nix/`.
-
-To compile everything from source, add `--build '*'` to the `conan install`
-command.
-
-### Why the nixpkgs revision is not part of the package ID
-
-A Conan package ID records the compiler and its major version, but nothing about
-the nixpkgs revision the toolchain came from — and `flake.lock` moves far more
-often than the toolchain meaningfully changes, so folding it in would rebuild
-every dependency on every bump for nothing.
-
-That is safe as long as no cached artifact resolves a `/nix/store` path at run
-time, because store paths change on every update and the old ones disappear with
-`nix-collect-garbage`. With the `clang` toolchain macOS CI and the dev shell use,
-they do not: it links against `/usr/lib/libc++` and `/usr/lib/libSystem`, and
-store paths reach the `.a` files only through debug info, which nothing resolves
-at link or run time.
-
-> [!WARNING]
-> This does not hold for `nix develop .#gcc` on macOS. There is no system
-> libstdc++, so GCC links its own from the store and every binary keeps a
-> `/nix/store` reference. That shell is fine for tooling, but it is not a build
-> configuration CI covers, and no dependency binaries are published for it.
-
-This is checked rather than assumed.
-[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) takes one file
-or directory and fails if a binary under it resolves a store path at run time.
-CI runs it over the build output and the Conan cache, and again in the upload job
-before anything is published. You can run it yourself:
-
-```bash
-bin/check-nix-store-refs.sh build
-bin/check-nix-store-refs.sh ~/.conan2-nix
-```
-
-It works on Linux too, but asserts something narrower there: the toolchain always
-writes the store into `PT_INTERP` and `RUNPATH`, and CI builds inside an image
-whose store is fixed for its lifetime, so that is fine. Only the binaries
-[`PatchNixBinary.cmake`](../../cmake/PatchNixBinary.cmake) retargets to the
-system loader have to be clean, and those are what CI checks:
-
-```bash
-bin/check-nix-store-refs.sh build/xrpld
-```
-
-### The libresolv stub
-
-This is not hypothetical: `xrpld` used to be caught by it. The c-ares package
-tells the linker to pass `-lresolv`, and nixpkgs keeps `libresolv` out of the
-macOS SDK and ships it as an ordinary store dylib — so every Nix-built `xrpld`
-recorded a `/nix/store/…-libresolv-93/lib/libresolv.9.dylib` load command and
-stopped running once that path was collected. Nothing in the link uses a single
-symbol from it.
-
-Both environments now put a stub on the linker search path
-(`libresolvSystemStub` in [`nix/darwin.nix`](../../nix/darwin.nix)): the
-same library with its install name set to `/usr/lib/libresolv.9.dylib`, which is
-exactly the load command the Apple Clang build records.
-
-Package IDs did not change, so Conan keeps serving anything built before the
-stub landed. If a binary fails to start with `Library not loaded: /nix/store/…`,
-see [that entry](./nix_troubleshooting.md#library-not-loaded-nixstore-from-a-binary-that-used-to-work)
-in the troubleshooting guide.
-
 ## Automatic Activation with direnv
 
 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
@@ -236,18 +142,18 @@ The repository already ships an `.envrc` at its root that activates the Nix flak
 > [!NOTE]
 > direnv only caches the `.direnv` directory (already listed in `.gitignore`); no other repository files are affected.
 
+## Conan and Prebuilt Packages
+
+Please note that there is no guarantee that binaries from conan cache will work when using nix. If you encounter any errors, please use `--build '*'` to force conan to compile everything from source:
+
+```bash
+conan install .. --output-folder . --build '*' --settings build_type=Release
+```
+
 ## Updating `flake.lock` file
 
 To update `flake.lock` to the latest revision use `nix flake update` command.
 
-## Tooling snapshots
-
-The tool versions in each Nix environment are recorded in
-[`nix/check-tools/`](../../nix/check-tools) and verified by CI. If you change the
-environment (bump the CI image tag, update `flake.lock`, or edit the tool list in
-`bin/check-tools.sh`), CI fails until you regenerate and commit the affected
-snapshot — see [`nix/check-tools/README.md`](../../nix/check-tools/README.md).
-
 ## Troubleshooting
 
 See [Troubleshooting Nix problems](./nix_troubleshooting.md) for common issues,

docs/build/nix_troubleshooting.md

@@ -3,78 +3,6 @@
 Common issues encountered when using the [Nix development shell](./nix.md), and
 how to resolve them.
 
-## `command not found: nix` after a macOS update
-
-If a shell suddenly can't find `nix` at all:
-
-```
-$ nix develop
-zsh: command not found: nix
-```
-
-then Nix is almost certainly still installed — only the shell hook that puts it
-on your `PATH` is gone. Confirm that first:
-
-```bash
-ls -l /nix/var/nix/profiles/default/bin/nix
-```
-
-If that exists, the installation is fine and this is purely a `PATH` problem.
-
-### Why it happens
-
-The installer does not touch your dotfiles. Instead it sources a setup script
-from the Nix store by editing **system-wide** rc files:
-
-| Shell | File the installer edits              |
-| ----- | ------------------------------------- |
-| bash  | `/etc/bashrc`, `/etc/bash.bashrc`     |
-| zsh   | `/etc/zshrc`                          |
-| fish  | `$__fish_sysconf_dir/conf.d/nix.fish` |
-
-macOS manages `/etc/zshrc`, so an OS update can replace it with the vendor copy
-and silently drop the Nix block. `/etc/bashrc` and the fish file usually survive,
-which is why the breakage often shows up in zsh only. You can verify this by
-diffing against the backup the installer left behind:
-
-```bash
-diff /etc/zshrc /etc/zshrc.backup-before-nix
-```
-
-If they are identical, the Nix snippet was wiped. This is upstream issue
-[NixOS/nix#3616](https://github.com/NixOS/nix/issues/3616).
-
-### Fix
-
-To unblock the current shell:
-
-```bash
-. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-```
-
-For a permanent fix, add the snippet to your **user** rc file rather than
-restoring `/etc/zshrc` — user dotfiles are not clobbered by OS updates:
-
-```bash
-cat >>~/.zshrc <<'EOF'
-
-# Nix
-if [ -e '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh' ]; then
-  . '/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh'
-fi
-# End Nix
-EOF
-```
-
-The scripts guard against double-sourcing via `__ETC_PROFILE_NIX_SOURCED`, so
-this is safe even if a system-wide hook is later restored.
-
-> [!NOTE]
-> `/etc/zshrc` and `~/.zshrc` are only read by **interactive** zsh. If the
-> snippet is present but `zsh -c '…'`, a script, or an IDE terminal still can't
-> find `nix`, that shell is non-interactive — put the snippet in `~/.zshenv`
-> instead.
-
 ## Git worktrees
 
 If `nix develop` fails with an error like:
@@ -131,91 +59,3 @@ once it picks up that rebuild, then re-run the `grep libgit2` check above to
 confirm it reports `1.9.4` or newer.
 
 Until then, prefer the workarounds above.
-
-## `wint_t` / `uint32_t` errors from the Nix libc++ headers
-
-A build that mixes the Nix toolchain with the system SDK fails in libc++ itself,
-with errors that look nothing like your code:
-
-```
-/nix/store/...-libcxx-.../include/c++/v1/cwchar:136:9: error: target of using declaration conflicts with declaration already in scope
-  136 | using ::wint_t _LIBCPP_USING_IF_EXISTS;
-/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/sys/_types/_wint_t.h:32:25: note: target of using declaration
-...
-error: use of undeclared identifier 'UINT32_C'
-```
-
-The give-away is the second path: Nix's libc++ headers are being combined with
-the **Xcode Command Line Tools** SDK instead of the Nix one.
-
-### Why it happens
-
-`SDKROOT` and `DEVELOPER_DIR` are what point the toolchain at the Nix SDK, and
-they are not baked into the compiler — a dev shell gets them from the
-`apple-sdk` setup hook. CMake, finding neither, asks `xcrun`, which answers with
-the system SDK. Nix's `libc++` and Apple's headers then declare the same types
-twice.
-
-### Fix
-
-Run the build from inside the dev shell (`nix develop`), or from an environment
-that exports both variables. To confirm which SDK a configured build is using:
-
-```bash
-grep -o '\-isysroot [^ ]*' build/compile_commands.json | sort -u
-```
-
-It should print a `/nix/store/...-apple-sdk-*` path. If it prints
-`/Library/Developer/CommandLineTools/...`, re-configure from within the shell —
-CMake caches the sysroot, so an existing `build/` directory keeps the wrong one.
-
-## `Library not loaded: /nix/store/…` from a binary that used to work
-
-A binary stops starting after a `nix flake update`, or after
-`nix-collect-garbage` removes the paths the previous toolchain used:
-
-```
-dyld[57271]: Library not loaded: /nix/store/…-libresolv-93/lib/libresolv.9.dylib
-```
-
-[`bin/check-nix-store-refs.sh`](../../bin/check-nix-store-refs.sh) finds the same
-thing without having to run anything, and names the file:
-
-```
-$ bin/check-nix-store-refs.sh ~/.conan2-nix
-::error file=/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig::references the Nix store at run time
-/Users/you/.conan2-nix/p/b/c-area24ded30c388c/p/bin/adig
-    /nix/store/p4lp3xq4imd1qzqh08x8vcq2zfhi7rca-libresolv-93/lib/libresolv.9.dylib
-/Users/you/.conan2-nix: checked 135, skipped 2495, 1 with Nix store references.
-```
-
-Conan's cache folders are named after a truncated package name plus a hash, so
-ask Conan which package the offending one belongs to — pass the folder holding
-the hash, not the file itself:
-
-```
-$ conan cache ref ~/.conan2-nix/p/b/c-area24ded30c388c
-c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650:dab5992496abe6d219defb7986ecbf367615a5e5#…
-```
-
-### Why it happens
-
-The binary records a store path that no longer exists. Nothing we build should:
-see [Prebuilt packages](./nix.md#prebuilt-packages) for why, and
-`libresolvSystemStub` in [`nix/darwin.nix`](../../nix/darwin.nix) for the one
-dependency that needed help to comply.
-
-A Conan package ID does not encode the nixpkgs revision, so a package built
-before that stub existed stays in your local cache and keeps being reused. The
-dev shell is also what tends to produce one: it is a slightly _less_ isolated
-build environment than CI's, because `mkShell` puts every tool's headers and
-libraries on the compiler's search path — which is how c-ares found the Nix
-`libresolv` in the first place.
-
-### Fix
-
-Drop that package and let Conan refetch or rebuild it:
-
-```bash
-conan remove 'c-ares/*'
-```

docs/install.md

@@ -1,144 +0,0 @@
-# Installing xrpld
-
-> [!NOTE]
-> These instructions apply to packages published from 2026-08-19 onwards.
-> For xrpld 3.3.0 and earlier see [install-legacy.md](./install-legacy.md).
-
-`xrpld` is published as DEB and RPM packages for 64-bit x86 Linux.
-Use APT on Debian-based distributions such as Debian and Ubuntu,
-and YUM on Red Hat-based distributions such as RHEL, AlmaLinux, and Rocky Linux.
-To build from source instead, see [BUILD.md](../BUILD.md).
-
-## Release channels
-
-Packages are published to four channels:
-
-- `stable` - production releases
-- `rc` - release candidates
-- `beta` - beta builds
-- `develop` - every push to the [`develop` branch](https://github.com/XRPLF/rippled/tree/develop)
-
-See [Publishing packages](../package/README.md#publishing-packages) for how channels are produced.
-
-The instructions below use `stable`.
-To follow another channel, replace `stable` with its name
-wherever it appears in the repository configuration.
-
-> [!WARNING]
-> Channels other than `stable` may be broken at any time.
-> Do not use them for production servers.
-
-## Install the xrpld package
-
-### With the APT package manager
-
-1.  Install utilities:
-
-    ```bash
-    sudo apt update -y
-    sudo apt install -y apt-transport-https ca-certificates curl gnupg
-    ```
-
-2.  Add the XRPL Foundation package-signing key to your list of trusted keys:
-
-    ```bash
-    sudo install -d -m 0755 /etc/apt/keyrings
-    sudo curl -fsS https://packages.xrplf.org/xrplf.asc -o /etc/apt/keyrings/xrplf.asc
-    ```
-
-3.  Check the fingerprint of the newly-added key:
-
-    ```bash
-    gpg --show-keys /etc/apt/keyrings/xrplf.asc
-    ```
-
-    The output should be:
-
-    ```text
-    pub   rsa4096 2026-08-18 [SC]
-          B655416741221F780FBCFBC9AA84D41A11D29FA9
-    uid                      XRPLF Packages <distribution@xrplf.org>
-    ```
-
-    In particular, make sure that the fingerprint matches.
-
-4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
-
-    ```bash
-    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
-        sudo tee /etc/apt/sources.list.d/xrplf.list
-    ```
-
-5.  Fetch the repository:
-
-    ```bash
-    sudo apt -y update
-    ```
-
-6.  Install the `xrpld` software package:
-
-    ```bash
-    sudo apt -y install xrpld
-    ```
-
-### With the YUM package manager
-
-1.  Add the XRPL Foundation package-signing key:
-
-    ```bash
-    sudo rpm --import https://packages.xrplf.org/xrplf.asc
-    ```
-
-2.  Add the repository, using the channel you picked in [Release channels](#release-channels):
-
-    ```bash
-    cat << 'REPOFILE' | sudo tee /etc/yum.repos.d/xrplf.repo
-    [xrplf-stable]
-    name=XRP Ledger Packages
-    enabled=1
-    baseurl=https://packages.xrplf.org/repository/rpm-stable/$basearch/
-    gpgcheck=1
-    repo_gpgcheck=1
-    gpgkey=https://packages.xrplf.org/xrplf.asc
-    REPOFILE
-    ```
-
-    `gpgcheck=1` verifies each package against the key above.
-    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
-
-3.  Install the `xrpld` package:
-
-    ```bash
-    sudo yum install -y xrpld
-    ```
-
-## The xrpld service
-
-Both package managers install a systemd unit and enable it, so `xrpld` starts on boot.
-Check whether it is already running:
-
-```bash
-systemctl status xrpld.service
-```
-
-The APT packages start it immediately as well; the YUM packages do not, so start it yourself:
-
-```bash
-sudo systemctl start xrpld.service
-```
-
-### Optional: binding to privileged ports
-
-To serve incoming API requests on port 80 or 443, grant the service the capability to bind them.
-You must also update the config file's port settings.
-
-```bash
-sudo install -d -m 0755 /etc/systemd/system/xrpld.service.d
-sudo tee /etc/systemd/system/xrpld.service.d/privileged-ports.conf >/dev/null <<'EOF'
-[Service]
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-EOF
-sudo systemctl daemon-reload
-sudo systemctl restart xrpld.service
-```

docs/sample_chart.doc

@@ -0,0 +1,24 @@
+/*!
+    \page somestatechart Example state diagram
+
+    \startuml SomeState "my state diagram"
+    scale 600 width
+
+    [*] -> State1
+    State1 --> State2 : Succeeded
+    State1 --> [*] : Aborted
+    State2 --> State3 : Succeeded
+    State2 --> [*] : Aborted
+    state State3 {
+      state "Accumulate Enough Data\nLong State Name" as long1
+      long1 : Just a test
+      [*] --> long1
+      long1 --> long1 : New Data
+      long1 --> ProcessData : Enough Data
+    }
+    State3 --> State3 : Failed
+    State3 --> [*] : Succeeded / Save Result
+    State3 --> [*] : Aborted
+
+    \enduml
+*/

include/xrpl/basics/Archive.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#include <filesystem>
+#include <boost/filesystem.hpp>
 
 namespace xrpl {
 
@@ -13,6 +13,6 @@ namespace xrpl {
  * @throws runtime_error
  */
 void
-extractTarLz4(std::filesystem::path const& src, std::filesystem::path const& dst);
+extractTarLz4(boost::filesystem::path const& src, boost::filesystem::path const& dst);
 
 }  // namespace xrpl

include/xrpl/basics/Buffer.h

@@ -3,7 +3,6 @@
 #include <xrpl/basics/Slice.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
-#include <algorithm>
 #include <cstdint>
 #include <cstring>
 #include <memory>
@@ -157,19 +156,6 @@ public:
     }
     /** @} */
 
-    /**
-     * Set every byte in the buffer to the given value.
-     *
-     * The size is unchanged, and this is a no-op on an empty buffer.
-     *
-     * @param value the byte to write to every position.
-     */
-    void
-    fill(std::uint8_t value) noexcept
-    {
-        std::fill_n(p_.get(), size_, value);
-    }
-
     /**
      * Reset the buffer.
      * All memory is deallocated. The resulting size is 0.
@@ -240,4 +226,10 @@ operator==(Buffer const& lhs, Buffer const& rhs) noexcept
     return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
 }
 
+inline bool
+operator!=(Buffer const& lhs, Buffer const& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
 }  // namespace xrpl

include/xrpl/basics/FileUtilities.h

@@ -1,79 +1,24 @@
 #pragma once
 
+#include <boost/filesystem.hpp>
+#include <boost/system/error_code.hpp>
+
 #include <cstddef>
-#include <filesystem>
 #include <optional>
 #include <string>
-#include <system_error>
 
 namespace xrpl {
 
 std::string
 getFileContents(
-    std::error_code& ec,
-    std::filesystem::path const& sourcePath,
+    boost::system::error_code& ec,
+    boost::filesystem::path const& sourcePath,
     std::optional<std::size_t> maxSize = std::nullopt);
 
 void
 writeFileContents(
-    std::error_code& ec,
-    std::filesystem::path const& destPath,
+    boost::system::error_code& ec,
+    boost::filesystem::path const& destPath,
     std::string const& contents);
 
-/**
- * Generate a unique, non-existing path under @p base whose filename starts with
- * @p prefix and ends with a random hex suffix.
- *
- * Attempts up to @p maxAttempts paths. Throws `std::runtime_error` if a unique
- * path cannot be found or if the filesystem returns an error while checking for
- * existence.
- */
-std::filesystem::path
-uniqueRandomPath(
-    std::filesystem::path const& base,
-    std::string const& prefix = "",
-    std::size_t maxAttempts = 100);
-
-/**
- * RAII temporary directory.
- *
- * The directory and all its contents are deleted when
- * the instance of `TempDir` is destroyed.
- */
-class TempDir
-{
-    std::filesystem::path path_;
-
-public:
-#if !GENERATING_DOCS
-    TempDir(TempDir const&) = delete;
-    TempDir&
-    operator=(TempDir const&) = delete;
-#endif
-
-    /**
-     * Construct a temporary directory.
-     */
-    TempDir();
-
-    /**
-     * Destroy a temporary directory.
-     */
-    ~TempDir();
-
-    /**
-     * Get the native path for the temporary directory.
-     */
-    [[nodiscard]] std::string
-    path() const;
-
-    /**
-     * Get the native path for a file.
-     *
-     * The file does not need to exist.
-     */
-    [[nodiscard]] std::string
-    file(std::string const& name) const;
-};
-
 }  // namespace xrpl

include/xrpl/basics/IntrusivePointer.h

@@ -96,6 +96,9 @@ public:
     SharedIntrusive&
     operator=(SharedIntrusive const& rhs);
 
+    bool
+    operator!=(std::nullptr_t) const;
+
     bool
     operator==(std::nullptr_t) const;
 

include/xrpl/basics/IntrusivePointer.ipp

@@ -111,6 +111,13 @@ SharedIntrusive<T>::operator=(SharedIntrusive<TT>&& rhs)
     return *this;
 }
 
+template <class T>
+bool
+SharedIntrusive<T>::operator!=(std::nullptr_t) const
+{
+    return this->get() != nullptr;
+}
+
 template <class T>
 bool
 SharedIntrusive<T>::operator==(std::nullptr_t) const

include/xrpl/basics/Log.h

@@ -3,8 +3,8 @@
 #include <xrpl/beast/utility/Journal.h>
 
 #include <boost/beast/core/string.hpp>
+#include <boost/filesystem.hpp>
 
-#include <filesystem>
 #include <fstream>
 #include <map>
 #include <memory>
@@ -84,7 +84,7 @@ private:
          * @return `true` if the file was opened.
          */
         bool
-        open(std::filesystem::path const& path);
+        open(boost::filesystem::path const& path);
 
         /**
          * Close and re-open the system file associated with the log
@@ -133,7 +133,7 @@ private:
 
     private:
         std::unique_ptr<std::ofstream> stream_;
-        std::filesystem::path path_;
+        boost::filesystem::path path_;
     };
 
     std::mutex mutable mutex_;
@@ -152,7 +152,7 @@ public:
     virtual ~Logs() = default;
 
     bool
-    open(std::filesystem::path const& pathToLogFile);
+    open(boost::filesystem::path const& pathToLogFile);
 
     beast::Journal::Sink&
     get(std::string const& name);

include/xrpl/basics/Number.h

@@ -304,7 +304,7 @@ concept Integral64 = std::is_same_v<T, std::int64_t> || std::is_same_v<T, std::u
  *      on-ledger are non-negative. This is due to implementation details of
  *      several operations which use unsigned arithmetic internally. This is
  *      sufficient to represent all valid XRP values (where the absolute value
- *      can not exceed kInitialXRP: 10^17), and MPT values (where the absolute
+ *      can not exceed INITIAL_XRP: 10^17), and MPT values (where the absolute
  *      value can not exceed maxMPTokenAmount: 2^63-1).
  *
  * ---- Mantissa Range Switching ----
@@ -449,6 +449,12 @@ public:
             x.exponent_ == y.exponent_;
     }
 
+    friend constexpr bool
+    operator!=(Number const& x, Number const& y) noexcept
+    {
+        return !(x == y);
+    }
+
     friend constexpr bool
     operator<(Number const& l, Number const& r) noexcept
     {

include/xrpl/basics/Resolver.h

@@ -11,7 +11,7 @@ namespace xrpl {
 class Resolver
 {
 public:
-    using HandlerType = std::function<void(std::string, std::vector<beast::ip::Endpoint>)>;
+    using HandlerType = std::function<void(std::string, std::vector<beast::IP::Endpoint>)>;
 
     virtual ~Resolver() = 0;
 

include/xrpl/basics/SHAMapHash.h

@@ -85,6 +85,12 @@ public:
     }
 };
 
+inline bool
+operator!=(SHAMapHash const& x, SHAMapHash const& y)
+{
+    return !(x == y);
+}
+
 template <>
 inline std::size_t
 extract(SHAMapHash const& key)

include/xrpl/basics/Slice.h

@@ -11,7 +11,6 @@
 #include <limits>
 #include <stdexcept>
 #include <string>
-#include <string_view>
 #include <type_traits>
 #include <vector>
 
@@ -208,6 +207,12 @@ operator==(Slice const& lhs, Slice const& rhs) noexcept
     return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
 }
 
+inline bool
+operator!=(Slice const& lhs, Slice const& rhs) noexcept
+{
+    return !(lhs == rhs);
+}
+
 inline bool
 operator<(Slice const& lhs, Slice const& rhs) noexcept
 {
@@ -246,11 +251,4 @@ makeSlice(std::basic_string<char, Traits, Alloc> const& s)
     return Slice(s.data(), s.size());
 }
 
-template <class Traits>
-Slice
-makeSlice(std::basic_string_view<char, Traits> s)
-{
-    return Slice(s.data(), s.size());
-}
-
 }  // namespace xrpl

include/xrpl/basics/StringUtilities.h

@@ -2,6 +2,7 @@
 
 #include <xrpl/basics/Blob.h>
 
+#include <boost/format.hpp>
 #include <boost/utility/string_view.hpp>
 
 #include <array>
@@ -124,31 +125,9 @@ struct ParsedUrl
 bool
 parseUrl(ParsedUrl& pUrl, std::string const& strUrl);
 
-/**
- * Remove leading and trailing ASCII whitespace.
- *
- * Whitespace is the fixed set " \t\n\v\f\r"; the current locale is not
- * consulted, so the result depends only on the input.
- *
- * @param str The string to trim.
- * @return @p str without leading or trailing whitespace.
- */
 std::string
 trimWhitespace(std::string str);
 
-/**
- * Fold ASCII upper case letters to lower case.
- *
- * Only 'A' through 'Z' are remapped; every other byte is left alone and the
- * current locale is not consulted, so the result depends only on the input.
- *
- * @param str The string to fold.
- * @return @p str with each ASCII upper case letter replaced by its lower case
- *         equivalent.
- */
-std::string
-toLower(std::string str);
-
 std::optional<std::uint64_t>
 toUInt64(std::string const& s);
 

include/xrpl/basics/base64.h

@@ -41,35 +41,6 @@
 
 namespace xrpl {
 
-namespace base64 {
-
-/**
- * Returns the maximum number of characters needed to base64-encode @p nBytes bytes.
- *
- * @param nBytes Number of input bytes.
- * @return Size of the encoded string, including padding.
- */
-constexpr std::size_t
-encodedSize(std::size_t const nBytes)
-{
-    return 4 * ((nBytes + 2) / 3);
-}
-
-/**
- * Returns the maximum number of bytes a base64 string of @p numChars characters
- * decodes to.
- *
- * @param numChars Number of base64 characters.
- * @return Upper bound on the number of decoded bytes.
- */
-constexpr std::size_t
-decodedSize(std::size_t const numChars)
-{
-    return ((numChars / 4) * 3) + 2;
-}
-
-}  // namespace base64
-
 std::string
 base64Encode(std::uint8_t const* data, std::size_t len);
 

include/xrpl/basics/partitioned_unordered_map.h

@@ -116,6 +116,12 @@ public:
         {
             return lhs.map == rhs.map && lhs.ait == rhs.ait && lhs.mit == rhs.mit;
         }
+
+        friend bool
+        operator!=(Iterator const& lhs, Iterator const& rhs)
+        {
+            return !(lhs == rhs);
+        }
     };
 
     struct ConstIterator
@@ -183,6 +189,12 @@ public:
         {
             return lhs.map == rhs.map && lhs.ait == rhs.ait && lhs.mit == rhs.mit;
         }
+
+        friend bool
+        operator!=(ConstIterator const& lhs, ConstIterator const& rhs)
+        {
+            return !(lhs == rhs);
+        }
     };
 
 private:

include/xrpl/beast/container/detail/aged_ordered_container.h

@@ -1038,6 +1038,25 @@ public:
                Compare,
                OtherAllocator> const& other) const;
 
+    template <
+        bool OtherIsMulti,
+        bool OtherIsMap,
+        class OtherT,
+        class OtherDuration,
+        class OtherAllocator>
+    bool
+    operator!=(AgedOrderedContainer<
+               OtherIsMulti,
+               OtherIsMap,
+               Key,
+               OtherT,
+               OtherDuration,
+               Compare,
+               OtherAllocator> const& other) const
+    {
+        return !(this->operator==(other));
+    }
+
     template <
         bool OtherIsMulti,
         bool OtherIsMap,

include/xrpl/beast/container/detail/aged_unordered_container.h

@@ -1340,6 +1340,28 @@ public:
                OtherAllocator> const& other) const
         requires MaybeMulti;
 
+    template <
+        bool OtherIsMulti,
+        bool OtherIsMap,
+        class OtherKey,
+        class OtherT,
+        class OtherDuration,
+        class OtherHash,
+        class OtherAllocator>
+    bool
+    operator!=(AgedUnorderedContainer<
+               OtherIsMulti,
+               OtherIsMap,
+               OtherKey,
+               OtherT,
+               OtherDuration,
+               OtherHash,
+               KeyEqual,
+               OtherAllocator> const& other) const
+    {
+        return !(this->operator==(other));
+    }
+
 private:
     bool
     wouldExceed(size_type additional) const

include/xrpl/beast/core/LexicalCast.h

@@ -58,7 +58,7 @@ struct LexicalCast<Out, std::string_view>
         "beast::LexicalCast can only be used with integral types");
 
     template <class Integral = Out>
-    constexpr bool
+    bool
     operator()(Integral& out, std::string_view in) const
         requires(std::is_integral_v<Integral> && !std::is_same_v<Integral, bool>)
     {
@@ -110,7 +110,7 @@ struct LexicalCast<Out, boost::core::basic_string_view<char>>
 {
     explicit LexicalCast() = default;
 
-    constexpr bool
+    bool
     operator()(Out& out, boost::core::basic_string_view<char> in) const
     {
         return LexicalCast<Out, std::string_view>()(out, in);
@@ -123,7 +123,7 @@ struct LexicalCast<Out, std::string>
 {
     explicit LexicalCast() = default;
 
-    constexpr bool
+    bool
     operator()(Out& out, std::string in) const
     {
         return LexicalCast<Out, std::string_view>()(out, in);
@@ -136,7 +136,7 @@ struct LexicalCast<Out, char const*>
 {
     explicit LexicalCast() = default;
 
-    constexpr bool
+    bool
     operator()(Out& out, char const* in) const
     {
         XRPL_ASSERT(in, "beast::detail::LexicalCast(char const*) : non-null input");
@@ -151,7 +151,7 @@ struct LexicalCast<Out, char*>
 {
     explicit LexicalCast() = default;
 
-    constexpr bool
+    bool
     operator()(Out& out, char* in) const
     {
         XRPL_ASSERT(in, "beast::detail::LexicalCast(char*) : non-null input");
@@ -177,7 +177,7 @@ struct BadLexicalCast : public std::bad_cast
  * @return `false` if there was a parsing or range error
  */
 template <class Out, class In>
-constexpr bool
+bool
 lexicalCastChecked(Out& out, In in)
 {
     return detail::LexicalCast<Out, In>()(out, in);
@@ -191,7 +191,7 @@ lexicalCastChecked(Out& out, In in)
  * @return The new type.
  */
 template <class Out, class In>
-constexpr Out
+Out
 lexicalCastThrow(In in)
 {
     if (Out out; lexicalCastChecked(out, in))
@@ -207,7 +207,7 @@ lexicalCastThrow(In in)
  * @return The new type.
  */
 template <class Out, class In>
-constexpr Out
+Out
 lexicalCast(In in, Out defaultValue = Out())
 {
     if (Out out; lexicalCastChecked(out, in))

include/xrpl/beast/core/List.h

@@ -82,6 +82,13 @@ public:
         return node_ == other.node_;
     }
 
+    template <typename M>
+    bool
+    operator!=(ListIterator<M> const& other) const noexcept
+    {
+        return !((*this) == other);
+    }
+
     reference
     operator*() const noexcept
     {