Merge remote-tracking branch 'origin/develop' into copilot/refactor-replace-boost-filesystem

# Conflicts:
#	src/test/app/GRPCServerTLS_test.cpp
#	src/test/app/SHAMapStore_test.cpp
#	src/xrpld/app/misc/SHAMapStoreImp.cpp
#	src/xrpld/app/rdb/backend/detail/Node.cpp
#	src/xrpld/core/detail/Config.cpp

.clang-tidy

@@ -1,144 +1,158 @@
 ---
 Checks: "-*,
-  bugprone-*,
-  -bugprone-easily-swappable-parameters,
-  -bugprone-exception-escape,
-  -bugprone-implicit-widening-of-multiplication-result,
-  -bugprone-narrowing-conversions,
-  -bugprone-throwing-static-initialization,
-
-  cppcoreguidelines-*,
-  -cppcoreguidelines-avoid-c-arrays,
-  -cppcoreguidelines-avoid-capturing-lambda-coroutines,
-  -cppcoreguidelines-avoid-const-or-ref-data-members,
-  -cppcoreguidelines-avoid-do-while,
-  -cppcoreguidelines-avoid-goto,
-  -cppcoreguidelines-avoid-magic-numbers,
-  -cppcoreguidelines-avoid-non-const-global-variables,
-  -cppcoreguidelines-avoid-reference-coroutine-parameters,
-  -cppcoreguidelines-c-copy-assignment-signature,
-  -cppcoreguidelines-explicit-virtual-functions,
-  -cppcoreguidelines-interfaces-global-init,
-  -cppcoreguidelines-macro-to-enum,
-  -cppcoreguidelines-macro-usage,
-  -cppcoreguidelines-missing-std-forward,
-  -cppcoreguidelines-narrowing-conversions,
-  -cppcoreguidelines-no-malloc,
-  -cppcoreguidelines-noexcept-destructor,
-  -cppcoreguidelines-noexcept-move-operations,
-  -cppcoreguidelines-noexcept-swap,
-  -cppcoreguidelines-non-private-member-variables-in-classes,
-  -cppcoreguidelines-owning-memory,
-  -cppcoreguidelines-prefer-member-initializer,
-  -cppcoreguidelines-pro-bounds-array-to-pointer-decay,
-  -cppcoreguidelines-pro-bounds-avoid-unchecked-container-access,
-  -cppcoreguidelines-pro-bounds-constant-array-index,
-  -cppcoreguidelines-pro-bounds-pointer-arithmetic,
-  -cppcoreguidelines-pro-type-const-cast,
-  -cppcoreguidelines-pro-type-cstyle-cast,
-  -cppcoreguidelines-pro-type-reinterpret-cast,
-  -cppcoreguidelines-pro-type-union-access,
-  -cppcoreguidelines-pro-type-vararg,
-  -cppcoreguidelines-slicing,
-  -cppcoreguidelines-special-member-functions,
-
+  bugprone-argument-comment,
+  bugprone-assert-side-effect,
+  bugprone-bad-signal-to-kill-thread,
+  bugprone-bool-pointer-implicit-conversion,
+  bugprone-capturing-this-in-member-variable,
+  bugprone-casting-through-void,
+  bugprone-chained-comparison,
+  bugprone-compare-pointer-to-member-virtual-function,
+  bugprone-copy-constructor-init,
+  bugprone-crtp-constructor-accessibility,
+  bugprone-dangling-handle,
+  bugprone-dynamic-static-initializers,
+  bugprone-empty-catch,
+  bugprone-fold-init-type,
+  bugprone-forward-declaration-namespace,
+  bugprone-inaccurate-erase,
+  bugprone-inc-dec-in-conditions,
+  bugprone-incorrect-enable-if,
+  bugprone-incorrect-roundings,
+  bugprone-infinite-loop,
+  bugprone-integer-division,
+  bugprone-lambda-function-name,
+  bugprone-macro-parentheses,
+  bugprone-macro-repeated-side-effects,
+  bugprone-misleading-setter-of-reference,
+  bugprone-misplaced-operator-in-strlen-in-alloc,
+  bugprone-misplaced-pointer-arithmetic-in-alloc,
+  bugprone-misplaced-widening-cast,
+  bugprone-move-forwarding-reference,
+  bugprone-multi-level-implicit-pointer-conversion,
+  bugprone-multiple-new-in-one-expression,
+  bugprone-multiple-statement-macro,
+  bugprone-no-escape,
+  bugprone-non-zero-enum-to-bool-conversion,
+  bugprone-optional-value-conversion,
+  bugprone-parent-virtual-call,
+  bugprone-pointer-arithmetic-on-polymorphic-object,
+  bugprone-posix-return,
+  bugprone-redundant-branch-condition,
+  bugprone-reserved-identifier,
+  bugprone-return-const-ref-from-parameter,
+  bugprone-shared-ptr-array-mismatch,
+  bugprone-signal-handler,
+  bugprone-signed-char-misuse,
+  bugprone-sizeof-container,
+  bugprone-sizeof-expression,
+  bugprone-spuriously-wake-up-functions,
+  bugprone-standalone-empty,
+  bugprone-string-constructor,
+  bugprone-string-integer-assignment,
+  bugprone-string-literal-with-embedded-nul,
+  bugprone-stringview-nullptr,
+  bugprone-suspicious-enum-usage,
+  bugprone-suspicious-include,
+  bugprone-suspicious-memory-comparison,
+  bugprone-suspicious-memset-usage,
+  bugprone-suspicious-missing-comma,
+  bugprone-suspicious-realloc-usage,
+  bugprone-suspicious-semicolon,
+  bugprone-suspicious-string-compare,
+  bugprone-suspicious-stringview-data-usage,
+  bugprone-swapped-arguments,
+  bugprone-switch-missing-default-case,
+  bugprone-terminating-continue,
+  bugprone-throw-keyword-missing,
+  bugprone-too-small-loop-variable,
+  bugprone-unchecked-optional-access,
+  bugprone-undefined-memory-manipulation,
+  bugprone-undelegated-constructor,
+  bugprone-unhandled-exception-at-new,
+  bugprone-unhandled-self-assignment,
+  bugprone-unique-ptr-array-mismatch,
+  bugprone-unsafe-functions,
+  bugprone-unused-local-non-trivial-variable,
+  bugprone-unused-raii,
+  bugprone-unused-return-value,
+  bugprone-use-after-move,
+  bugprone-virtual-near-miss,
+  cppcoreguidelines-init-variables,
+  cppcoreguidelines-misleading-capture-default-by-value,
+  cppcoreguidelines-no-suspend-with-lock,
+  cppcoreguidelines-pro-type-member-init,
+  cppcoreguidelines-pro-type-static-cast-downcast,
+  cppcoreguidelines-rvalue-reference-param-not-moved,
+  cppcoreguidelines-use-default-member-init,
+  cppcoreguidelines-use-enum-class,
+  cppcoreguidelines-virtual-class-destructor,
+  hicpp-ignored-remove-result,
   llvm-namespace-comment,
-
-  misc-*,
-  -misc-anonymous-namespace-in-header,
-  -misc-confusable-identifiers,
-  -misc-coroutine-hostile-raii,
-  -misc-misleading-bidirectional,
-  -misc-misleading-identifier,
-  -misc-multiple-inheritance,
-  -misc-new-delete-overloads,
-  -misc-no-recursion,
-  -misc-non-copyable-objects,
-  -misc-non-private-member-variables-in-classes,
-  -misc-override-with-different-visibility,
-  -misc-predictable-rand,
-  -misc-unconventional-assign-operator,
-  -misc-uniqueptr-reset-release,
-  -misc-unused-parameters,
-  -misc-use-anonymous-namespace,
-  -misc-use-internal-linkage,
-
-  modernize-*,
-  -modernize-avoid-bind,
-  -modernize-avoid-c-arrays,
-  -modernize-avoid-c-style-cast,
-  -modernize-avoid-setjmp-longjmp,
-  -modernize-avoid-variadic-functions,
-  -modernize-deprecated-ios-base-aliases,
-  -modernize-loop-convert,
-  -modernize-macro-to-enum,
-  -modernize-min-max-use-initializer-list,
-  -modernize-raw-string-literal,
-  -modernize-redundant-void-arg,
-  -modernize-replace-auto-ptr,
-  -modernize-replace-disallow-copy-and-assign-macro,
-  -modernize-replace-random-shuffle,
-  -modernize-return-braced-init-list,
-  -modernize-shrink-to-fit,
-  -modernize-unary-static-assert,
-  -modernize-use-auto,
-  -modernize-use-bool-literals,
-  -modernize-use-constraints,
-  -modernize-use-default-member-init,
-  -modernize-use-integer-sign-comparison,
-  -modernize-use-noexcept,
-  -modernize-use-nullptr,
-  -modernize-use-std-format,
-  -modernize-use-std-print,
-  -modernize-use-trailing-return-type,
-  -modernize-use-transparent-functors,
-  -modernize-use-uncaught-exceptions,
-
-  performance-*,
-  -performance-avoid-endl,
-  -performance-enum-size,
-  -performance-inefficient-algorithm,
-  -performance-inefficient-string-concatenation,
-  -performance-no-int-to-ptr,
-  -performance-noexcept-destructor,
-  -performance-noexcept-move-constructor,
-  -performance-noexcept-swap,
-  -performance-type-promotion-in-math-fn,
-  -performance-unnecessary-copy-initialization,
-  -performance-unnecessary-value-param,
-
-  readability-*,
-  -readability-avoid-const-params-in-decls,
-  -readability-avoid-unconditional-preprocessor-if,
-  -readability-container-data-pointer,
-  -readability-delete-null-pointer,
-  -readability-function-cognitive-complexity,
-  -readability-function-size,
-  -readability-identifier-length,
-  -readability-inconsistent-declaration-parameter-name,
-  -readability-isolate-declaration,
-  -readability-magic-numbers,
-  -readability-misplaced-array-index,
-  -readability-named-parameter,
-  -readability-operators-representation,
-  -readability-qualified-auto,
-  -readability-redundant-access-specifiers,
-  -readability-redundant-control-flow,
-  -readability-redundant-function-ptr-dereference,
-  -readability-redundant-preprocessor,
-  -readability-redundant-smartptr-get,
-  -readability-redundant-string-cstr,
-  -readability-simplify-subscript-expr,
-  -readability-static-accessed-through-instance,
-  -readability-string-compare,
-  -readability-uniqueptr-delete-release,
-  -readability-uppercase-literal-suffix,
-  -readability-use-anyofallof,
-  -readability-use-concise-preprocessor-directives
+  misc-const-correctness,
+  misc-definitions-in-headers,
+  misc-header-include-cycle,
+  misc-include-cleaner,
+  misc-misplaced-const,
+  misc-redundant-expression,
+  misc-static-assert,
+  misc-throw-by-value-catch-by-reference,
+  misc-unused-alias-decls,
+  misc-unused-using-decls,
+  modernize-concat-nested-namespaces,
+  modernize-deprecated-headers,
+  modernize-make-shared,
+  modernize-make-unique,
+  modernize-pass-by-value,
+  modernize-type-traits,
+  modernize-use-designated-initializers,
+  modernize-use-emplace,
+  modernize-use-equals-default,
+  modernize-use-equals-delete,
+  modernize-use-nodiscard,
+  modernize-use-override,
+  modernize-use-ranges,
+  modernize-use-scoped-lock,
+  modernize-use-starts-ends-with,
+  modernize-use-std-numbers,
+  modernize-use-using,
+  performance-faster-string-find,
+  performance-for-range-copy,
+  performance-implicit-conversion-in-loop,
+  performance-inefficient-vector-operation,
+  performance-move-const-arg,
+  performance-move-constructor-init,
+  performance-no-automatic-move,
+  performance-trivially-destructible,
+  readability-ambiguous-smartptr-reset-call,
+  readability-avoid-nested-conditional-operator,
+  readability-avoid-return-with-void-value,
+  readability-braces-around-statements,
+  readability-const-return-type,
+  readability-container-contains,
+  readability-container-size-empty,
+  readability-convert-member-functions-to-static,
+  readability-duplicate-include,
+  readability-else-after-return,
+  readability-enum-initial-value,
+  readability-identifier-naming,
+  readability-implicit-bool-conversion,
+  readability-make-member-function-const,
+  readability-math-missing-parentheses,
+  readability-misleading-indentation,
+  readability-non-const-parameter,
+  readability-redundant-casting,
+  readability-redundant-declaration,
+  readability-redundant-inline-specifier,
+  readability-redundant-member-init,
+  readability-redundant-string-init,
+  readability-reference-to-constructed-temporary,
+  readability-simplify-boolean-expr,
+  readability-static-definition-in-anonymous-namespace,
+  readability-suspicious-call-argument,
+  readability-use-std-min-max
   "
 # ---
-# bugprone-narrowing-conversions,                      # This will break a lot of code but we should enable it in the future because it can eliminate a lot of bugs
-# misc-override-with-different-visibility,             # Will be addressed in a future PR, but for now it generates too many warnings
 # readability-inconsistent-declaration-parameter-name, # In this codebase this check will break a lot of arg names
 # readability-static-accessed-through-instance,        # this check is probably unnecessary. It makes the code less readable
 # ---
@@ -147,7 +161,7 @@ CheckOptions:
   bugprone-unsafe-functions.ReportMoreUnsafeFunctions: true
   bugprone-unused-return-value.CheckedReturnTypes: ::std::error_code;::std::error_condition;::std::errc
 
-  misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/.*;openssl/obj_mac\\.h"
+  misc-include-cleaner.IgnoreHeaders: ".*/(detail|impl)/.*;.*fwd\\.h(pp)?;time.h;stdlib.h;sqlite3.h;netinet/in\\.h;sys/resource\\.h;sys/sysinfo\\.h;linux/sysinfo\\.h;__chrono/.*;bits/.*;_abort\\.h;boost/uuid/uuid_hash.hpp;boost/beast/core/flat_buffer\\.hpp;boost/beast/http/field\\.hpp;boost/beast/http/dynamic_body\\.hpp;boost/beast/http/message\\.hpp;boost/beast/http/read\\.hpp;boost/beast/http/write\\.hpp;openssl/obj_mac\\.h"
 
   readability-braces-around-statements.ShortStatementLines: 2
   readability-identifier-naming.MacroDefinitionCase: UPPER_CASE

.gersemi/definitions.cmake

@@ -48,12 +48,6 @@ endfunction()
 function(add_module parent name)
 endfunction()
 
-function(verify_target_headers target headers_dir)
-endfunction()
-
-function(_verify_add_headers target dir)
-endfunction()
-
 function(setup_protocol_autogen)
 endfunction()
 
@@ -102,6 +96,3 @@ function(verbose_find_path variable name)
         ${ARGN}
     )
 endfunction()
-
-function(patch_nix_binary target)
-endfunction()

.github/actions/setup-conan/action.yml

@@ -9,7 +9,7 @@ inputs:
   remote_url:
     description: "The URL of the Conan endpoint to use."
     required: false
-    default: https://conan.xrplf.org/repository/conan/
+    default: https://conan.ripplex.io
 
 runs:
   using: composite

.github/scripts/levelization/results/loops.txt

@@ -1,3 +1,9 @@
+Loop: test.jtx test.toplevel
+  test.toplevel > test.jtx
+
+Loop: test.jtx test.unit_test
+  test.unit_test ~= test.jtx
+
 Loop: xrpld.app xrpld.overlay
   xrpld.app > xrpld.overlay
 

.github/scripts/levelization/results/ordering.txt

@@ -14,6 +14,7 @@ libxrpl.ledger > xrpl.json
 libxrpl.ledger > xrpl.ledger
 libxrpl.ledger > xrpl.nodestore
 libxrpl.ledger > xrpl.protocol
+libxrpl.ledger > xrpl.server
 libxrpl.ledger > xrpl.shamap
 libxrpl.net > xrpl.basics
 libxrpl.net > xrpl.net
@@ -83,6 +84,7 @@ test.conditions > xrpl.basics
 test.conditions > xrpl.conditions
 test.consensus > test.csf
 test.consensus > test.jtx
+test.consensus > test.toplevel
 test.consensus > test.unit_test
 test.consensus > xrpl.basics
 test.consensus > xrpld.app
@@ -105,9 +107,9 @@ test.csf > xrpl.basics
 test.csf > xrpld.consensus
 test.csf > xrpl.json
 test.csf > xrpl.ledger
+test.csf > xrpl.protocol
 test.json > test.jtx
 test.json > xrpl.json
-test.jtx > test.unit_test
 test.jtx > xrpl.basics
 test.jtx > xrpl.config
 test.jtx > xrpl.core
@@ -194,6 +196,8 @@ test.shamap > xrpl.config
 test.shamap > xrpl.nodestore
 test.shamap > xrpl.protocol
 test.shamap > xrpl.shamap
+test.toplevel > test.csf
+test.toplevel > xrpl.json
 test.unit_test > xrpl.basics
 test.unit_test > xrpl.protocol
 tests.libxrpl > xrpl.basics
@@ -216,14 +220,12 @@ xrpl.core > xrpl.json
 xrpl.core > xrpl.protocol
 xrpl.json > xrpl.basics
 xrpl.ledger > xrpl.basics
-xrpl.ledger > xrpl.json
-xrpl.ledger > xrpl.nodestore
 xrpl.ledger > xrpl.protocol
+xrpl.ledger > xrpl.server
 xrpl.ledger > xrpl.shamap
 xrpl.net > xrpl.basics
 xrpl.nodestore > xrpl.basics
 xrpl.nodestore > xrpl.config
-xrpl.nodestore > xrpl.json
 xrpl.nodestore > xrpl.protocol
 xrpl.protocol > xrpl.basics
 xrpl.protocol > xrpl.json
@@ -241,6 +243,7 @@ xrpl.server > xrpl.json
 xrpl.server > xrpl.protocol
 xrpl.server > xrpl.rdb
 xrpl.server > xrpl.resource
+xrpl.server > xrpl.shamap
 xrpl.shamap > xrpl.basics
 xrpl.shamap > xrpl.nodestore
 xrpl.shamap > xrpl.protocol
@@ -295,10 +298,8 @@ xrpld.peerfinder > xrpl.rdb
 xrpld.perflog > xrpl.basics
 xrpld.perflog > xrpl.config
 xrpld.perflog > xrpl.core
-xrpld.perflog > xrpld.app
 xrpld.perflog > xrpld.rpc
 xrpld.perflog > xrpl.json
-xrpld.perflog > xrpl.nodestore
 xrpld.perflog > xrpl.protocol
 xrpld.rpc > xrpl.basics
 xrpld.rpc > xrpl.config
@@ -316,6 +317,5 @@ xrpld.rpc > xrpl.shamap
 xrpld.rpc > xrpl.tx
 xrpld.shamap > xrpl.basics
 xrpld.shamap > xrpld.core
-xrpld.shamap > xrpl.nodestore
 xrpld.shamap > xrpl.protocol
 xrpld.shamap > xrpl.shamap

.github/scripts/strategy-matrix/generate.py

@@ -20,6 +20,8 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
+    if build_type == "Release":
+        args.append("-Dassert=ON")
     if extra_args:
         args.extend(extra_args.split())
     return " ".join(args)
@@ -54,8 +56,6 @@ class LinuxConfig:
     suffix: str = ""
     extra_cmake_args: str = ""
     image: str = ""  # only used by package_configs entries
-    # Flip every amendment to Supported::Yes before building (perf/test only).
-    force_supported: bool = False
     # List of GitHub event names (e.g. "pull_request") on which this config
     # should NOT run. Empty means it runs on every event.
     exclude_event_types: list[str] = dataclasses.field(default_factory=list)
@@ -144,7 +144,6 @@ class MatrixEntry:
     sanitizers: str
     image: str = ""  # container image; empty for macOS/Windows (runs natively)
     compiler: str = ""  # compiler name ("gcc" or "clang"); empty for macOS/Windows
-    force_supported: bool = False  # flip amendments to Supported::Yes before build
 
 
 @dataclasses.dataclass
@@ -214,7 +213,6 @@ def expand_linux_matrix(
                         architecture=arch_info,
                         sanitizers=sanitizer,
                         compiler=compiler,
-                        force_supported=cfg.force_supported,
                     )
                 )
 
@@ -233,14 +231,9 @@ def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
     for distro, configs in linux.package_configs.items():
         for cfg in configs:
             for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
-                # Keep in sync with build config_name so the packaging job finds
-                # the matching binary artifact (e.g. the -supported variant).
-                artifact_name = f"xrpld-{distro}-{compiler}-{build_type.lower()}-amd64"
-                if cfg.suffix:
-                    artifact_name += f"-{cfg.suffix}"
                 entries.append(
                     PackagingEntry(
-                        artifact_name=artifact_name,
+                        artifact_name=f"xrpld-{distro}-{compiler}-{build_type.lower()}-amd64",
                         image=cfg.image,
                         distro=distro,
                     )

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-e29b523",
+  "image_tag": "sha-63ffdc3",
   "configs": {
     "ubuntu": [
       {
@@ -10,7 +10,7 @@
 
       {
         "compiler": ["gcc", "clang"],
-        "build_type": ["Debug", "Release"],
+        "build_type": ["Debug"],
         "arch": ["amd64"],
         "sanitizers": ["address", "undefinedbehavior"]
       },
@@ -43,13 +43,6 @@
         "suffix": "unity",
         "extra_cmake_args": "-Dunity=ON",
         "exclude_event_types": ["pull_request"]
-      },
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "suffix": "supported",
-        "force_supported": true
       }
     ],
 
@@ -70,22 +63,12 @@
     ]
   },
   "package_configs": {
-    "ubuntu": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "suffix": "supported",
-        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
-      }
-    ],
-
     "debian": [
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
-        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-577d745"
+        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-63ffdc3"
       }
     ],
 
@@ -94,7 +77,7 @@
         "compiler": ["gcc"],
         "build_type": ["Release"],
         "arch": ["amd64"],
-        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-577d745"
+        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-63ffdc3"
       }
     ]
   }

.github/scripts/strategy-matrix/macos.json

@@ -1,6 +1,6 @@
 {
   "platform": "macos/arm64",
-  "runner": ["self-hosted", "macOS", "ARM64", "macos-26-apple-clang-21"],
+  "runner": ["self-hosted", "macOS", "ARM64", "mac-runner-m1"],
   "configs": [
     {
       "build_type": "Release",

.github/scripts/strategy-matrix/windows.json

@@ -1,6 +1,6 @@
 {
   "platform": "windows/amd64",
-  "runner": ["self-hosted", "Windows", "dev-box-windows-2026"],
+  "runner": ["self-hosted", "Windows", "devbox"],
   "configs": [
     { "build_type": "Release" },
     {

.github/workflows/build-nix-images.yml

@@ -9,20 +9,12 @@ on:
       - "flake.nix"
       - "flake.lock"
       - "nix/**"
-      - "!nix/docker/README.md"
-      - "!nix/devshell.nix"
-      - "bin/check-tools.sh"
-      - "bin/install-sanitizer-libs.sh"
   pull_request:
     paths:
       - ".github/workflows/build-nix-images.yml"
       - "flake.nix"
       - "flake.lock"
       - "nix/**"
-      - "!nix/docker/README.md"
-      - "!nix/devshell.nix"
-      - "bin/check-tools.sh"
-      - "bin/install-sanitizer-libs.sh"
   workflow_dispatch:
 
 concurrency:
@@ -54,9 +46,9 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@c1b480188519e0cad040e6aa70db1cbc5a797e07
     with:
-      image_name: xrpld/nix-${{ matrix.distro.name }}
+      image_name: ghcr.io/xrplf/xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
-      push: ${{ github.event_name == 'push' }}
+      push: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' }}

.github/workflows/build-packaging-images.yml

@@ -38,9 +38,9 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@ee03d31bcc4501d7599dc1b1ecd7a34af582ad1c
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@c1b480188519e0cad040e6aa70db1cbc5a797e07
     with:
-      image_name: xrpld/packaging-${{ matrix.distro.name }}
+      image_name: ghcr.io/xrplf/xrpld/packaging-${{ matrix.distro.name }}
       dockerfile: package/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
-      push: ${{ github.event_name == 'push' }}
+      push: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' }}

.github/workflows/build-supported-image.yml

@@ -1,104 +0,0 @@
-# Package the "all amendments Supported::Yes" build into a runtime Docker image
-# and push it to GHCR, as a drop-in for the rippleci/xrpld image xrpl.js uses
-# for standalone testing -- except every amendment is built Supported::Yes.
-#
-# This does NOT build or package anything: the Trigger workflow already builds
-# the supported binary and the supported .deb (the force_supported build config
-# and the matching supported package config in linux.json). This workflow waits
-# for a successful Trigger run on develop, downloads that run's supported .deb
-# artifact, installs it into a slim base (docker/supported.Dockerfile, which
-# replicates rippleci's layout), and pushes ghcr.io/xrplf/xrpld/supported.
-#
-# Perf/test artifact only -- never run it on a production validator.
-name: Build supported Docker image
-
-on:
-  workflow_run:
-    workflows: ["Trigger"]
-    types: [completed]
-    branches: [develop]
-  # Manual runs: point at a specific completed Trigger run via its run id.
-  workflow_dispatch:
-    inputs:
-      trigger_run_id:
-        description: "Run id of the Trigger workflow whose supported .deb to package."
-        required: true
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-defaults:
-  run:
-    shell: bash
-
-env:
-  # The supported .deb artifact uploaded by reusable-package.yml:
-  # <artifact_name>-pkg, where artifact_name carries the -supported suffix.
-  DEB_ARTIFACT: xrpld-ubuntu-gcc-release-amd64-supported-pkg
-  IMAGE_NAME: ghcr.io/xrplf/xrpld/supported
-  SOURCE_RUN_ID: ${{ github.event.workflow_run.id || inputs.trigger_run_id }}
-
-jobs:
-  image:
-    # Only for successful Trigger runs (workflow_run), and only on the canonical
-    # repo where GITHUB_TOKEN can push to ghcr.io/xrplf/*.
-    if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success') }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      actions: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Download the supported .deb from the Trigger run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          name: ${{ env.DEB_ARTIFACT }}
-          path: dl
-          run-id: ${{ env.SOURCE_RUN_ID }}
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Assemble build context
-        run: |
-          set -euo pipefail
-          mkdir -p docker-context
-          deb="$(find dl -name '*.deb' | head -n1)"
-          [ -n "${deb}" ] || {
-              echo "::error::no supported .deb found in run ${SOURCE_RUN_ID}"
-              exit 1
-          }
-          mv "${deb}" docker-context/xrpld.deb
-          echo "Packaging $(basename "${deb}") into ${IMAGE_NAME}"
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Docker metadata
-        id: meta
-        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
-        with:
-          images: ${{ env.IMAGE_NAME }}
-          tags: |
-            type=sha,prefix=sha-,format=short
-            type=raw,value=latest
-
-      - name: Build and push
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: docker-context
-          file: docker/supported.Dockerfile
-          platforms: linux/amd64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/check-pr-description.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Write PR body to file
         env:

.github/workflows/on-pr.yml

@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Determine changed files
         # This step checks whether any files have changed that should
         # cause the next jobs to run. We do it this way rather than
@@ -70,7 +70,6 @@ jobs:
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
-            bin/check-tools.sh
             cfg/**
             cmake/**
             conan/**
@@ -122,6 +121,7 @@ jobs:
       issues: write
       contents: read
     with:
+      check_only_changed: true
       create_issue_on_failure: false
 
   build-test:
@@ -153,8 +153,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   notify-clio:
     needs: upload-recipe

.github/workflows/on-tag.yml

@@ -20,8 +20,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   build-test:
     if: ${{ github.repository == 'XRPLF/rippled' }}

.github/workflows/on-trigger.yml

@@ -27,7 +27,6 @@ on:
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
-      - "bin/check-tools.sh"
       - "cfg/**"
       - "cmake/**"
       - "conan/**"
@@ -72,6 +71,7 @@ jobs:
       issues: write
       contents: read
     with:
+      check_only_changed: false
       create_issue_on_failure: ${{ github.event_name == 'schedule' }}
 
   build-test:
@@ -97,8 +97,8 @@ jobs:
     if: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
-      remote_username: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-      remote_password: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
+      remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}
+      remote_password: ${{ secrets.CONAN_REMOTE_PASSWORD }}
 
   package:
     needs: build-test

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@1bde119a1ab71305ba5d3716e7a82cea1c7bdede
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@312aaab296060ff89d7f798dcab59f019bea6e02
     with:
       runs_on: ubuntu-latest
       container: '{ "image": "ghcr.io/xrplf/ci/tools-rippled-pre-commit:sha-41ec7c1" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-63ffdc3
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
         with:
           enable_ccache: false
 

.github/workflows/reusable-build-test-config.yml

@@ -63,12 +63,6 @@ on:
         type: string
         default: ""
 
-      force_supported:
-        description: "Flip every amendment to Supported::Yes before building. For perf/test builds only; never for release artifacts."
-        required: false
-        type: boolean
-        default: false
-
     secrets:
       CODECOV_TOKEN:
         description: "The Codecov token to use for uploading coverage reports."
@@ -88,7 +82,7 @@ jobs:
     name: ${{ inputs.config_name }}
     runs-on: ${{ fromJSON(inputs.runs_on) }}
     container: ${{ inputs.image != '' && inputs.image || null }}
-    timeout-minutes: ${{ inputs.sanitizers != '' && 360 || 180 }}
+    timeout-minutes: ${{ inputs.sanitizers != '' && 360 || 90 }}
     env:
       # Use a namespace to keep the objects separate for each configuration.
       CCACHE_NAMESPACE: ${{ inputs.config_name }}
@@ -116,24 +110,10 @@ jobs:
         uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-
-      - name: Force all amendments to Supported::Yes
-        if: ${{ inputs.force_supported }}
-        run: |
-          set -euo pipefail
-          MACRO="include/xrpl/protocol/detail/features.macro"
-          echo "Flipping Supported::No -> Supported::Yes in ${MACRO}:"
-          grep -n 'Supported::No,' "${MACRO}" || echo "  (none found)"
-          sed -i 's/Supported::No,/Supported::Yes,/g' "${MACRO}"
-          if grep -q 'Supported::No,' "${MACRO}"; then
-              echo "::error::Supported::No entries remain after sed"
-              exit 1
-          fi
-          git diff -- "${MACRO}" || true
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -141,11 +121,6 @@ jobs:
         if: ${{ inputs.ccache_enabled && runner.debug == '1' }}
         run: echo "CCACHE_LOGFILE=${{ runner.temp }}/ccache.log" >>"${GITHUB_ENV}"
 
-      - name: Check tools
-        env:
-          CHECK_TOOLS_SKIP_CLONE: "1"
-        run: ./bin/check-tools.sh
-
       - name: Print build environment
         uses: XRPLF/actions/print-build-env@59dec886e4afb05a1724443af08baccbc045b574
 
@@ -183,33 +158,12 @@ jobs:
           CMAKE_ARGS: ${{ inputs.cmake_args }}
         run: |
           cmake \
-              -G '${{ runner.os == 'Windows' && 'Visual Studio 18 2026' || 'Ninja' }}' \
+              -G '${{ runner.os == 'Windows' && 'Visual Studio 17 2022' || 'Ninja' }}' \
               -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake \
               -DCMAKE_BUILD_TYPE="${BUILD_TYPE}" \
               ${CMAKE_ARGS} \
               ..
 
-      # Export the sanitizer options before any instrumented binary runs. The
-      # protocol code-gen and build steps below invoke instrumented dependency
-      # tools (protoc, grpc), so setting UBSAN_OPTIONS here lets the UBSan
-      # suppression list silence their diagnostics too, not just at test time.
-      # GITHUB_WORKSPACE (not the github.workspace context) is used so the path
-      # resolves correctly inside the container job.
-      - name: Set sanitizer options
-        if: ${{ !inputs.build_only && env.SANITIZERS_ENABLED == 'true' }}
-        env:
-          CONFIG_NAME: ${{ inputs.config_name }}
-        run: |
-          SUPP="${GITHUB_WORKSPACE}/sanitizers/suppressions"
-          ASAN_OPTS="include=${SUPP}/runtime-asan-options.txt:suppressions=${SUPP}/asan.supp"
-          if [[ "${CONFIG_NAME}" == *gcc* ]]; then
-              ASAN_OPTS="${ASAN_OPTS}:alloc_dealloc_mismatch=0"
-          fi
-          echo "ASAN_OPTIONS=${ASAN_OPTS}" >>${GITHUB_ENV}
-          echo "TSAN_OPTIONS=include=${SUPP}/runtime-tsan-options.txt:suppressions=${SUPP}/tsan.supp" >>${GITHUB_ENV}
-          echo "UBSAN_OPTIONS=include=${SUPP}/runtime-ubsan-options.txt:suppressions=${SUPP}/ubsan.supp" >>${GITHUB_ENV}
-          echo "LSAN_OPTIONS=include=${SUPP}/runtime-lsan-options.txt:suppressions=${SUPP}/lsan.supp" >>${GITHUB_ENV}
-
       - name: Check protocol autogen files are up-to-date
         working-directory: ${{ env.BUILD_DIR }}
         env:
@@ -249,6 +203,21 @@ jobs:
               --parallel "${BUILD_NPROC}" \
               --target "${CMAKE_TARGET}"
 
+      # This step is needed to allow running in non-Nix environments
+      - name: Patch binary to use default loader and remove rpath (Linux)
+        if: ${{ runner.os == 'Linux' && env.SANITIZERS_ENABLED == 'false' }}
+        run: |
+          loader="$(/tmp/loader-path.sh)"
+          patchelf --set-interpreter "${loader}" --remove-rpath "${{ env.BUILD_DIR }}/xrpld"
+
+      # We're only running aarch64 Linux builds in Ubuntu-based images, so this is kept simple
+      - name: Install libatomic (Linux aarch64)
+        if: ${{ runner.os == 'Linux' && runner.arch == 'ARM64' }}
+        run: |
+          apt update --yes
+          apt install -y --no-install-recommends \
+              libatomic1
+
       - name: Show ccache statistics
         if: ${{ inputs.ccache_enabled }}
         run: |
@@ -310,6 +279,20 @@ jobs:
         run: |
           ./xrpld --version | grep libvoidstar
 
+      - name: Set sanitizer options
+        if: ${{ !inputs.build_only && env.SANITIZERS_ENABLED == 'true' }}
+        env:
+          CONFIG_NAME: ${{ inputs.config_name }}
+        run: |
+          ASAN_OPTS="include=${GITHUB_WORKSPACE}/sanitizers/suppressions/runtime-asan-options.txt:suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/asan.supp"
+          if [[ "${CONFIG_NAME}" == *gcc* ]]; then
+              ASAN_OPTS="${ASAN_OPTS}:alloc_dealloc_mismatch=0"
+          fi
+          echo "ASAN_OPTIONS=${ASAN_OPTS}" >>${GITHUB_ENV}
+          echo "TSAN_OPTIONS=include=${GITHUB_WORKSPACE}/sanitizers/suppressions/runtime-tsan-options.txt:suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/tsan.supp" >>${GITHUB_ENV}
+          echo "UBSAN_OPTIONS=include=${GITHUB_WORKSPACE}/sanitizers/suppressions/runtime-ubsan-options.txt:suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/ubsan.supp" >>${GITHUB_ENV}
+          echo "LSAN_OPTIONS=include=${GITHUB_WORKSPACE}/sanitizers/suppressions/runtime-lsan-options.txt:suppressions=${GITHUB_WORKSPACE}/sanitizers/suppressions/lsan.supp" >>${GITHUB_ENV}
+
       - name: Run the separate tests
         if: ${{ !inputs.build_only }}
         working-directory: ${{ runner.os == 'Windows' && format('{0}/{1}', env.BUILD_DIR, inputs.build_type) || env.BUILD_DIR }}

.github/workflows/reusable-build-test.yml

@@ -50,6 +50,5 @@ jobs:
       config_name: ${{ matrix.config_name }}
       sanitizers: ${{ matrix.sanitizers }}
       compiler: ${{ matrix.compiler || '' }}
-      force_supported: ${{ matrix.force_supported || false }}
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/reusable-check-levelization.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Check levelization
         run: python .github/scripts/levelization/generate.py
       - name: Check for differences

.github/workflows/reusable-check-rename.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Check definitions
         run: .github/scripts/rename/definitions.sh .
       - name: Check copyright notices

.github/workflows/reusable-clang-tidy.yml

@@ -3,6 +3,10 @@ name: Run clang-tidy on files
 on:
   workflow_call:
     inputs:
+      check_only_changed:
+        description: "Check only changed files in PR. If false, checks all files in the repository."
+        type: boolean
+        default: false
       create_issue_on_failure:
         description: "Whether to create an issue if the check failed"
         type: boolean
@@ -16,34 +20,32 @@ env:
   BUILD_DIR: build
   BUILD_TYPE: Debug # Debug so that ASSERTS and such participate in clang-tidy check
 
-  OUTPUT_FILE: /tmp/clang-tidy-output.txt
-  FILTERED_OUTPUT_FILE: /tmp/clang-tidy-filtered-output.txt
-  DIFF_FILE: /tmp/clang-tidy-git-diff.txt
-  ISSUE_FILE: /tmp/clang-tidy-issue.md
-
-  COMPILER: clang
+  OUTPUT_FILE: clang-tidy-output.txt
+  DIFF_FILE: clang-tidy-git-diff.txt
+  ISSUE_FILE: clang-tidy-issue.md
 
 jobs:
   determine-files:
+    if: ${{ inputs.check_only_changed }}
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@312aaab296060ff89d7f798dcab59f019bea6e02
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
-    if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
+    if: ${{ always() && !cancelled() && (!inputs.check_only_changed || needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.clang_tidy_config_changed == 'true') }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-e29b523"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-63ffdc3"
     permissions:
       contents: read
       issues: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
         with:
           enable_ccache: false
 
@@ -57,7 +59,7 @@ jobs:
       - name: Set compiler environment
         uses: ./.github/actions/set-compiler-env
         with:
-          compiler: ${{ env.COMPILER }}
+          compiler: clang
 
       - name: Setup Conan
         uses: ./.github/actions/setup-conan
@@ -79,7 +81,6 @@ jobs:
               -Dtests=ON \
               -Dwerr=ON \
               -Dxrpld=ON \
-              -Dverify_headers=ON \
               ..
 
       # clang-tidy needs headers generated from proto files
@@ -92,15 +93,15 @@ jobs:
         id: run_clang_tidy
         continue-on-error: true
         env:
-          TARGETS: ${{ needs.determine-files.outputs.need_full_run != 'true' && needs.determine-files.outputs.cpp_changed_files || 'include src tests' }}
+          TARGETS: ${{ (needs.determine-files.outputs.clang_tidy_config_changed != 'true' && inputs.check_only_changed) && needs.determine-files.outputs.cpp_changed_files || 'src tests' }}
         run: |
           set -o pipefail
           run-clang-tidy -j ${{ steps.nproc.outputs.nproc }} -p "${BUILD_DIR}" -quiet -fix -allow-no-checks ${TARGETS} 2>&1 | tee "${OUTPUT_FILE}"
 
-      - name: Print filtered clang-tidy errors
+      - name: Print errors
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}
         run: |
-          bin/filter-clang-tidy.py "${OUTPUT_FILE}"
+          sed '/error\||/!d' "${OUTPUT_FILE}"
 
       - name: Upload clang-tidy output
         if: ${{ github.event.repository.visibility == 'public' && steps.run_clang_tidy.outcome != 'success' }}
@@ -144,26 +145,26 @@ jobs:
           \`\`\`
           EOF
 
-      - name: Append filtered clang-tidy output to issue body
+      - name: Append clang-tidy output to issue body (filter for errors and warnings)
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}
         run: |
           if [ -f "${OUTPUT_FILE}" ]; then
-              # Filter to the unique errors with their source context.
-              bin/filter-clang-tidy.py "${OUTPUT_FILE}" >"${FILTERED_OUTPUT_FILE}" || true
+              # Extract lines containing 'error:', 'warning:', or 'note:'
+              grep -E '(error:|warning:|note:)' "${OUTPUT_FILE}" >filtered-output.txt || true
 
               # If filtered output is empty, use original (might be a different error format)
-              if [ ! -s "${FILTERED_OUTPUT_FILE}" ]; then
-                  cp "${OUTPUT_FILE}" "${FILTERED_OUTPUT_FILE}"
+              if [ ! -s filtered-output.txt ]; then
+                  cp "${OUTPUT_FILE}" filtered-output.txt
               fi
 
               # Truncate if too large
-              head -c 60000 "${FILTERED_OUTPUT_FILE}" >>"${ISSUE_FILE}"
-              if [ "$(wc -c <"${FILTERED_OUTPUT_FILE}")" -gt 60000 ]; then
+              head -c 60000 filtered-output.txt >>"${ISSUE_FILE}"
+              if [ "$(wc -c <filtered-output.txt)" -gt 60000 ]; then
                   echo "" >>"${ISSUE_FILE}"
                   echo "... (output truncated, see artifacts for full output)" >>"${ISSUE_FILE}"
               fi
 
-              rm "${FILTERED_OUTPUT_FILE}"
+              rm filtered-output.txt
           else
               echo "No output file found" >>"${ISSUE_FILE}"
           fi

.github/workflows/reusable-package.yml

@@ -27,10 +27,10 @@ jobs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
 
@@ -39,8 +39,23 @@ jobs:
         working-directory: .github/scripts/strategy-matrix
         run: ./generate.py --packaging >>"${GITHUB_OUTPUT}"
 
+  generate-version:
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          sparse-checkout: |
+            .github/actions/generate-version
+            src/libxrpl/protocol/BuildInfo.cpp
+      - name: Generate version
+        id: version
+        uses: ./.github/actions/generate-version
+
   package:
-    needs: [generate-matrix]
+    needs: [generate-matrix, generate-version]
     if: ${{ github.event.repository.visibility == 'public' }}
     strategy:
       fail-fast: false
@@ -54,7 +69,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Download pre-built binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -67,13 +82,14 @@ jobs:
 
       - name: Build package
         env:
+          PKG_VERSION: ${{ needs.generate-version.outputs.version }}
           PKG_RELEASE: ${{ inputs.pkg_release }}
         run: ./package/build_pkg.sh
 
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: ${{ matrix.artifact_name }}-pkg
+          name: ${{ matrix.artifact_name }}-pkg-${{ needs.generate-version.outputs.version }}
           path: |
             ${{ env.BUILD_DIR }}/debbuild/*.deb
             ${{ env.BUILD_DIR }}/debbuild/*.ddeb

.github/workflows/reusable-strategy-matrix.yml

@@ -23,10 +23,10 @@ jobs:
       matrix: ${{ steps.generate.outputs.matrix }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
 

.github/workflows/reusable-upload-recipe.yml

@@ -14,7 +14,7 @@ on:
         description: "The URL of the Conan endpoint to use."
         required: false
         type: string
-        default: https://conan.xrplf.org/repository/conan/
+        default: https://conan.ripplex.io
 
     secrets:
       remote_username:
@@ -40,14 +40,10 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-e29b523
-    env:
-      REMOTE_NAME: ${{ inputs.remote_name }}
-      CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
-      CONAN_PASSWORD_XRPLF: ${{ secrets.remote_password }}
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-63ffdc3
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Generate build version number
         id: version
@@ -60,9 +56,15 @@ jobs:
           remote_url: ${{ inputs.remote_url }}
 
       - name: Log into Conan remote
-        run: conan remote login "${REMOTE_NAME}" "${CONAN_LOGIN_USERNAME_XRPLF}" --password "${CONAN_PASSWORD_XRPLF}"
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
+          REMOTE_USERNAME: ${{ secrets.remote_username }}
+          REMOTE_PASSWORD: ${{ secrets.remote_password }}
+        run: conan remote login "${REMOTE_NAME}" "${REMOTE_USERNAME}" --password "${REMOTE_PASSWORD}"
 
       - name: Upload Conan recipe (version)
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=${{ steps.version.outputs.version }}
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/${{ steps.version.outputs.version }}
@@ -71,6 +73,8 @@ jobs:
       # 'develop' branch, see on-trigger.yml.
       - name: Upload Conan recipe (develop)
         if: ${{ github.event_name == 'push' }}
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=develop
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/develop
@@ -79,6 +83,8 @@ jobs:
       # one of the 'release' branches, see on-pr.yml.
       - name: Upload Conan recipe (rc)
         if: ${{ github.event_name == 'pull_request' }}
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=rc
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/rc
@@ -87,6 +93,8 @@ jobs:
       # release, see on-tag.yml.
       - name: Upload Conan recipe (release)
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        env:
+          REMOTE_NAME: ${{ inputs.remote_name }}
         run: |
           conan export . --version=release
           conan upload --confirm --check --remote="${REMOTE_NAME}" xrpl/release

.github/workflows/upload-conan-deps.yml

@@ -34,7 +34,7 @@ on:
 
 env:
   CONAN_REMOTE_NAME: xrplf
-  CONAN_REMOTE_URL: https://conan.xrplf.org/repository/conan/
+  CONAN_REMOTE_URL: https://conan.ripplex.io
   NPROC_SUBTRACT: 2
 
 concurrency:
@@ -65,10 +65,10 @@ jobs:
         uses: XRPLF/actions/cleanup-workspace@c7d9ce5ebb03c752a354889ecd870cadfc2b1cd4
 
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@64ec3cf3b152b4444638f470bbd6df7a7a30c81c
+        uses: XRPLF/actions/prepare-runner@c47daebb2f9db64ffbac71b47d68a661498d5ce8
         with:
           enable_ccache: false
 
@@ -108,12 +108,10 @@ jobs:
 
       - name: Log into Conan remote
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
-        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.NEXUS_REMOTE_USERNAME }}" --password "${{ secrets.NEXUS_REMOTE_PASSWORD }}"
+        run: conan remote login "${CONAN_REMOTE_NAME}" "${{ secrets.CONAN_REMOTE_USERNAME }}" --password "${{ secrets.CONAN_REMOTE_PASSWORD }}"
 
       - name: Upload Conan packages
         if: ${{ github.repository == 'XRPLF/rippled' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
         env:
           FORCE_OPTION: ${{ github.event.inputs.force_upload == 'true' && '--force' || '' }}
-          CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.NEXUS_REMOTE_USERNAME }}
-          CONAN_PASSWORD_XRPLF: ${{ secrets.NEXUS_REMOTE_PASSWORD }}
         run: conan upload "*" --remote="${CONAN_REMOTE_NAME}" --confirm ${FORCE_OPTION}

.pre-commit-config.yaml

@@ -15,7 +15,6 @@ repos:
     hooks:
       - id: check-added-large-files
         args: [--maxkb=400, --enforce-all]
-      - id: check-executables-have-shebangs
       - id: trailing-whitespace
       - id: end-of-file-fixer
       - id: check-merge-conflict
@@ -28,37 +27,30 @@ repos:
         entry: ./bin/pre-commit/clang_tidy_check.py
         language: python
         types_or: [c++, c]
-        # .ipp fragments are included by their owning header rather than compiled
-        # as standalone translation units, so they have no compile_commands.json
-        # entry to lint (verify_headers checks them transitively).
-        exclude: '^include/xrpl/protocol_autogen|\.ipp$'
+        exclude: ^include/xrpl/protocol_autogen
+        pass_filenames: false # script determines the staged files itself
       - id: fix-include-style
         name: fix include style
         entry: ./bin/pre-commit/fix_include_style.py
         language: python
         types_or: [c++, c]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
-      - id: fix-pragma-once
-        name: fix missing '#pragma once' declarations in header files
-        language: python
-        entry: ./bin/pre-commit/fix_pragma_once.py
-        files: \.(h|hpp)$
 
   - repo: https://github.com/pre-commit/mirrors-clang-format
     rev: dd18dad857d6133e90bbe478f4f2f22ec0030269 # frozen: v22.1.5
     hooks:
       - id: clang-format
         args: [--style=file]
-        types_or: [c++, c, proto]
+        "types_or": [c++, c, proto]
         exclude: ^include/xrpl/protocol_autogen/(transactions|ledger_entries)/
 
   - repo: https://github.com/BlankSpruce/gersemi-pre-commit
-    rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7
+    rev: faadd6a9d852369ca94f4d15b2404c967ba8cb01 # frozen: 0.27.6
     hooks:
       - id: gersemi
 
   - repo: https://github.com/rbubley/mirrors-prettier
-    rev: 39e2973981e6d2f9b6c543b0086a2d2393abdc89 # frozen: v3.9.4
+    rev: 515f543f5718ebfd6ce22e16708bb32c68ff96e1 # frozen: v3.8.3
     hooks:
       - id: prettier
         args: [--end-of-line=auto]
@@ -88,7 +80,7 @@ repos:
         files: \.md$
 
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: ea11f9efc0bec520073405bc30552da887ba71bc # frozen: v10.0.1
+    rev: 4643f154907327ee0a2c7038f0296e0dd77d9776 # frozen: v10.0.0
     hooks:
       - id: cspell # Spell check changed files
         exclude: |

BUILD.md

@@ -1,57 +1,26 @@
-| :warning: **WARNING** :warning:                                                                                                                                                                                                                                                                                                                                                                                                                                               |
-| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md).<br><br>These instructions also assume a basic familiarity with Conan and CMake. If you are unfamiliar with Conan, you can read our [crash course](./docs/build/conan.md) or the official [Getting Started][conan-getting-started] walkthrough. |
+| :warning: **WARNING** :warning:                                                                                                                                                                                                |
+| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| These instructions assume you have a C++ development environment ready with Git, Python, Conan, CMake, and a C++ compiler. For help setting one up on Linux, macOS, or Windows, [see this guide](./docs/build/environment.md). |
 
-## Minimum Requirements
+> These instructions also assume a basic familiarity with Conan and CMake.
+> If you are unfamiliar with Conan, you can read our
+> [crash course](./docs/build/conan.md) or the official [Getting Started][3]
+> walkthrough.
 
-See [System Requirements](https://xrpl.org/system-requirements.html).
+## Branches
 
-Building xrpld generally requires Git, Python, Conan, CMake, and a C++
-compiler.
-
-- [Python](https://www.python.org/downloads/)
-- [Conan](https://conan.io/downloads.html)
-- [CMake](https://cmake.org/download/)
-
-You can verify that the required tools are installed and runnable with:
+For a stable release, choose the `master` branch or one of the [tagged
+releases](https://github.com/XRPLF/rippled/releases).
 
 ```bash
-./bin/check-tools.sh
+git checkout master
 ```
 
-`xrpld` is written in the C++23 dialect. The [tested compiler versions][cpp23-support] are:
+For the latest release candidate, choose the `release` branch.
 
-| Compiler    | Version         |
-| ----------- | --------------- |
-| GCC         | 15.2            |
-| Clang       | 22              |
-| Apple Clang | 17              |
-| MSVC        | 19.44[^windows] |
-
-## Operating Systems
-
-Please see the [environment setup guide](./docs/build/environment.md) for detailed instructions for all platforms.
-
-### Linux
-
-The Ubuntu Linux distribution has received the highest level of quality
-assurance, testing, and support. We also support Red Hat and use Debian
-internally.
-Our Linux CI tooling is distro-independent and uses a Nix-based environment, so it should be possible to build on other Linux distributions as well, although we have not tested them.
-
-### macOS
-
-Many `xrpld` engineers use macOS for development.
-
-### Windows
-
-Windows is used by some engineers for development only.
-
-[^windows]: Windows is not recommended for production use.
-
-## Steps
-
-### Branches
+```bash
+git checkout release
+```
 
 For the latest set of untested features, or to contribute, choose the `develop`
 branch.
@@ -60,15 +29,55 @@ branch.
 git checkout develop
 ```
 
-For a release candidate, choose the relevant release branch, e.g.
-`release/3.2.x`.
+## Minimum Requirements
 
-```bash
-git checkout release/3.2.x
-```
+See [System Requirements](https://xrpl.org/system-requirements.html).
 
-For a stable release, choose one of the [tagged
-releases](https://github.com/XRPLF/rippled/releases).
+Building xrpld generally requires git, Python, Conan, CMake, and a C++
+compiler. Some guidance on setting up such a [C++ development environment can be
+found here](./docs/build/environment.md).
+
+- [Python 3.11](https://www.python.org/downloads/), or higher
+- [Conan 2.17](https://conan.io/downloads.html)[^1], or higher
+- [CMake 3.22](https://cmake.org/download/), or higher
+
+[^1]:
+    It is possible to build with Conan 1.60+, but the instructions are
+    significantly different, which is why we are not recommending it.
+
+`xrpld` is written in the C++23 dialect and includes the `<concepts>` header.
+The [tested compiler versions][2] are:
+
+| Compiler    | Version   |
+| ----------- | --------- |
+| GCC         | 15        |
+| Clang       | 22        |
+| Apple Clang | 17        |
+| MSVC        | 19.44[^3] |
+
+### Linux
+
+The Ubuntu Linux distribution has received the highest level of quality
+assurance, testing, and support. We also support Red Hat and use Debian
+internally.
+
+Here are [sample instructions for setting up a C++ development environment on
+Linux](./docs/build/environment.md#linux).
+
+### Mac
+
+Many xrpld engineers use macOS for development.
+
+Here are [sample instructions for setting up a C++ development environment on
+macOS](./docs/build/environment.md#macos).
+
+### Windows
+
+Windows is used by some engineers for development only.
+
+[^3]: Windows is not recommended for production use.
+
+## Steps
 
 ### Set Up Conan
 
@@ -77,11 +86,18 @@ Conan, CMake, and a C++ compiler, you may need to set up your Conan profile.
 
 These instructions assume a basic familiarity with Conan and CMake. If you are
 unfamiliar with Conan, then please read [this crash course](./docs/build/conan.md) or the official
-[Getting Started][conan-getting-started] walkthrough.
+[Getting Started][3] walkthrough.
 
-#### Profiles
+#### Conan lockfile
 
-We recommend that you install our Conan profiles:
+To achieve reproducible dependencies, we use a [Conan lockfile](https://docs.conan.io/2/tutorial/versioning/lockfiles.html),
+which has to be updated every time dependencies change.
+
+Please see the [instructions on how to regenerate the lockfile](conan/lockfile/README.md).
+
+#### Default profile
+
+We recommend that you import the provided `conan/profiles/default` profile:
 
 ```bash
 conan config install conan/profiles/ -tf $(conan config home)/profiles/
@@ -93,15 +109,222 @@ You can check your Conan profile by running:
 conan profile show
 ```
 
-If the default profile is not suitable for your environment, you can create a custom profile and pass it to Conan.
-More information on customizing Conan can be found in the [Advanced Conan configuration](./docs/build/advanced_conan.md).
+#### Custom profile
 
-#### Add xrplf remote
-
-Run the following command to add the `xrplf` remote, which hosts some of our dependencies:
+If the default profile does not work for you and you do not yet have a Conan
+profile, you can create one by running:
 
 ```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
+conan profile detect
+```
+
+You may need to make changes to the profile to suit your environment. You can
+refer to the provided `conan/profiles/default` profile for inspiration, and you
+may also need to apply the required [tweaks](#conan-profile-tweaks) to this
+default profile.
+
+### Patched recipes
+
+Occasionally, we need patched recipes or recipes not present in Conan Center.
+We maintain a fork of the Conan Center Index
+[here](https://github.com/XRPLF/conan-center-index/) containing the modified and newly added recipes.
+
+To ensure our patched recipes are used, you must add our Conan remote at a
+higher index than the default Conan Center remote, so it is consulted first. You
+can do this by running:
+
+```bash
+conan remote add --index 0 xrplf https://conan.ripplex.io
+```
+
+Alternatively, you can pull our recipes from the repository and export them locally:
+
+```bash
+# Define which recipes to export.
+recipes=('abseil' 'ed25519' 'mpt-crypto' 'openssl' 'secp256k1' 'snappy' 'soci' 'wasm-xrplf' 'wasmi')
+
+# Selectively check out the recipes from our CCI fork.
+cd external
+mkdir -p conan-center-index
+cd conan-center-index
+git init
+git remote add origin git@github.com:XRPLF/conan-center-index.git
+git sparse-checkout init
+for recipe in "${recipes[@]}"; do
+    echo "Checking out recipe '${recipe}'..."
+    git sparse-checkout add recipes/${recipe}
+done
+git fetch origin master
+git checkout master
+
+./export_all.sh
+cd ../../
+```
+
+In the case we switch to a newer version of a dependency that still requires a
+patch or add a new dependency, it will be necessary for you to pull in the changes and re-export the
+updated dependencies with the newer version. However, if we switch to a newer
+version that no longer requires a patch, no action is required on your part, as
+the new recipe will be automatically pulled from the official Conan Center.
+
+> [!NOTE]
+> You might need to add `--lockfile=""` to your `conan install` command
+> to avoid automatic use of the existing `conan.lock` file when you run
+> `conan export` manually on your machine
+>
+> This is not recommended though, as you might end up using different revisions of recipes.
+
+### Conan profile tweaks
+
+#### Missing compiler version
+
+If you see an error similar to the following after running `conan profile show`:
+
+```text
+ERROR: Invalid setting '17' is not a valid 'settings.compiler.version' value.
+Possible values are ['5.0', '5.1', '6.0', '6.1', '7.0', '7.3', '8.0', '8.1',
+'9.0', '9.1', '10.0', '11.0', '12.0', '13', '13.0', '13.1', '14', '14.0', '15',
+'15.0', '16', '16.0']
+Read "http://docs.conan.io/2/knowledge/faq.html#error-invalid-setting"
+```
+
+you need to add your compiler to the list of compiler versions in
+`$(conan config home)/settings_user.yml`, by adding the required version number(s)
+to the `version` array specific for your compiler. For example:
+
+```yaml
+compiler:
+  apple-clang:
+    version: ["17.0"]
+```
+
+#### Multiple compilers
+
+If you have multiple compilers installed, make sure to select the one to use in
+your default Conan configuration **before** running `conan profile detect`, by
+setting the `CC` and `CXX` environment variables.
+
+For example, if you are running MacOS and have [homebrew
+LLVM@18](https://formulae.brew.sh/formula/llvm@18), and want to use it as a
+compiler in the new Conan profile:
+
+```bash
+export CC=$(brew --prefix llvm@18)/bin/clang
+export CXX=$(brew --prefix llvm@18)/bin/clang++
+conan profile detect
+```
+
+You should also explicitly set the path to the compiler in the profile file,
+which helps to avoid errors when `CC` and/or `CXX` are set and disagree with the
+selected Conan profile. For example:
+
+```text
+[conf]
+tools.build:compiler_executables={'c':'/usr/bin/gcc','cpp':'/usr/bin/g++'}
+```
+
+#### Multiple profiles
+
+You can manage multiple Conan profiles in the directory
+`$(conan config home)/profiles`, for example renaming `default` to a different
+name and then creating a new `default` profile for a different compiler.
+
+#### Select language
+
+The default profile created by Conan will typically select different C++ dialect
+than C++23 used by this project. You should set `23` in the profile line
+starting with `compiler.cppstd=`. For example:
+
+```bash
+sed -i.bak -e 's|^compiler\.cppstd=.*$|compiler.cppstd=23|' $(conan config home)/profiles/default
+```
+
+#### Select standard library in Linux
+
+**Linux** developers will commonly have a default Conan [profile][] that
+compiles with GCC and links with libstdc++. If you are linking with libstdc++
+(see profile setting `compiler.libcxx`), then you will need to choose the
+`libstdc++11` ABI:
+
+```bash
+sed -i.bak -e 's|^compiler\.libcxx=.*$|compiler.libcxx=libstdc++11|' $(conan config home)/profiles/default
+```
+
+#### Select architecture and runtime in Windows
+
+**Windows** developers may need to use the x64 native build tools. An easy way
+to do that is to run the shortcut "x64 Native Tools Command Prompt" for the
+version of Visual Studio that you have installed.
+
+Windows developers must also build `xrpld` and its dependencies for the x64
+architecture:
+
+```bash
+sed -i.bak -e 's|^arch=.*$|arch=x86_64|' $(conan config home)/profiles/default
+```
+
+**Windows** developers also must select static runtime:
+
+```bash
+sed -i.bak -e 's|^compiler\.runtime=.*$|compiler.runtime=static|' $(conan config home)/profiles/default
+```
+
+#### Clang workaround for grpc
+
+If your compiler is clang, version 19 or later, or apple-clang, version 17 or
+later, you may encounter a compilation error while building the `grpc`
+dependency:
+
+```text
+In file included from .../lib/promise/try_seq.h:26:
+.../lib/promise/detail/basic_seq.h:499:38: error: a template argument list is expected after a name prefixed by the template keyword [-Wmissing-template-arg-list-after-template-kw]
+  499 |                     Traits::template CallSeqFactory(f_, *cur_, std::move(arg)));
+      |                                      ^
+```
+
+The workaround for this error is to add two lines to profile:
+
+```text
+[conf]
+tools.build:cxxflags=['-Wno-missing-template-arg-list-after-template-kw']
+```
+
+#### Workaround for gcc 12
+
+If your compiler is gcc, version 12, and you have enabled `werr` option, you may
+encounter a compilation error such as:
+
+```text
+/usr/include/c++/12/bits/char_traits.h:435:56: error: 'void* __builtin_memcpy(void*, const void*, long unsigned int)' accessing 9223372036854775810 or more bytes at offsets [2, 9223372036854775807] and 1 may overlap up to 9223372036854775813 bytes at offset -3 [-Werror=restrict]
+  435 |         return static_cast<char_type*>(__builtin_memcpy(__s1, __s2, __n));
+      |                                        ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
+cc1plus: all warnings being treated as errors
+```
+
+The workaround for this error is to add two lines to your profile:
+
+```text
+[conf]
+tools.build:cxxflags=['-Wno-restrict']
+```
+
+#### Workaround for clang 16
+
+If your compiler is clang, version 16, you may encounter compilation error such
+as:
+
+```text
+In file included from .../boost/beast/websocket/stream.hpp:2857:
+.../boost/beast/websocket/impl/read.hpp:695:17: error: call to 'async_teardown' is ambiguous
+                async_teardown(impl.role, impl.stream(),
+                ^~~~~~~~~~~~~~
+```
+
+The workaround for this error is to add two lines to your profile:
+
+```text
+[conf]
+tools.build:cxxflags=['-DBOOST_ASIO_DISABLE_CONCEPTS']
 ```
 
 ### Set Up Ccache
@@ -110,7 +333,14 @@ To speed up repeated compilations, we recommend that you install
 [ccache](https://ccache.dev), a tool that wraps your compiler so that it can
 cache build objects locally.
 
-On Linux and macOS, `ccache` is included in the [Nix development shell](./docs/build/nix.md).
+#### Linux
+
+You can install it using the package manager, e.g. `sudo apt install ccache`
+(Ubuntu) or `sudo dnf install ccache` (RHEL).
+
+#### macOS
+
+You can install it using Homebrew, i.e. `brew install ccache`.
 
 #### Windows
 
@@ -317,41 +547,21 @@ See [Sanitizers docs](./docs/build/sanitizers.md) for more details.
 
 ## Options
 
-| Option           | Default Value | Description                                                                   |
-| ---------------- | ------------- | ----------------------------------------------------------------------------- |
-| `assert`         | OFF           | Force enabling assertions.                                                    |
-| `coverage`       | OFF           | Prepare the coverage report.                                                  |
-| `tests`          | OFF           | Build tests.                                                                  |
-| `unity`          | OFF           | Configure a unity build.                                                      |
-| `verify_headers` | ON            | Make the `verify-headers` target available to compile each header on its own. |
-| `xrpld`          | OFF           | Build the xrpld application, and not just the libxrpl library.                |
-| `werr`           | OFF           | Treat compilation warnings as errors                                          |
-| `wextra`         | OFF           | Enable additional compilation warnings                                        |
+| Option     | Default Value | Description                                                    |
+| ---------- | ------------- | -------------------------------------------------------------- |
+| `assert`   | OFF           | Enable assertions.                                             |
+| `coverage` | OFF           | Prepare the coverage report.                                   |
+| `tests`    | OFF           | Build tests.                                                   |
+| `unity`    | OFF           | Configure a unity build.                                       |
+| `xrpld`    | OFF           | Build the xrpld application, and not just the libxrpl library. |
+| `werr`     | OFF           | Treat compilation warnings as errors                           |
+| `wextra`   | OFF           | Enable additional compilation warnings                         |
 
-[Unity builds][unity-build] may be faster for the first build (at the cost of much more
+[Unity builds][5] may be faster for the first build (at the cost of much more
 memory) since they concatenate sources into fewer translation units. Non-unity
 builds may be faster for incremental builds, and can be helpful for detecting
 `#include` omissions.
 
-### Verifying headers
-
-The regular build only compiles `.cpp` files, so a header is only ever checked
-through whatever translation unit happens to include it. A header that forgets
-an `#include` is not caught as long as every `.cpp` that uses it includes its
-missing dependency first. The `verify_headers` option (ON by default) adds a
-`verify-headers` target that compiles every header on its own, which fails if a
-header is not self-contained:
-
-```bash
-cmake --build . --target verify-headers
-```
-
-The per-header objects are excluded from the `all` target, so a normal build
-never compiles them; they are built only through `verify-headers`. The generated
-translation units do appear in `compile_commands.json`, so clang-tidy (and
-clangd and IDEs) can lint each header on its own. Pass `-Dverify_headers=OFF` to
-omit them entirely.
-
 ## Troubleshooting
 
 ### Conan
@@ -373,14 +583,14 @@ After any updates or changes to dependencies, you may need to do the following:
    conan remove '*'
    ```
 
-3. Re-run [conan export](./docs/build/advanced_conan.md#patched-recipes) if needed.
-4. [Regenerate lockfile](./docs/build/advanced_conan.md#conan-lockfile).
+3. Re-run [conan export](#patched-recipes) if needed.
+4. [Regenerate lockfile](#conan-lockfile).
 5. Re-run [conan install](#build-and-test).
 
 #### ERROR: Package not resolved
 
 If you're seeing an error like `ERROR: Package 'snappy/1.1.10' not resolved: Unable to find 'snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1756234314.246' in remotes.`,
-please [add `xrplf` remote](#add-xrplf-remote) or re-run `conan export` for [patched recipes](./docs/build/advanced_conan.md#patched-recipes).
+please add `xrplf` remote or re-run `conan export` for [patched recipes](#patched-recipes).
 
 ### `protobuf/port_def.inc` file not found
 
@@ -400,9 +610,28 @@ For example, if you want to build Debug:
 1. For conan install, pass `--settings build_type=Debug`
 2. For cmake, pass `-DCMAKE_BUILD_TYPE=Debug`
 
-[cpp23-support]: https://en.cppreference.com/w/cpp/compiler_support/23
-[conan-getting-started]: https://docs.conan.io/en/latest/getting_started.html
-[unity-build]: https://en.wikipedia.org/wiki/Unity_build
+## Add a Dependency
+
+If you want to experiment with a new package, follow these steps:
+
+1. Search for the package on [Conan Center](https://conan.io/center/).
+2. Modify [`conanfile.py`](./conanfile.py):
+   - Add a version of the package to the `requires` property.
+   - Change any default options for the package by adding them to the
+     `default_options` property (with syntax `'$package:$option': $value`).
+3. Modify [`CMakeLists.txt`](./CMakeLists.txt):
+   - Add a call to `find_package($package REQUIRED)`.
+   - Link a library from the package to the target `xrpl_libs`
+     (search for the existing call to `target_link_libraries(xrpl_libs INTERFACE ...)`).
+4. Start coding! Don't forget to include whatever headers you need from the package.
+
+[1]: https://github.com/conan-io/conan-center-index/issues/13168
+[2]: https://en.cppreference.com/w/cpp/compiler_support/20
+[3]: https://docs.conan.io/en/latest/getting_started.html
+[5]: https://en.wikipedia.org/wiki/Unity_build
+[6]: https://github.com/boostorg/beast/issues/2648
+[7]: https://github.com/boostorg/beast/issues/2661
 [gcovr]: https://gcovr.com/en/stable/getting-started.html
 [python-pip]: https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/
 [build_type]: https://cmake.org/cmake/help/latest/variable/CMAKE_BUILD_TYPE.html
+[profile]: https://docs.conan.io/en/latest/reference/profiles.html

CMakeLists.txt

@@ -57,8 +57,6 @@ if(target)
     )
 endif()
 
-include(PatchNixBinary)
-
 include(XrplSanity)
 include(XrplVersion)
 include(XrplSettings)
@@ -90,7 +88,6 @@ find_package(ed25519 REQUIRED)
 find_package(gRPC REQUIRED)
 find_package(LibArchive REQUIRED)
 find_package(lz4 REQUIRED)
-find_package(mpt-crypto REQUIRED)
 find_package(nudb REQUIRED)
 find_package(OpenSSL REQUIRED)
 find_package(secp256k1 REQUIRED)
@@ -103,7 +100,6 @@ target_link_libraries(
     INTERFACE
         ed25519::ed25519
         lz4::lz4
-        mpt-crypto::mpt-crypto
         OpenSSL::Crypto
         OpenSSL::SSL
         secp256k1::secp256k1

CONTRIBUTING.md

@@ -14,9 +14,9 @@ The following branches exist in the main project repository:
 
 - `develop`: The latest set of unreleased features, and the most common
   starting point for contributions.
-- `release/*` (e.g. `release/3.2.x`): Release branches, one per release line,
-  holding the latest release candidate, or stable release for that line.
-  Stable releases are published as [tagged releases](https://github.com/XRPLF/rippled/releases).
+- `release`: The latest beta release or release candidate.
+- `master`: The latest stable release.
+- `gh-pages`: The documentation for this project, built by Doxygen.
 
 The tip of each branch must be signed. In order for GitHub to sign a
 squashed commit that it builds from your pull request, GitHub must know
@@ -130,9 +130,11 @@ tl;dr
 ## Pull requests
 
 In general, pull requests use `develop` as the base branch.
+The exceptions are
 
-The exceptions are fixes, improvements, and hotfixes for an existing release,
-which use that release's branch (e.g. `release/3.2.x`) as the base.
+- Fixes and improvements to a release candidate use `release` as the
+  base.
+- Hotfixes use `master` as the base.
 
 If your changes are not quite ready, but you want to make it easily available
 for preliminary examination or review, you can create a "Draft" pull request.
@@ -214,7 +216,7 @@ coherent rather than a set of _thou shalt not_ commandments.
 
 ## Formatting
 
-All code must conform to `clang-format` version 22,
+All code must conform to `clang-format` version 21,
 according to the settings in [`.clang-format`](./.clang-format),
 unless the result would be unreasonably difficult to read or maintain.
 To demarcate lines that should be left as-is, surround them with comments like
@@ -259,7 +261,7 @@ This ensures that configuration changes don't introduce new warnings across the
 
 ### Installing clang-tidy
 
-See the [environment setup guide](./docs/build/environment.md#clang-tidy) for how to get clang-tidy.
+See the [environment setup guide](./docs/build/environment.md#clang-tidy) for platform-specific installation instructions.
 
 ### Running clang-tidy locally
 

bin/check-tools.sh

@@ -1,161 +0,0 @@
-#!/usr/bin/env bash
-#
-# check-tools.sh — verify the xrpld development tooling is present and runnable.
-#
-# Works on Linux, macOS, and Windows (Git Bash / MSYS). For every expected tool
-# it runs a version probe, collecting anything that is missing or fails to run,
-# and prints a summary at the end (exiting non-zero if anything is missing).
-#
-# The tool set is platform-aware:
-#   - Linux:   the full Nix CI environment (see nix/packages.nix, nix/ci-env.nix),
-#              with GCC, Clang and the sanitizer/coverage tooling. This script is
-#              run during the Nix Docker image build (nix/docker/Dockerfile), so
-#              the Linux list is kept in sync with that environment.
-#   - macOS:   the same tooling, minus GCC/g++/gcov/mold
-#   - Windows: the core build tools only (CMake, Conan, Git, Python).
-#              MSVC is expected to be provided separately and is not checked here.
-#
-# Some tools (clang-format, doxygen, gcovr, gh, git-cliff, gpg, pre-commit,
-# run-clang-tidy) are present in our Linux CI images and in local development
-# setups, but not in the macOS CI environment. They are checked everywhere
-# except when running in CI on macOS.
-#
-# Environment variables:
-#   CI                      if set, skip the tools above when on macOS.
-#   CHECK_TOOLS_SKIP_CLONE  if set, skip the git-over-HTTPS connectivity check.
-
-set -uo pipefail
-
-missing=()
-checked=0
-
-# check <name> [probe-command...]
-# Runs the probe (default: "<name> --version") quietly. Records <name> as
-# missing if the command is not found or exits non-zero.
-check() {
-    local name="$1"
-    shift
-    local -a probe=("$@")
-    if [ "${#probe[@]}" -eq 0 ]; then
-        probe=("${name}" --version)
-    fi
-
-    echo "Checking ${name}..."
-    checked=$((checked + 1))
-    if "${probe[@]}" | head -n 1; then
-        printf '  [ ok ] %s\n' "${name}"
-    else
-        printf '  [MISS] %s\n' "${name}"
-        missing+=("${name}")
-    fi
-}
-
-case "$(uname -s)" in
-    Linux*) os=linux ;;
-    Darwin*) os=macos ;;
-    MINGW* | MSYS* | CYGWIN*) os=windows ;;
-    *)
-        echo "Unknown OS: $(uname -s)" >&2
-        exit 1
-        ;;
-esac
-
-echo "Detected OS: ${os} ($(uname -s) $(uname -m))"
-echo
-echo "Core build tools:"
-check cmake
-check conan
-check git
-if [ "${os}" = "windows" ]; then
-    check python python --version
-else
-    check python3
-fi
-
-# The full development toolchain. Available from Nix on Linux and macOS; on
-# Windows these are typically not installed, so they are skipped.
-if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
-    echo
-    echo "Development tooling:"
-    check ccache
-    check clang
-    check clang++
-    check ClangBuildAnalyzer
-    check curl
-    check file
-    check less
-    check make
-    check netstat which netstat
-    check ninja
-    check perl
-    check pkg-config
-    check vim
-    check zip
-
-    # These tools are present in our Linux CI images and in local development
-    # setups, but not in the macOS CI environment. So check them everywhere
-    # except when running in CI on macOS.
-    if [ "${os}" = "linux" ] || [ -z "${CI:-}" ]; then
-        check clang-format
-        check dot
-        check doxygen
-        check gcovr
-        check gh
-        check git-cliff
-        check git-lfs
-        check gpg
-        # pre-commit, or its alternative implementation prek
-        check pre-commit sh -c 'pre-commit --version || prek --version'
-        check run-clang-tidy run-clang-tidy --help
-    fi
-fi
-
-# GCC is the default compiler on Linux. macOS uses the system Apple Clang
-# instead, so GCC/g++/gcov are not expected there.
-if [ "${os}" = "linux" ]; then
-    echo
-    echo "GCC toolchain:"
-    check gcc
-    check g++
-    check gcov
-
-    echo
-    echo "Mold:"
-    check mold
-fi
-
-if [ "${os}" = "windows" ]; then
-    echo
-    echo "Note: on Windows the C++ compiler is MSVC, which is provided"
-    echo "      separately (e.g. via Visual Studio) and is not checked here."
-fi
-
-# A simple test to verify that git can clone a repository over HTTPS
-# (i.e. the CA bundle is wired up). Clone to a temp dir and clean up.
-if [ -n "${CHECK_TOOLS_SKIP_CLONE:-}" ]; then
-    echo
-    echo "Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set)."
-else
-    echo
-    echo "Connectivity check:"
-    checked=$((checked + 1))
-    tmp_clone="$(mktemp -d)"
-    if git clone --depth 1 https://github.com/XRPLF/actions.git "${tmp_clone}/actions" >/dev/null 2>&1; then
-        printf '  [ ok ] git clone over HTTPS\n'
-    else
-        printf '  [MISS] git clone over HTTPS\n'
-        missing+=("git-https-clone")
-    fi
-    rm -rf "${tmp_clone}"
-fi
-
-echo
-if [ "${#missing[@]}" -eq 0 ]; then
-    echo "All ${checked} checked tools are present and runnable."
-else
-    echo "Missing or non-functional tools (${#missing[@]} of ${checked}):" >&2
-    for tool in "${missing[@]}"; do
-        echo "  - ${tool}" >&2
-    done
-    exit 1
-fi

bin/filter-clang-tidy.py

@@ -1,102 +0,0 @@
-#!/usr/bin/env python3
-
-"""
-Reduce run-clang-tidy output to its unique errors.
-
-It does two things:
-
-  1. Filters the raw output down to diagnostics and their source-context lines
-     (the indented "  103 | ..." / "      | ^" lines clang-tidy prints),
-     matching the "path:line:col: error:" diagnostic shape.
-
-  2. Deduplicates. The same diagnostic in a header is reported once per
-     translation unit that includes it, so identical error blocks are collapsed
-     to their first occurrence.
-
-An "error block" is an "error:" line together with the indented context lines
-and any "note:" lines that follow it (up to the next "error:" line). Blocks are
-compared as a whole, so an error stays attached to its own context, and
-first-occurrence order is preserved.
-
-The deduplicated output goes to stdout; a summary of unique error counts per
-check is printed to stderr.
-
-Usage:
-  bin/filter-clang-tidy.py [INPUT_FILE]            # read from file, or
-  run-clang-tidy ... | bin/filter-clang-tidy.py    # read from stdin
-"""
-
-import re
-import sys
-from collections import Counter
-
-# A clang-tidy diagnostic line looks like "path:line:col: error: msg [check]".
-# Matching on that shape (rather than a loose "error" substring) avoids treating
-# progress lines whose paths contain "error" as diagnostics, e.g.
-#   [284/850][0.7s] /nix/.../clang-tidy ... src/.../error.cpp
-DIAG_RE = re.compile(r":\d+:\d+: (?:error|warning|note):")
-ERROR_RE = re.compile(r":\d+:\d+: error:")
-CHECK_RE = re.compile(r" error: .*\[([^\],]+)")
-
-
-def filter_and_dedup(lines: list[str]) -> list[str]:
-    """Keep diagnostics with their context, then drop duplicate error blocks."""
-    blocks: list[str] = []
-    seen: set[str] = set()
-    current: list[str] = []
-
-    def flush() -> None:
-        if not current:
-            return
-        block = "".join(current)
-        if block not in seen:
-            seen.add(block)
-            blocks.append(block)
-
-    for line in lines:
-        # Keep only diagnostics and their indented source-context lines; drop
-        # progress/status output and blank lines.
-        if not (DIAG_RE.search(line) or line[:1] in (" ", "\t")):
-            continue
-        # An "error:" line starts a new block; its context and any following
-        # "note:" lines (and their context) belong to it.
-        if ERROR_RE.search(line):
-            flush()
-            current = []
-        current.append(line)
-    flush()
-
-    return blocks
-
-
-def summarize(blocks: list[str]) -> Counter[str]:
-    """Count unique errors per check name (e.g. "bugprone-branch-clone")."""
-    counts: Counter[str] = Counter()
-    for block in blocks:
-        # The error line is the first line of the block.
-        match = CHECK_RE.search(block.splitlines()[0])
-        if match:
-            counts[match.group(1)] += 1
-    return counts
-
-
-def main() -> int:
-    if len(sys.argv) > 1 and sys.argv[1] != "-":
-        with open(sys.argv[1], encoding="utf-8") as f:
-            lines = f.readlines()
-    else:
-        lines = sys.stdin.readlines()
-
-    blocks = filter_and_dedup(lines)
-    # Blank line between blocks so distinct errors are easy to tell apart.
-    sys.stdout.write("\n".join(blocks))
-
-    print("\nUnique errors per check:", file=sys.stderr)
-    for check, count in summarize(blocks).most_common():
-        print(f"{count:>4} {check}", file=sys.stderr)
-
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

bin/pre-commit/clang_tidy_check.py

@@ -1,22 +1,21 @@
 #!/usr/bin/env python3
-"""Pre-commit hook that runs clang-tidy on changed files using run-clang-tidy.
-
-The set of files is chosen by pre-commit (see .pre-commit-config.yaml), which
-filters to C/C++ sources and excludes `.ipp` fragments. Headers are linted
-directly: the `verify_headers` build option (ON by default) compiles every
-`.h`/`.hpp` on its own, so each header is the main file of its own
-compile_commands.json entry and run-clang-tidy can analyse it just like a
-`.cpp`.
-"""
+"""Pre-commit hook that runs clang-tidy on changed files using run-clang-tidy."""
 
 from __future__ import annotations
 
+import json
 import os
+import re
 import shutil
 import subprocess
 import sys
+from collections import defaultdict
 from pathlib import Path
 
+HEADER_EXTENSIONS = {".h", ".hpp", ".ipp"}
+SOURCE_EXTENSIONS = {".cpp"}
+INCLUDE_RE = re.compile(r"^\s*#\s*include\s*[<\"]([^>\"]+)[>\"]")
+
 
 def find_run_clang_tidy() -> str | None:
     for candidate in ("run-clang-tidy-21", "run-clang-tidy"):
@@ -33,11 +32,150 @@ def find_build_dir(repo_root: Path) -> Path | None:
     return None
 
 
+def build_include_graph(build_dir: Path, repo_root: Path) -> tuple[dict, set]:
+    """
+    Scan all files reachable from compile_commands.json and build an inverted include graph.
+
+    Returns:
+        inverted: header_path -> set of files that include it
+        source_files: set of all TU paths from compile_commands.json
+    """
+    with open(build_dir / "compile_commands.json") as f:
+        db = json.load(f)
+
+    source_files = {Path(e["file"]).resolve() for e in db}
+    include_roots = [repo_root / "include", repo_root / "src"]
+    inverted: dict[Path, set[Path]] = defaultdict(set)
+
+    to_scan: set[Path] = set(source_files)
+    scanned: set[Path] = set()
+
+    while to_scan:
+        file = to_scan.pop()
+        if file in scanned or not file.exists():
+            continue
+        scanned.add(file)
+
+        content = file.read_text()
+
+        for line in content.splitlines():
+            m = INCLUDE_RE.match(line)
+            if not m:
+                continue
+            for root in include_roots:
+                candidate = (root / m.group(1)).resolve()
+                if candidate.exists():
+                    inverted[candidate].add(file)
+                    if candidate not in scanned:
+                        to_scan.add(candidate)
+                    break
+
+    return inverted, source_files
+
+
+def find_tus_for_headers(
+    headers: list[Path],
+    inverted: dict[Path, set[Path]],
+    source_files: set[Path],
+) -> set[Path]:
+    """
+    For each header, pick one TU that transitively includes it.
+    Prefers a TU whose stem matches the header's stem, otherwise picks the first found.
+    """
+    result: set[Path] = set()
+
+    for header in headers:
+        preferred: Path | None = None
+        visited: set[Path] = {header}
+        stack: list[Path] = [header]
+
+        while stack:
+            h = stack.pop()
+            for inc in inverted.get(h, ()):
+                if inc in source_files:
+                    if inc.stem == header.stem:
+                        preferred = inc
+                        break
+                    if preferred is None:
+                        preferred = inc
+                if inc not in visited:
+                    visited.add(inc)
+                    stack.append(inc)
+            if preferred is not None and preferred.stem == header.stem:
+                break
+
+        if preferred is not None:
+            result.add(preferred)
+
+    return result
+
+
+def resolve_files(
+    input_files: list[str], build_dir: Path, repo_root: Path
+) -> list[str]:
+    """
+    Split input into source files and headers. Source files are passed through;
+    headers are resolved to the TUs that transitively include them.
+    """
+    sources: list[Path] = []
+    headers: list[Path] = []
+
+    for f in input_files:
+        p = Path(f).resolve()
+        if p.suffix in SOURCE_EXTENSIONS:
+            sources.append(p)
+        elif p.suffix in HEADER_EXTENSIONS:
+            headers.append(p)
+
+    if not headers:
+        return [str(p) for p in sources]
+
+    print(
+        f"Resolving {len(headers)} header(s) to compilation units...", file=sys.stderr
+    )
+    inverted, source_files = build_include_graph(build_dir, repo_root)
+    tus = find_tus_for_headers(headers, inverted, source_files)
+
+    if not tus:
+        print(
+            "Warning: no compilation units found that include the modified headers; "
+            "skipping clang-tidy for headers.",
+            file=sys.stderr,
+        )
+
+    return sorted({str(p) for p in (*sources, *tus)})
+
+
+def staged_files(repo_root: Path) -> list[str]:
+    result = subprocess.run(
+        ["git", "diff", "--staged", "--name-only", "--diff-filter=d"],
+        capture_output=True,
+        text=True,
+        cwd=repo_root,
+    )
+    if result.returncode != 0:
+        print(
+            "clang-tidy check failed: 'git diff --staged' command failed.",
+            file=sys.stderr,
+        )
+        if result.stderr:
+            print(result.stderr, file=sys.stderr)
+        sys.exit(result.returncode or 1)
+    return [str(repo_root / p) for p in result.stdout.splitlines() if p]
+
+
 def main():
     if not os.environ.get("TIDY"):
         return 0
 
-    files = sys.argv[1:]
+    repo_root = Path(
+        subprocess.check_output(
+            ["git", "rev-parse", "--show-toplevel"],
+            cwd=Path(__file__).parent,
+            text=True,
+        ).strip()
+    )
+    files = staged_files(repo_root)
     if not files:
         return 0
 
@@ -50,13 +188,6 @@ def main():
         )
         return 1
 
-    repo_root = Path(
-        subprocess.check_output(
-            ["git", "rev-parse", "--show-toplevel"],
-            cwd=Path(__file__).parent,
-            text=True,
-        ).strip()
-    )
     build_dir = find_build_dir(repo_root)
     if not build_dir:
         print(
@@ -66,9 +197,13 @@ def main():
         )
         return 1
 
+    tidy_files = resolve_files(files, build_dir, repo_root)
+    if not tidy_files:
+        return 0
+
     result = subprocess.run(
         [run_clang_tidy, "-quiet", "-p", str(build_dir), "-fix", "-allow-no-checks"]
-        + files
+        + tidy_files
     )
     return result.returncode
 

bin/pre-commit/fix_pragma_once.py

@@ -1,34 +0,0 @@
-#!/usr/bin/env python3
-
-"""
-Adds "#pragma once" to the top of header files that don't already have it.
-
-Usage: ./bin/pre-commit/fix_pragma_once.py <file1> <file2> ...
-"""
-
-import sys
-from pathlib import Path
-
-PRAGMA_ONCE = "#pragma once\n\n"
-
-
-def fix_pragma_once(path: Path) -> bool:
-    original = path.read_text(encoding="utf-8")
-    if PRAGMA_ONCE not in original:
-        path.write_text(PRAGMA_ONCE + original, encoding="utf-8")
-        return False
-    return True
-
-
-def main() -> int:
-    files = [Path(f) for f in sys.argv[1:]]
-    success = True
-
-    for path in files:
-        success &= fix_pragma_once(path)
-
-    return 0 if success else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

cmake/CompilationEnv.cmake

@@ -56,16 +56,3 @@ elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "aarch64|arm64|ARM64")
 else()
     message(FATAL_ERROR "Unknown architecture: ${CMAKE_SYSTEM_PROCESSOR}")
 endif()
-
-# --------------------------------------------------------------------
-# Sanitizers
-# --------------------------------------------------------------------
-# SANITIZERS is injected by the Conan toolchain when a sanitizer build is
-# requested (see conan/profiles/sanitizers). The flags are applied to the
-# 'common' target in XrplSanitizers; this flag lets other modules know a
-# sanitizer build is active without depending on that module.
-if(DEFINED SANITIZERS)
-    set(SANITIZERS_ENABLED TRUE)
-else()
-    set(SANITIZERS_ENABLED FALSE)
-endif()

cmake/PatchNixBinary.cmake

@@ -1,53 +0,0 @@
-#[===================================================================[
-   Patch executables to run in non-Nix environments.
-
-   The Nix-based CI image links binaries against an ELF interpreter (loader)
-   that lives in the Nix store, so the resulting binaries don't run elsewhere
-   (including once installed from the .deb package). `patch_nix_binary` adds a
-   POST_BUILD step that resets the interpreter to the system default loader and
-   drops the rpath.
-
-   This is only active inside the Nix-based image, detected by the presence of
-   /tmp/loader-path.sh (shipped by that image, resolves the default loader). It
-   is skipped for sanitizer builds, whose runtime libraries are resolved through
-   the rpath. Everywhere else `patch_nix_binary` is a no-op.
-#]===================================================================]
-
-include_guard(GLOBAL)
-
-include(CompilationEnv)
-
-# Provided by the Nix-based CI image; prints the system default ELF loader path.
-set(_loader_path_script "/tmp/loader-path.sh")
-
-if(is_linux AND NOT SANITIZERS_ENABLED AND EXISTS "${_loader_path_script}")
-    execute_process(
-        COMMAND "${_loader_path_script}"
-        OUTPUT_VARIABLE DEFAULT_LOADER_PATH
-        OUTPUT_STRIP_TRAILING_WHITESPACE
-        COMMAND_ERROR_IS_FATAL ANY
-    )
-    find_program(PATCHELF_COMMAND patchelf REQUIRED)
-    set(PATCH_NIX_BINARIES TRUE)
-    message(
-        STATUS
-        "Binaries will be patched to use loader '${DEFAULT_LOADER_PATH}'"
-    )
-else()
-    set(PATCH_NIX_BINARIES FALSE)
-endif()
-
-function(patch_nix_binary target)
-    if(NOT PATCH_NIX_BINARIES)
-        return()
-    endif()
-    add_custom_command(
-        TARGET ${target}
-        POST_BUILD
-        COMMAND
-            "${PATCHELF_COMMAND}" --set-interpreter "${DEFAULT_LOADER_PATH}"
-            --remove-rpath "$<TARGET_FILE:${target}>"
-        COMMENT "Patching ${target}: set default loader, remove rpath"
-        VERBATIM
-    )
-endfunction()

cmake/XrplCompiler.cmake

@@ -154,15 +154,6 @@ else()
             >
     )
 
-    # On aarch64, libatomic is required for atomic operations. It is not needed on x86_64.
-    # Linking it statically on Linux
-    if(is_arm64 AND is_linux)
-        target_link_options(
-            common
-            INTERFACE -Wl,--push-state -Wl,-Bstatic -latomic -Wl,--pop-state
-        )
-    endif()
-
     # Keep -stdlib=libstdc++ off the compile commands, but preserve it for linking.
     #
     # Conan turns `compiler.libcxx=libstdc++` into `-stdlib=libstdc++` and puts it in

cmake/XrplCore.cmake

@@ -247,7 +247,6 @@ target_link_modules(
 
 if(xrpld)
     add_executable(xrpld)
-    patch_nix_binary(xrpld)
     if(tests)
         target_compile_definitions(xrpld PUBLIC ENABLE_TESTS)
         target_compile_definitions(
@@ -293,13 +292,4 @@ if(xrpld)
             PRIVATE ${CMAKE_SOURCE_DIR}/external/antithesis-sdk
         )
     endif()
-
-    # The xrpld headers are not built with add_module, so verify them against
-    # the executable's own compile environment.
-    if(verify_headers)
-        verify_target_headers(xrpld "${CMAKE_CURRENT_SOURCE_DIR}/src/xrpld")
-        if(tests)
-            verify_target_headers(xrpld "${CMAKE_CURRENT_SOURCE_DIR}/src/test")
-        endif()
-    endif()
 endif()

cmake/XrplPackaging.cmake

@@ -28,6 +28,7 @@ endif()
 set(package_env
     SRC_DIR=${CMAKE_SOURCE_DIR}
     BUILD_DIR=${CMAKE_BINARY_DIR}
+    PKG_VERSION=${xrpld_version}
     PKG_RELEASE=${pkg_release}
 )
 

cmake/XrplSanitizers.cmake

@@ -14,9 +14,11 @@
 include_guard(GLOBAL)
 include(CompilationEnv)
 
-if(NOT SANITIZERS_ENABLED)
+if(NOT DEFINED SANITIZERS)
+    set(SANITIZERS_ENABLED FALSE)
     return()
 endif()
+set(SANITIZERS_ENABLED TRUE)
 
 message(STATUS "=== Configuring Sanitizers ===")
 message(STATUS "  SANITIZERS: ${SANITIZERS}")

cmake/XrplSettings.cmake

@@ -30,23 +30,6 @@ if(tests)
     endif()
 endif()
 
-# Enabled by default so every header is compiled on its own as the main file of
-# its own compile_commands.json entry - this is what lets clang-tidy (and clangd
-# and IDEs) analyse a header's own includes directly. The per-header objects are
-# EXCLUDE_FROM_ALL (see cmake/verify_headers.cmake) and the aggregate target
-# below is not part of `all`, so a normal `cmake --build` never compiles them.
-option(
-    verify_headers
-    "Compile every header on its own to verify it is self-contained."
-    ON
-)
-if(verify_headers)
-    # Aggregate target that builds every per-module header-verification library
-    # created by add_module (see cmake/verify_headers.cmake). Build it with:
-    #   cmake --build . --target verify-headers
-    add_custom_target(verify-headers)
-endif()
-
 option(unity "Creates a build using UNITY support in cmake." OFF)
 if(unity)
     if(NOT is_ci)

cmake/add_module.cmake

@@ -1,5 +1,4 @@
 include(isolate_headers)
-include(verify_headers)
 
 # Create an OBJECT library target named
 #
@@ -38,20 +37,4 @@ function(add_module parent name)
         "${CMAKE_CURRENT_SOURCE_DIR}/src/lib${parent}/${name}"
         PRIVATE
     )
-    # protocol_autogen contains generated headers that are deliberately exempt
-    # from clang-tidy (see ExcludeHeaderFilterRegex in .clang-tidy), so we do not
-    # verify them either.
-    if(
-        verify_headers
-        AND NOT "${parent}/${name}" STREQUAL "xrpl/protocol_autogen"
-    )
-        verify_target_headers(
-            ${target}
-            "${CMAKE_CURRENT_SOURCE_DIR}/include/${parent}/${name}"
-        )
-        verify_target_headers(
-            ${target}
-            "${CMAKE_CURRENT_SOURCE_DIR}/src/lib${parent}/${name}"
-        )
-    endif()
 endfunction()

cmake/verify_headers.cmake

@@ -1,84 +0,0 @@
-# Our normal build only ever compiles `.cpp` files, so a header is only ever
-# checked through whatever translation unit happens to include it. A header that
-# is missing an `#include` is never caught as long as every `.cpp` that uses it
-# includes its missing dependency first. To check a header on its own we compile
-# it directly as a translation unit.
-#
-# Compiling the header itself - rather than a `.cpp` wrapper that includes it -
-# gives two checks at once:
-#   * the compiler fails if the header is not self-contained, i.e. it uses a
-#     declaration that is not available (directly or transitively); and
-#   * the header is the *main file* of its `compile_commands.json` entry, so
-#     clang-tidy's misc-include-cleaner analyses (and can --fix) the header's own
-#     includes - flagging a dependency that is only available transitively, which
-#     a plain compile cannot catch. A wrapper would be the main file instead, and
-#     include-cleaner never looks inside the headers a main file includes.
-#
-# The objects are never linked anywhere; we build them only for these checks.
-
-# Verify that the headers under headers_dir compile on their own, using the
-# compile environment of an existing target so each header is compiled exactly as
-# that target compiles it. This works for both add_module libraries and the xrpld
-# and test binaries: a library's isolated public and private include directories
-# and a binary's `-I src` both live in its INCLUDE_DIRECTORIES, and the modules or
-# libraries it links live in its LINK_LIBRARIES. We copy those usage requirements
-# through generator expressions (rather than linking ${target}, which is
-# impossible for an executable), evaluated at generation time so they capture
-# requirements the caller adds after this runs. The verify library is created
-# once; call this repeatedly to add more header directories.
-#
-# verify_target_headers(target headers_dir)
-function(verify_target_headers target headers_dir)
-    set(verify ${target}.verify)
-    if(NOT TARGET ${verify})
-        add_library(${verify} OBJECT EXCLUDE_FROM_ALL)
-        # A unity build would concatenate the headers into a single translation
-        # unit, where a header missing an include could be satisfied by one that
-        # precedes it in the blob - exactly the bug we want to catch.
-        set_target_properties(${verify} PROPERTIES UNITY_BUILD OFF)
-        target_include_directories(
-            ${verify}
-            PRIVATE $<TARGET_PROPERTY:${target},INCLUDE_DIRECTORIES>
-        )
-        target_compile_definitions(
-            ${verify}
-            PRIVATE $<TARGET_PROPERTY:${target},COMPILE_DEFINITIONS>
-        )
-        target_compile_options(
-            ${verify}
-            PRIVATE $<TARGET_PROPERTY:${target},COMPILE_OPTIONS>
-        )
-        target_link_libraries(
-            ${verify}
-            PRIVATE $<TARGET_PROPERTY:${target},LINK_LIBRARIES>
-        )
-        add_dependencies(verify-headers ${verify})
-    endif()
-    _verify_add_headers(${verify} "${headers_dir}")
-endfunction()
-
-# Add every .h/.hpp under dir to target as a directly-compiled C++ translation
-# unit. .ipp files are inline-implementation fragments included by their owning
-# header (often after a class declaration), so they are not self-contained on
-# their own and are verified transitively when that header is verified.
-function(_verify_add_headers target dir)
-    file(GLOB_RECURSE headers CONFIGURE_DEPENDS "${dir}/*.h" "${dir}/*.hpp")
-    if(NOT headers)
-        return()
-    endif()
-    # `-xc++` forces the header to be compiled as a C++ translation unit; a lone
-    # `.h` is otherwise treated as a header to precompile. `#pragma once` is
-    # harmless (and warns) when the header is the main file, so silence it.
-    # Compiled on its own, a header legitimately defines constants and static or
-    # template functions that nothing in this single translation unit uses (they
-    # exist for the files that include it), so the resulting unused-entity
-    # warnings are expected and must not fail the build under -Werror.
-    set_source_files_properties(
-        ${headers}
-        PROPERTIES
-            LANGUAGE CXX
-            COMPILE_OPTIONS
-                "-xc++;-Wno-pragma-once-outside-header;-Wno-unused-const-variable;-Wno-unused-function"
-    )
-    target_sources(${target} PRIVATE ${headers})
-endfunction()

conan.lock

@@ -1,44 +1,43 @@
 {
     "version": "0.5",
     "requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
-        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1782392402.420688",
-        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1782392403.185447",
-        "soci/4.0.3#e726491a03468795453f7c83fc924a96%1782392402.679521",
-        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1782307151.633168",
-        "secp256k1/0.7.1#b1f450b7f78a36fff75bb6934a356f3a%1782338841.3729",
-        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1782392413.075713",
-        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1782392402.431897",
-        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "openssl/3.6.3#1163d4ddc603907084d08a6a0c6e580f%1782307150.583886",
-        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1782392402.297166",
-        "mpt-crypto/0.4.0-rc2#a580f2f9ad0e795de696aa62d54fb9af%1782425834.488828",
-        "lz4/1.10.0#982d9b673900f665a1da109e09c17cab%1782392402.164188",
-        "libiconv/1.17#9923bc6dc6f106646d6967e0039a5ada%1782392792.775744",
-        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1782392402.420732",
-        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1782392403.066892",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1777558780.503",
+        "xxhash/0.8.3#681d36a0a6111fc56e5e45ea182c19cc%1765850149.987",
+        "sqlite3/3.53.0#324ada52333108388a9a6108bfa96734%1776096494.149",
+        "soci/4.0.3#fe32b9ad5eb47e79ab9e45a68f363945%1774450067.231",
+        "snappy/1.1.10#968fef506ff261592ec30c574d4a7809%1765850147.878",
+        "secp256k1/0.7.1#481881709eb0bdd0185a12b912bbe8ad%1770910500.329",
+        "rocksdb/10.5.1#4a197eca381a3e5ae8adf8cffa5aacd0%1765850186.86",
+        "re2/20251105#8579cfd0bda4daf0683f9e3898f964b4%1774398111.888",
+        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
+        "openssl/3.6.2#4789bbf131b77d0515d15e094c8f697f%1778071755.506",
+        "nudb/2.0.9#11149c73f8f2baff9a0198fe25971fc7%1775040983.408",
+        "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504%1765850143.914",
+        "libiconv/1.17#1e65319e945f2d31941a9d28cc13c058%1765842973.492",
+        "libbacktrace/cci.20210118#a7691bfccd8caaf66309df196790a5a1%1765842973.03",
+        "libarchive/3.8.7#c446109bd1f1d8ba7936c94189bc50e6%1776147552.838",
         "jemalloc/5.3.1#1fc58d55316041f10fbc1e8a2eae632a%1776700028.228",
-        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1782392402.791979",
-        "grpc/1.81.1#5217e6ef0544c42b46f4af35d5e7f649%1782307148.845616",
-        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1782307148.15562",
-        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1782392402.538492",
-        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1782392402.681654",
-        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1782392402.296732",
-        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1782392419.475605",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "gtest/1.17.0#5224b3b3ff3b4ce1133cbdd27d53ee7d%1768312129.152",
+        "grpc/1.78.1#b1a9e74b145cc471bed4dc64dc6eb2c1%1774467387.342",
+        "ed25519/2015.03#ae761bdc52730a843f0809bdf6c1b1f6%1765850143.772",
+        "date/3.0.4#862e11e80030356b53c2c38599ceb32b%1765850143.772",
+        "c-ares/1.34.6#545240bb1c40e2cacd4362d6b8967650%1774439234.681",
+        "bzip2/1.0.8#c470882369c2d95c5c77e970c0c7e321%1765850143.837",
+        "boost/1.91.0#ea540ca2133d831b560036aa24dece3c%1778050991.9",
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
     ],
     "build_requires": [
-        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1782392402.122708",
-        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1782395692.540639",
-        "protobuf/6.33.5#ff253ead763bd8d9904a52979cd21e81%1782392410.233933",
-        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1782395690.33162",
+        "zlib/1.3.2#1cb806da49011867778ffb6ac7190fcb%1777558780.503",
+        "strawberryperl/5.32.1.1#8d114504d172cfea8ea1662d09b6333e%1774447376.964",
+        "protobuf/6.33.5#d96d52ba5baaaa532f47bda866ad87a5%1774467363.12",
+        "nasm/2.16.01#31e26f2ee3c4346ecd347911bd126904%1765850144.707",
         "msys2/cci.latest#d22fe7b2808f5fd34d0a7923ace9c54f%1770657326.649",
-        "m4/1.4.19#34c4bbc3eeebe98ca6edf2f52d602e7d%1777282960.259",
-        "cmake/4.3.3#840cf00ea09777e05c2050a50a82c722%1782392418.696091",
-        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1782392402.624226",
+        "m4/1.4.19#4523e4347b55cd26ae918bd5770cab9a%1778062762.471",
+        "cmake/4.3.0#b939a42e98f593fb34d3a8c5cc860359%1774439249.183",
+        "b2/5.4.2#ffd6084a119587e70f11cd45d1a386e2%1774439233.447",
         "automake/1.16.5#b91b7c384c3deaa9d535be02da14d04f%1755524470.56",
         "autoconf/2.71#51077f068e61700d65bb05541ea1e4b0%1731054366.86",
-        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1782307147.395833"
+        "abseil/20250127.0#bb0baf1f362bc4a725a24eddd419b8f7%1774365460.196"
     ],
     "python_requires": [],
     "overrides": {
@@ -58,7 +57,7 @@
             "boost/1.91.0"
         ],
         "lz4/[>=1.9.4 <2]": [
-            "lz4/1.10.0#982d9b673900f665a1da109e09c17cab"
+            "lz4/1.10.0#59fc63cac7f10fbe8e05c7e62c2f3504"
         ]
     },
     "config_requires": []

conan/lockfile/regenerate.sh

@@ -14,7 +14,7 @@ export CONAN_HOME="$TEMP_DIR"
 # Ensure that the xrplf remote is the first to be consulted, so any recipes we
 # patched are used. We also add it there to not created huge diff when the
 # official Conan Center Index is updated.
-conan remote add --force --index 0 xrplf https://conan.xrplf.org/repository/conan/
+conan remote add --force --index 0 xrplf https://conan.ripplex.io
 
 # Delete any existing lockfile.
 rm -f conan.lock

conan/profiles/default

@@ -10,18 +10,16 @@
 os={{ os }}
 arch={{ arch }}
 build_type=Debug
-compiler={{ compiler }}
+compiler={{compiler}}
 compiler.version={{ compiler_version }}
 compiler.cppstd=23
 {% if os == "Windows" %}
 compiler.runtime=static
 {% else %}
-compiler.libcxx={{ detect_api.detect_libcxx(compiler, version, compiler_exe) }}
+compiler.libcxx={{detect_api.detect_libcxx(compiler, version, compiler_exe)}}
 {% endif %}
 
 [conf]
-{# By default, Conan tries to reuse binaries built with different cppstd versions. #}
-{# We want to avoid that to improve reproduceability, so we add the cppstd version to the package ID. #}
-{# More info: https://docs.conan.io/2/reference/extensions/binary_compatibility.html #}
-user.package:cppstd_version=23
-tools.info.package_id:confs+=["user.package:cppstd_version"]
+{% if compiler == "gcc" and compiler_version < 13 %}
+tools.build:cxxflags+=['-Wno-restrict']
+{% endif %}

conan/profiles/sanitizers

@@ -87,15 +87,15 @@ include(default)
 {% endif %}
 
 [conf]
-tools.build:defines+={{ defines }}
-tools.build:cxxflags+={{ sanitizer_compiler_flags }}
-tools.build:sharedlinkflags+={{ sanitizer_linker_flags }}
-tools.build:exelinkflags+={{ sanitizer_linker_flags }}
+tools.build:defines+={{defines}}
+tools.build:cxxflags+={{sanitizer_compiler_flags}}
+tools.build:sharedlinkflags+={{sanitizer_linker_flags}}
+tools.build:exelinkflags+={{sanitizer_linker_flags}}
 
 tools.info.package_id:confs+=["tools.build:cxxflags", "tools.build:exelinkflags", "tools.build:sharedlinkflags", "tools.build:defines"]
 
 # &: means "apply only to the consumer/root package"
-&:tools.cmake.cmaketoolchain:extra_variables={"SANITIZERS": "{{ sanitizers }}", "SANITIZERS_COMPILER_FLAGS": "{{ sanitizer_compiler_flags | join(' ') }}", "SANITIZERS_LINKER_FLAGS": "{{ sanitizer_linker_flags | join(' ') }}"}
+&:tools.cmake.cmaketoolchain:extra_variables={"SANITIZERS": "{{sanitizers}}", "SANITIZERS_COMPILER_FLAGS": "{{sanitizer_compiler_flags | join(' ')}}", "SANITIZERS_LINKER_FLAGS": "{{sanitizer_linker_flags | join(' ')}}"}
 
 [options]
 {% if enable_asan %}

conanfile.py

@@ -28,10 +28,11 @@ class Xrpl(ConanFile):
 
     requires = [
         "ed25519/2015.03",
-        "grpc/1.81.1",
+        "grpc/1.78.1",
         "libarchive/3.8.7",
         "nudb/2.0.9",
-        "openssl/3.6.3",
+        "openssl/3.6.2",
+        "secp256k1/0.7.1",
         "soci/4.0.3",
         "zlib/1.3.2",
     ]
@@ -131,15 +132,13 @@ class Xrpl(ConanFile):
     def requirements(self):
         self.requires("boost/1.91.0", force=True, transitive_headers=True)
         self.requires("date/3.0.4", transitive_headers=True)
+        self.requires("lz4/1.10.0", force=True)
+        self.requires("protobuf/6.33.5", force=True)
+        self.requires("sqlite3/3.53.0", force=True)
         if self.options.jemalloc:
             self.requires("jemalloc/5.3.1")
-        self.requires("lz4/1.10.0", force=True)
-        self.requires("mpt-crypto/0.4.0-rc2", transitive_headers=True)
-        self.requires("protobuf/6.33.5", force=True)
         if self.options.rocksdb:
             self.requires("rocksdb/10.5.1")
-        self.requires("secp256k1/0.7.1", transitive_headers=True)
-        self.requires("sqlite3/3.53.0", force=True)
         self.requires("xxhash/0.8.3", transitive_headers=True)
 
     exports_sources = (
@@ -209,7 +208,6 @@ class Xrpl(ConanFile):
             "grpc::grpc++",
             "libarchive::libarchive",
             "lz4::lz4",
-            "mpt-crypto::mpt-crypto",
             "nudb::nudb",
             "openssl::crypto",
             "protobuf::libprotobuf",

cspell.config.yaml

@@ -60,7 +60,6 @@ words:
   - autobridging
   - bimap
   - bindir
-  - blindings
   - bookdir
   - Bougalis
   - Britto
@@ -96,7 +95,6 @@ words:
   - daria
   - dcmake
   - dearmor
-  - decryptor
   - dedented
   - deleteme
   - demultiplexer
@@ -108,11 +106,9 @@ words:
   - distro
   - doxyfile
   - dxrpl
-  - elgamal
   - enabled
   - enablerepo
   - endmacro
-  - envrc
   - exceptioned
   - EXPECT_STREQ
   - Falco
@@ -122,7 +118,6 @@ words:
   - fmtdur
   - fsanitize
   - funclets
-  - Gamal
   - gcov
   - gcovr
   - ghead
@@ -220,7 +215,6 @@ words:
   - partitioner
   - paychan
   - paychans
-  - Pedersen
   - permdex
   - perminute
   - permissioned
@@ -239,15 +233,9 @@ words:
   - pyenv
   - pyparsing
   - qalloc
-  - qbsprofile
   - queuable
   - Raphson
-  - rcflags
   - replayer
-  - rerandomize
-  - rerandomization
-  - rerandomized
-  - rerandomizes
   - rerere
   - retriable
   - RIPD
@@ -264,7 +252,6 @@ words:
   - sahyadri
   - Satoshi
   - scons
-  - Schnorr
   - secp
   - sendq
   - seqit
@@ -295,7 +282,6 @@ words:
   - stvar
   - stvector
   - stxchainattestations
-  - summands
   - superpeer
   - superpeers
   - takergets
@@ -312,7 +298,6 @@ words:
   - txs
   - ubsan
   - UBSAN
-  - ufdio
   - umant
   - unacquired
   - unambiguity

docker/supported.Dockerfile

@@ -1,25 +0,0 @@
-# Runtime image for the perf/test xrpld build with all amendments Supported::Yes.
-# Installs the .deb into ubuntu:jammy (matching rippleci/xrpld): gives
-# /usr/bin/xrpld, /etc/xrpld/xrpld.cfg, and the xrpld user.
-# NOT for production validators.
-ARG BASE_IMAGE=ubuntu:jammy
-FROM ${BASE_IMAGE}
-
-# Build context must contain the supported package as xrpld.deb.
-COPY xrpld.deb /tmp/xrpld.deb
-
-RUN set -eux; \
-    id -u xrpld >/dev/null 2>&1 || \
-        useradd --system --no-create-home --shell /usr/sbin/nologin xrpld; \
-    apt-get update; \
-    apt-get install -y --no-install-recommends ca-certificates jq /tmp/xrpld.deb; \
-    rm -rf /var/lib/apt/lists/* /tmp/xrpld.deb; \
-    mkdir -p /var/log/xrpld /var/lib/xrpld; \
-    chown -R xrpld:xrpld /var/log/xrpld /var/lib/xrpld; \
-    # Symlink for consumers that exec /opt/xrpld/bin/xrpld.
-    mkdir -p /opt/xrpld/bin; \
-    ln -sf /usr/bin/xrpld /opt/xrpld/bin/xrpld
-
-EXPOSE 2459/tcp 5005/tcp 6006/tcp
-USER xrpld
-ENTRYPOINT ["/usr/bin/xrpld"]

docs/0001-negative-unl/README.md

@@ -288,7 +288,7 @@ components with non-trivial changes are colored green.
     validated.
 
 ![Sequence diagram](./negativeUNL_highLevel_sequence.png?raw=true "Negative UNL
-Changes")
+ Changes")
 
 ## Roads Not Taken
 

docs/build/advanced_conan.md

@@ -1,193 +0,0 @@
-# Advanced Conan configuration
-
-This document provides advanced instructions for setting up and configuring Conan for `xrpld` development: custom profiles, the lockfile, patched recipes, and profile tweaks.
-
-## Custom profile
-
-If the default profile does not work for you and you do not yet have a Conan
-profile, you can create one by running:
-
-```bash
-conan profile detect
-```
-
-You may need to make changes to the profile to suit your environment. You can
-refer to the provided `conan/profiles/default` profile for inspiration, and you
-may also need to apply the required [tweaks](#conan-profile-tweaks) to this
-default profile.
-
-## Conan lockfile
-
-To achieve reproducible dependencies, we use a [Conan lockfile](https://docs.conan.io/2/tutorial/versioning/lockfiles.html),
-which has to be updated every time dependencies change.
-
-Please see the [instructions on how to regenerate the lockfile](../../conan/lockfile/README.md).
-
-## Patched recipes
-
-Occasionally, we need patched recipes or recipes not present in Conan Center.
-We maintain a fork of the Conan Center Index
-[here](https://github.com/XRPLF/conan-center-index/) containing the modified and newly added recipes.
-
-To ensure our patched recipes are used, you must add our Conan remote at a
-higher index than the default Conan Center remote, so it is consulted first. You
-can do this by running:
-
-```bash
-conan remote add --index 0 --force xrplf https://conan.xrplf.org/repository/conan/
-```
-
-Alternatively, you can pull our recipes from the repository and export them locally:
-
-```bash
-# Define which recipes to export.
-recipes=('abseil' 'ed25519' 'mpt-crypto' 'openssl' 'secp256k1' 'snappy' 'soci' 'wasm-xrplf' 'wasmi')
-
-# Selectively check out the recipes from our CCI fork.
-cd external
-mkdir -p conan-center-index
-cd conan-center-index
-git init
-git remote add origin git@github.com:XRPLF/conan-center-index.git
-git sparse-checkout init
-for recipe in "${recipes[@]}"; do
-    echo "Checking out recipe '${recipe}'..."
-    git sparse-checkout add recipes/${recipe}
-done
-git fetch origin master
-git checkout master
-
-./export_all.sh
-cd ../../
-```
-
-In the case we switch to a newer version of a dependency that still requires a
-patch or add a new dependency, it will be necessary for you to pull in the changes and re-export the
-updated dependencies with the newer version. However, if we switch to a newer
-version that no longer requires a patch, no action is required on your part, as
-the new recipe will be automatically pulled from the official Conan Center.
-
-> [!NOTE]
-> You might need to add `--lockfile=""` to your `conan install` command
-> to avoid automatic use of the existing `conan.lock` file when you run
-> `conan export` manually on your machine
->
-> This is not recommended though, as you might end up using different revisions of recipes.
-
-## Conan profile tweaks
-
-### Missing compiler version
-
-If you see an error similar to the following after running `conan profile show`:
-
-```text
-ERROR: Invalid setting '17' is not a valid 'settings.compiler.version' value.
-Possible values are ['5.0', '5.1', '6.0', '6.1', '7.0', '7.3', '8.0', '8.1',
-'9.0', '9.1', '10.0', '11.0', '12.0', '13', '13.0', '13.1', '14', '14.0', '15',
-'15.0', '16', '16.0']
-Read "http://docs.conan.io/2/knowledge/faq.html#error-invalid-setting"
-```
-
-you need to create `$(conan config home)/settings_user.yml` file if it doesn't exist and add the required version number(s)
-to the `version` array specific for your compiler. For example:
-
-```yaml
-compiler:
-  apple-clang:
-    version: ["17.0"]
-```
-
-### Multiple compilers
-
-If you have multiple compilers installed, make sure to select the one to use in
-your default Conan configuration **before** running `conan profile detect`, by
-setting the `CC` and `CXX` environment variables.
-
-For example, if you are running MacOS and have [homebrew
-LLVM@18](https://formulae.brew.sh/formula/llvm@18), and want to use it as a
-compiler in the new Conan profile:
-
-```bash
-export CC=$(brew --prefix llvm@18)/bin/clang
-export CXX=$(brew --prefix llvm@18)/bin/clang++
-conan profile detect
-```
-
-You should also explicitly set the path to the compiler in the profile file,
-which helps to avoid errors when `CC` and/or `CXX` are set and disagree with the
-selected Conan profile. For example:
-
-```text
-[conf]
-tools.build:compiler_executables={'c':'/usr/bin/gcc','cpp':'/usr/bin/g++'}
-```
-
-### Multiple profiles
-
-You can manage multiple Conan profiles in the directory
-`$(conan config home)/profiles`, for example renaming `default` to a different
-name and then creating a new `default` profile for a different compiler.
-
-### Select language
-
-The default profile created by Conan will typically select different C++ dialect
-than C++23 used by this project. You should set `23` in the profile line
-starting with `compiler.cppstd=`. For example:
-
-```bash
-sed -i.bak -e 's|^compiler\.cppstd=.*$|compiler.cppstd=23|' $(conan config home)/profiles/default
-```
-
-### Select standard library in Linux
-
-**Linux** developers will commonly have a default Conan [profile][] that
-compiles with GCC and links with libstdc++. If you are linking with libstdc++
-(see profile setting `compiler.libcxx`), then you will need to choose the
-`libstdc++11` ABI:
-
-```bash
-sed -i.bak -e 's|^compiler\.libcxx=.*$|compiler.libcxx=libstdc++11|' $(conan config home)/profiles/default
-```
-
-### Select architecture and runtime in Windows
-
-**Windows** developers may need to use the x64 native build tools. An easy way
-to do that is to run the shortcut "x64 Native Tools Command Prompt" for the
-version of Visual Studio that you have installed.
-
-Windows developers must also build `xrpld` and its dependencies for the x64
-architecture:
-
-```bash
-sed -i.bak -e 's|^arch=.*$|arch=x86_64|' $(conan config home)/profiles/default
-```
-
-**Windows** developers also must select static runtime:
-
-```bash
-sed -i.bak -e 's|^compiler\.runtime=.*$|compiler.runtime=static|' $(conan config home)/profiles/default
-```
-
-## Add a Dependency
-
-If you want to experiment with a new package, follow these steps:
-
-1. Search for the package on [Conan Center](https://conan.io/center/).
-2. Modify [`conanfile.py`](../../conanfile.py):
-   - Add a version of the package to the `requires` property.
-   - Change any default options for the package by adding them to the
-     `default_options` property (with syntax `'$package:$option': $value`).
-3. Regenerate the [Conan lockfile](../../conan/lockfile/README.md) so the new
-   dependency is captured:
-
-   ```bash
-   ./conan/lockfile/regenerate.sh
-   ```
-
-4. Modify [`CMakeLists.txt`](../../CMakeLists.txt):
-   - Add a call to `find_package($package REQUIRED)`.
-   - Link a library from the package to the target `xrpl_libs`
-     (search for the existing call to `target_link_libraries(xrpl_libs INTERFACE ...)`).
-5. Start coding! Don't forget to include whatever headers you need from the package.
-
-[profile]: https://docs.conan.io/2/reference/config_files/profiles.html

docs/build/conan.md

@@ -115,7 +115,7 @@ By default, Conan will use the profile named "default".
 [find_package]: https://cmake.org/cmake/help/latest/command/find_package.html
 [pcf]: https://cmake.org/cmake/help/latest/manual/cmake-packages.7.html#package-configuration-file
 [prefix_path]: https://cmake.org/cmake/help/latest/variable/CMAKE_PREFIX_PATH.html
-[profile]: https://docs.conan.io/2/reference/config_files/profiles.html
+[profile]: https://docs.conan.io/en/latest/reference/profiles.html
 [pvf]: https://cmake.org/cmake/help/latest/manual/cmake-packages.7.html#package-version-file
 [runtime]: https://cmake.org/cmake/help/latest/variable/CMAKE_MSVC_RUNTIME_LIBRARY.html
 [search]: https://cmake.org/cmake/help/latest/command/find_package.html#search-procedure

docs/build/environment.md

@@ -1,73 +1,69 @@
 Our [build instructions][BUILD.md] assume you have a C++ development
 environment complete with Git, Python, Conan, CMake, and a C++ compiler.
-This document explains how to set one up.
+This document exists to help readers set one up on any of the Big Three
+platforms: Linux, macOS, or Windows.
+
+As an alternative to system packages, the Nix development shell can be used to provide a development environment. See [using nix development shell](./nix.md) for more details.
 
 [BUILD.md]: ../../BUILD.md
 
-## Tested compiler versions
+## Linux
 
-`xrpld` is built in the **C++23** dialect by default.
-Make sure your toolchain is recent enough — the compiler versions currently tested in CI are:
+Package ecosystems vary across Linux distributions,
+so there is no one set of instructions that will work for every Linux user.
+The instructions below are written for Debian 12 (Bookworm).
 
-| Compiler    | Version |
-| ----------- | ------- |
-| GCC         | 15.2    |
-| Clang       | 22      |
-| Apple Clang | 17      |
-| MSVC        | 19.44   |
+```
+export GCC_RELEASE=12
+sudo apt update
+sudo apt install --yes gcc-${GCC_RELEASE} g++-${GCC_RELEASE} python3-pip \
+  python-is-python3 python3-venv python3-dev curl wget ca-certificates \
+  git build-essential cmake ninja-build libc6-dev
+sudo pip install --break-system-packages conan
 
-LLVM tools (`clang-tidy` and `clang-format`) are also pinned to version 22.
-
-Older compilers may fail to build the latest `develop` code: the codebase now
-relies on C++23 features and has been adjusted for `clang-tidy`.
-If the latest code doesn't build for you, update your build toolchain first.
-
-## Linux and macOS
-
-The **recommended way** to get a development environment on Linux and macOS is
-the Nix development shell. It provides the exact tooling used in CI — `git`,
-`python`, `conan`, `cmake`, `clang-tidy`, `clang-format`, and everything else —
-with a single command and without installing anything system-wide:
-
-```bash
-nix --experimental-features 'nix-command flakes' develop
+sudo update-alternatives --install /usr/bin/cc cc /usr/bin/gcc-${GCC_RELEASE} 999
+sudo update-alternatives --install \
+  /usr/bin/gcc gcc /usr/bin/gcc-${GCC_RELEASE} 100 \
+  --slave /usr/bin/g++ g++ /usr/bin/g++-${GCC_RELEASE} \
+  --slave /usr/bin/gcc-ar gcc-ar /usr/bin/gcc-ar-${GCC_RELEASE} \
+  --slave /usr/bin/gcc-nm gcc-nm /usr/bin/gcc-nm-${GCC_RELEASE} \
+  --slave /usr/bin/gcc-ranlib gcc-ranlib /usr/bin/gcc-ranlib-${GCC_RELEASE} \
+  --slave /usr/bin/gcov gcov /usr/bin/gcov-${GCC_RELEASE} \
+  --slave /usr/bin/gcov-tool gcov-tool /usr/bin/gcov-tool-${GCC_RELEASE} \
+  --slave /usr/bin/gcov-dump gcov-dump /usr/bin/gcov-dump-${GCC_RELEASE} \
+  --slave /usr/bin/lto-dump lto-dump /usr/bin/lto-dump-${GCC_RELEASE}
+sudo update-alternatives --auto cc
+sudo update-alternatives --auto gcc
 ```
 
-On **Linux**, Nix also provides the compiler (GCC). On **macOS**, the shell uses
-your **system-wide Apple Clang** as the compiler, so you still need to manage
-its version (see below).
+If you use different Linux distribution, hope the instruction above can guide
+you in the right direction. We try to maintain compatibility with all recent
+compiler releases, so if you use a rolling distribution like e.g. Arch or CentOS
+then there is a chance that everything will "just work".
 
-See [Using the Nix development shell](./nix.md) for installation and usage
-details, including how to select a different compiler.
+## macOS
 
-> [!NOTE]
-> Using Nix is not mandatory. Any custom environment (Homebrew packages or
-> anything else) will continue to work, but then it is up to you to keep it in
-> sync with the environment used in CI. Nix unifies the development environment
-> for everyone and synchronizes updates, which is why we recommend it.
+Open a Terminal and enter the below command to bring up a dialog to install
+the command line developer tools.
+Once it is finished, this command should return a version greater than the
+minimum required (see [BUILD.md][]).
 
-### macOS: managing the Apple Clang version
-
-Because the Nix shell uses the system-wide Apple Clang on macOS, the compiler
-version is whatever your installed Xcode (or Command Line Tools) provides. The
-following command should return a version greater than or equal to the
-[minimum required](#tested-compiler-versions):
-
-```bash
+```
 clang --version
 ```
 
-If you develop other applications using Xcode, you might be consistently
-updating to the newest version of Apple Clang, which will likely cause issues
-building xrpld. You may want to install and pin a specific version of Xcode:
+### Install Xcode Specific Version (Optional)
+
+If you develop other applications using XCode you might be consistently updating to the newest version of Apple Clang.
+This will likely cause issues building xrpld. You may want to install a specific version of Xcode:
 
 1. **Download Xcode**
    - Visit [Apple Developer Downloads](https://developer.apple.com/download/more/)
    - Sign in with your Apple Developer account
-   - Search for an Xcode version that includes the expected Apple Clang version
+   - Search for an Xcode version that includes **Apple Clang (Expected Version)**
    - Download the `.xip` file
 
-2. **Install and configure Xcode**
+2. **Install and Configure Xcode**
 
    ```bash
    # Extract the .xip file and rename for version management
@@ -83,28 +79,62 @@ building xrpld. You may want to install and pin a specific version of Xcode:
    export DEVELOPER_DIR=/Applications/Xcode_16.2.app/Contents/Developer
    ```
 
-## Windows
+The command line developer tools should include Git too:
 
-Nix is not available on Windows, so the required tools have to be installed
-manually:
+```
+git --version
+```
 
-- [Visual Studio 2022](https://visualstudio.microsoft.com/) with the
-  **"Desktop development with C++"** workload — this provides MSVC and the
-  "x64 Native Tools Command Prompt".
-- [Git for Windows](https://git-scm.com/download/win)
-- [Python 3.11](https://www.python.org/downloads/), or higher
-- [Conan 2.17](https://conan.io/downloads.html), or higher
-- [CMake 3.22](https://cmake.org/download/), or higher
+Install [Homebrew][],
+use it to install [pyenv][],
+use it to install Python,
+and use it to install Conan:
 
-> [!NOTE]
-> Windows is used for development only and is not recommended for production.
+[Homebrew]: https://brew.sh/
+[pyenv]: https://github.com/pyenv/pyenv
+
+```
+/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+brew update
+brew install xz
+brew install pyenv
+pyenv install 3.11
+pyenv global 3.11
+eval "$(pyenv init -)"
+pip install 'conan'
+```
+
+Install CMake with Homebrew too:
+
+```
+brew install cmake
+```
 
 ## Clang-tidy
 
-`clang-tidy` is required to run static analysis checks locally (see
-[CONTRIBUTING.md](../../CONTRIBUTING.md)). It is not required to build the
-project. This project currently uses `clang-tidy` version 22.
+Clang-tidy is required to run static analysis checks locally (see [CONTRIBUTING.md](../../CONTRIBUTING.md)).
+It is not required to build the project. Currently this project uses clang-tidy version 21.
 
-On Linux and macOS, the [Nix development shell](./nix.md) provides `clang-tidy`
-22 out of the box — run it via `run-clang-tidy`. No separate installation is
-needed.
+### Linux
+
+LLVM 21 is not available in the default Debian 12 (Bookworm) repositories.
+Install it using the official LLVM apt installer:
+
+```
+wget https://apt.llvm.org/llvm.sh
+chmod +x llvm.sh
+sudo ./llvm.sh 21
+sudo apt install --yes clang-tidy-21
+```
+
+Then use `run-clang-tidy-21` when running clang-tidy locally.
+
+### macOS
+
+Install LLVM 21 via Homebrew:
+
+```
+brew install llvm@21
+```
+
+Then use `run-clang-tidy` from the LLVM 21 Homebrew prefix when running clang-tidy locally.

docs/build/nix.md

@@ -2,12 +2,9 @@
 
 This guide explains how to use Nix to set up a reproducible development environment for xrpld. Using Nix eliminates the need to manually install utilities and ensures consistent tooling across different machines.
 
-**The Nix development shell is the recommended way to develop xrpld.** It unifies the development environment for everyone and synchronizes updates: the same tooling and compiler versions are used both here and in CI. Any custom environment (Homebrew packages or anything else) will continue to work, but then it is up to you to keep it in sync with the environment used in CI.
-
 ## Benefits of Using Nix
 
 - **Reproducible environment**: Everyone gets the same versions of tools and compilers
-- **Matches CI**: The Linux CI runs in Docker images built from this exact Nix environment
 - **No system pollution**: Dependencies are isolated and don't affect your system packages
 - **Multiple compiler versions**: Easily switch between different GCC and Clang versions
 - **Quick setup**: Get started with a single command
@@ -31,22 +28,11 @@ This will:
 
 - Download and set up all required development tools (CMake, Ninja, Conan, etc.)
 - Configure the appropriate compiler for your platform:
-  - **Linux**: GCC 15.2 (provided by Nix)
-  - **macOS**: Apple Clang (your system compiler)
+  - **macOS**: Apple Clang (default system compiler)
+  - **Linux**: GCC 15
 
 The first time you run this command, it will take a few minutes to download and build the environment. Subsequent runs will be much faster.
 
-### Platform notes
-
-- **Linux**: `nix develop` gives you a shell with all the tooling necessary to
-  develop xrpld and with GCC 15.2 (also provided by Nix). There are no caveats.
-- **macOS**: `nix develop` gives you a full environment too. The compiler is
-  your system-wide Apple Clang, while every other tool — including Conan — is
-  provided by Nix. Conan has no binary in the Nix cache for macOS, so it is
-  built from source the first time you enter the shell, which makes the initial
-  setup slower (this is handled automatically; see
-  [`nix/devshell.nix`](../../nix/devshell.nix)).
-
 > [!TIP]
 > To avoid typing `--experimental-features 'nix-command flakes'` every time, you can permanently enable flakes by creating `~/.config/nix/nix.conf`:
 >
@@ -65,7 +51,7 @@ The first time you run this command, it will take a few minutes to download and
 A compiler can be chosen by providing its name with the `.#` prefix, e.g. `nix develop .#gcc15`.
 Use `nix flake show` to see all the available development shells.
 
-Use `nix develop .#no-compiler` to use the compiler from your system.
+Use `nix develop .#no_compiler` to use the compiler from your system.
 
 ### Example Usage
 
@@ -82,28 +68,12 @@ nix develop
 
 ### Using a different shell
 
-`nix develop` opens bash by default. To use another shell, pass it with the `-c` flag — this works with any shell, e.g. `zsh` or `fish`:
+`nix develop` opens bash by default. If you want to use another shell this could be done by adding `-c` flag. For example:
 
 ```bash
-# Use zsh
 nix develop -c zsh
-
-# Use fish
-nix develop -c fish
-
-# Use your login shell
-nix develop -c "$SHELL"
 ```
 
-> [!WARNING]
-> Your shell's interactive startup files (e.g. `config.fish`, `.zshrc`) may prepend other directories — most commonly Homebrew — to `$PATH`, which can shadow the tools provided by the Nix shell. After entering, verify that tools resolve into the Nix store:
->
-> ```bash
-> command -v cmake   # should print a /nix/store/... path
-> ```
->
-> If it doesn't, either adjust your shell configuration so it doesn't override `$PATH`, or use [direnv](#automatic-activation-with-direnv) (below), which loads the environment _after_ your shell config and so takes precedence regardless of the shell you use.
-
 ## Building xrpld with Nix
 
 Once inside the Nix development shell, follow the standard [build instructions](../../BUILD.md#steps). The Nix shell provides all necessary tools (CMake, Ninja, Conan, etc.).
@@ -112,8 +82,6 @@ Once inside the Nix development shell, follow the standard [build instructions](
 
 [direnv](https://direnv.net/) or [nix-direnv](https://github.com/nix-community/nix-direnv) can automatically activate the Nix development shell when you enter the repository directory.
 
-This is also the most robust way to use the environment from **any shell** (bash, zsh, fish, …): direnv stays in your current shell and loads the environment _after_ your shell's startup files have run, so the Nix-provided tools take precedence over anything your shell configuration adds to `$PATH`. To use it, install direnv for your shell, then add an `.envrc` containing `use flake` at the repository root and run `direnv allow`.
-
 ## Conan and Prebuilt Packages
 
 Please note that there is no guarantee that binaries from conan cache will work when using nix. If you encounter any errors, please use `--build '*'` to force conan to compile everything from source:
@@ -125,8 +93,3 @@ conan install .. --output-folder . --build '*' --settings build_type=Release
 ## Updating `flake.lock` file
 
 To update `flake.lock` to the latest revision use `nix flake update` command.
-
-## Troubleshooting
-
-See [Troubleshooting Nix problems](./nix_troubleshooting.md) for common issues,
-such as `nix develop` failing inside Git worktrees.

docs/build/nix_troubleshooting.md

@@ -1,61 +0,0 @@
-# Troubleshooting Nix problems
-
-Common issues encountered when using the [Nix development shell](./nix.md), and
-how to resolve them.
-
-## Git worktrees
-
-If `nix develop` fails with an error like:
-
-```
-error:
-       … while fetching the input 'git+file:///path/to/rippled'
-
-       error: opening Git repository "/path/to/rippled": unsupported extension name extensions.relativeworktrees (libgit2 error code = 6)
-```
-
-then your Nix is linked against a libgit2 older than **1.9.4**. Git 2.48+ writes
-the `extensions.relativeWorktrees` config entry when a worktree is created with
-relative paths (`git worktree add --relative-paths`, or with
-`worktree.useRelativePaths=true`), and older libgit2 versions refuse to open a
-repository that uses it. Nix uses libgit2 to read the flake, so evaluation
-fails.
-
-> [!IMPORTANT]
-> This entry is written to the **shared** repository config, so once any
-> relative worktree exists, `nix develop` fails in the main checkout too — not
-> just inside the worktree.
-
-### Workarounds
-
-These work today, with any Nix version:
-
-- bypass libgit2 with a `path:` flakeref: `nix develop "path:$PWD"`
-  (note: this copies the working tree to the store and ignores `.gitignore`); or
-- create worktrees with absolute paths (omit `--relative-paths`); or
-- clear the extension if you don't need relative worktrees:
-  `git config --unset extensions.relativeWorktrees`.
-
-### Permanent fix
-
-The fix is in [libgit2 1.9.4](https://github.com/libgit2/libgit2/releases/tag/v1.9.4),
-so the real solution is a Nix that links against libgit2 `1.9.4` or newer. Check
-which version yours links against:
-
-```bash
-nix-store -qR "$(readlink -f "$(command -v nix)")" | grep libgit2
-```
-
-> [!WARNING]
-> `nix upgrade-nix` does **not** help yet. It installs the build from the
-> official [`nix-fallback-paths`](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/installer/tools/nix-fallback-paths.nix),
-> which is still linked against libgit2 `1.9.2` — there is no new upstream Nix
-> release with the fix. (On some systems that build is even the exact store path
-> you already have, making the upgrade a no-op.)
-
-nixpkgs has already rebuilt Nix against the fixed libgit2 (e.g. `nix-2.34.7+1`),
-so the cleanest path is to reinstall Nix using your usual installation method
-once it picks up that rebuild, then re-run the `grep libgit2` check above to
-confirm it reports `1.9.4` or newer.
-
-Until then, prefer the workarounds above.

flake.lock

@@ -2,18 +2,17 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781173989,
-        "narHash": "sha256-fnzKKPvS+oieI/pTzotA5tkoM47EB1NpaBcgk4R97hE=",
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8c91a71d13451abc40eb9dae8910f972f979852f",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
+        "id": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "indirect"
       }
     },
     "nixpkgs-custom-glibc": {

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "Nix related things for xrpld";
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "nixpkgs/nixos-unstable";
     # nixpkgs snapshot (2020-06-30) that shipped glibc 2.31 as the primary
     # version — matches the system libc on Ubuntu 20.04 LTS. Imported
     # manually (flake = false) because this revision predates nixpkgs'

include/xrpl/basics/Archive.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#include <boost/filesystem.hpp>
+#include <filesystem>
 
 namespace xrpl {
 
@@ -12,6 +12,6 @@ namespace xrpl {
     @throws runtime_error
 */
 void
-extractTarLz4(boost::filesystem::path const& src, boost::filesystem::path const& dst);
+extractTarLz4(std::filesystem::path const& src, std::filesystem::path const& dst);
 
 }  // namespace xrpl

include/xrpl/basics/Buffer.h

@@ -6,7 +6,6 @@
 #include <cstdint>
 #include <cstring>
 #include <memory>
-#include <utility>
 
 namespace xrpl {
 

include/xrpl/basics/CompressionAlgorithms.h

@@ -5,7 +5,6 @@
 #include <lz4.h>
 
 #include <algorithm>
-#include <cstddef>
 #include <cstdint>
 #include <stdexcept>
 #include <vector>

include/xrpl/basics/DecayingSample.h

@@ -2,7 +2,6 @@
 
 #include <chrono>
 #include <cmath>
-#include <cstddef>
 
 namespace xrpl {
 
@@ -13,8 +12,8 @@ template <int Window, typename Clock>
 class DecayingSample
 {
 public:
-    using value_type = Clock::duration::rep;
-    using time_point = Clock::time_point;
+    using value_type = typename Clock::duration::rep;
+    using time_point = typename Clock::time_point;
 
     DecayingSample() = delete;
 
@@ -94,7 +93,7 @@ template <int HalfLife, class Clock>
 class DecayWindow
 {
 public:
-    using time_point = Clock::time_point;
+    using time_point = typename Clock::time_point;
 
     explicit DecayWindow(time_point now) : when_(now)
     {

include/xrpl/basics/FileUtilities.h

@@ -1,24 +1,22 @@
 #pragma once
 
-#include <boost/filesystem.hpp>
-#include <boost/system/error_code.hpp>
-
-#include <cstddef>
+#include <filesystem>
 #include <optional>
 #include <string>
+#include <system_error>
 
 namespace xrpl {
 
 std::string
 getFileContents(
-    boost::system::error_code& ec,
-    boost::filesystem::path const& sourcePath,
+    std::error_code& ec,
+    std::filesystem::path const& sourcePath,
     std::optional<std::size_t> maxSize = std::nullopt);
 
 void
 writeFileContents(
-    boost::system::error_code& ec,
-    boost::filesystem::path const& destPath,
+    std::error_code& ec,
+    std::filesystem::path const& destPath,
     std::string const& contents);
 
 }  // namespace xrpl

include/xrpl/basics/IntrusivePointer.h

@@ -1,7 +1,6 @@
 #pragma once
 
 #include <concepts>
-#include <cstddef>
 #include <cstdint>
 #include <type_traits>
 #include <utility>

include/xrpl/basics/IntrusiveRefCounts.h

@@ -3,7 +3,6 @@
 #include <xrpl/beast/utility/instrumentation.h>
 
 #include <atomic>
-#include <cstddef>
 #include <cstdint>
 
 namespace xrpl {

include/xrpl/basics/Log.h

@@ -1,18 +1,17 @@
 #pragma once
 
+#include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/beast/utility/Journal.h>
 
 #include <boost/beast/core/string.hpp>
-#include <boost/filesystem.hpp>
 
+#include <filesystem>
 #include <fstream>
 #include <map>
 #include <memory>
 #include <mutex>
 #include <optional>
-#include <string>
 #include <utility>
-#include <vector>
 
 namespace xrpl {
 
@@ -77,7 +76,7 @@ private:
             @return `true` if the file was opened.
         */
         bool
-        open(boost::filesystem::path const& path);
+        open(std::filesystem::path const& path);
 
         /** Close and re-open the system file associated with the log
             This assists in interoperating with external log management tools.
@@ -119,7 +118,7 @@ private:
 
     private:
         std::unique_ptr<std::ofstream> stream_;
-        boost::filesystem::path path_;
+        std::filesystem::path path_;
     };
 
     std::mutex mutable mutex_;
@@ -138,7 +137,7 @@ public:
     virtual ~Logs() = default;
 
     bool
-    open(boost::filesystem::path const& pathToLogFile);
+    open(std::filesystem::path const& pathToLogFile);
 
     beast::Journal::Sink&
     get(std::string const& name);
@@ -207,7 +206,8 @@ private:
 #ifndef JLOG
 #define JLOG(x) \
     if (!(x))   \
-        ;       \
+    {           \
+    }           \
     else        \
         x
 #endif

include/xrpl/basics/Number.h

@@ -2,9 +2,7 @@
 
 #include <xrpl/beast/utility/instrumentation.h>
 
-#include <algorithm>
 #include <array>
-#include <cstddef>
 #include <cstdint>
 #include <functional>
 #include <limits>
@@ -13,9 +11,7 @@
 #include <set>
 #include <stdexcept>
 #include <string>
-#include <type_traits>
 #include <unordered_map>
-#include <utility>
 
 namespace xrpl {
 

include/xrpl/basics/RangeSet.h

@@ -6,7 +6,6 @@
 #include <boost/icl/closed_interval.hpp>
 #include <boost/icl/interval_set.hpp>
 
-#include <functional>
 #include <optional>
 #include <string>
 #include <vector>

include/xrpl/basics/Resolver.h

@@ -3,7 +3,6 @@
 #include <xrpl/beast/net/IPEndpoint.h>
 
 #include <functional>
-#include <string>
 #include <vector>
 
 namespace xrpl {

include/xrpl/basics/ResolverAsio.h

@@ -5,8 +5,6 @@
 
 #include <boost/asio/io_context.hpp>
 
-#include <memory>
-
 namespace xrpl {
 
 class ResolverAsio : public Resolver

include/xrpl/basics/SHAMapHash.h

@@ -3,9 +3,7 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/basics/partitioned_unordered_map.h>
 
-#include <cstddef>
 #include <ostream>
-#include <string>
 
 namespace xrpl {
 

include/xrpl/basics/SharedWeakCachePointer.h

@@ -1,7 +1,5 @@
 #pragma once
 
-#include <concepts>
-#include <cstddef>
 #include <memory>
 #include <variant>
 

include/xrpl/basics/SlabAllocator.h

@@ -15,7 +15,6 @@
 #include <cstdint>
 #include <cstring>
 #include <mutex>
-#include <stdexcept>
 #include <vector>
 
 #if BOOST_OS_LINUX

include/xrpl/basics/StringUtilities.h

@@ -1,19 +1,18 @@
 #pragma once
 
 #include <xrpl/basics/Blob.h>
+#include <xrpl/basics/strHex.h>
 
 #include <boost/format.hpp>
 #include <boost/utility/string_view.hpp>
 
 #include <array>
 #include <concepts>
-#include <cstddef>
 #include <cstdint>
 #include <optional>
 #include <string>
 #include <string_view>
 #include <type_traits>
-#include <utility>
 
 namespace xrpl {
 

include/xrpl/basics/TaggedCache.h

@@ -1,46 +1,22 @@
 #pragma once
 
-#include <xrpl/basics/SharedWeakCachePointer.h>
-#include <xrpl/basics/SharedWeakCachePointer.ipp>  // IWYU pragma: keep
+#include <xrpl/basics/IntrusivePointer.h>
+#include <xrpl/basics/Log.h>
+#include <xrpl/basics/SharedWeakCachePointer.ipp>
 #include <xrpl/basics/UnorderedContainers.h>
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/beast/clock/abstract_clock.h>
-#include <xrpl/beast/insight/Collector.h>
-#include <xrpl/beast/insight/Gauge.h>
-#include <xrpl/beast/insight/Hook.h>
-#include <xrpl/beast/insight/NullCollector.h>
-#include <xrpl/beast/utility/Journal.h>
+#include <xrpl/beast/insight/Insight.h>
 
 #include <atomic>
-#include <chrono>
-#include <cstddef>
-#include <cstdint>
 #include <functional>
-#include <memory>
 #include <mutex>
-#include <string>
 #include <thread>
 #include <type_traits>
 #include <vector>
 
 namespace xrpl {
 
-namespace detail {
-
-// Replace-policy tags selecting how TaggedCache::canonicalizeImpl resolves a
-// collision when the key already exists (defined in TaggedCache.ipp):
-//   - ReplaceCached: always replace the cached value with `data`. `data` is
-//     never written back and may be const.
-//   - ReplaceClient: keep the cached value and write it back into `data` (the
-//     client's pointer), which must therefore be writable.
-//   - ReplaceDynamically: call the supplied callback to decide per call; `data`
-//     is written back when the cached value is kept, so it must be writable.
-struct ReplaceCached;
-struct ReplaceClient;
-struct ReplaceDynamically;
-
-}  // namespace detail
-
 /** Map/cache combination.
     This class implements a cache and a map. The cache keeps objects alive
     in the map. The map allows multiple code paths that reference objects
@@ -120,32 +96,6 @@ public:
     bool
     del(key_type const& key, bool valid);
 
-private:
-    // Selects the `data` parameter type of canonicalizeImpl from the replace
-    // policy: const for detail::ReplaceCached (never written back), otherwise
-    // writable.
-    template <typename Policy>
-    using CanonicalizeClientPointerType = std::conditional_t<
-        std::is_same_v<detail::ReplaceCached, Policy>,
-        SharedPointerType const&,
-        SharedPointerType&>;
-
-    /** Shared implementation of the canonicalize family.
-
-        `policy` selects how a collision is resolved when `key` already exists:
-        detail::ReplaceCached, detail::ReplaceClient or
-        detail::ReplaceDynamically. For ReplaceDynamically `replaceCallback` is
-        invoked with the existing strong pointer and returns whether to replace
-        the cached value with `data`; for the tag policies it is unused.
-    */
-    template <class Policy, class Callback = std::nullptr_t>
-    bool
-    canonicalizeImpl(
-        key_type const& key,
-        CanonicalizeClientPointerType<Policy> data,
-        Policy policy,
-        Callback&& replaceCallback = nullptr);
-
 public:
     /** Replace aliased objects with originals.
 
@@ -154,52 +104,19 @@ public:
         This routine eliminates the duplicate and performs a replacement
         on the callers shared pointer if needed.
 
-        `replaceCallback` is a callable taking the existing strong pointer and
-        returning whether to replace the cached value with `data` (true) or to
-        keep the cached value and write it back into `data` (false). Because the
-        write-back case mutates `data`, `data` must be writable.
-
         @param key The key corresponding to the object
         @param data A shared pointer to the data corresponding to the object.
-        @param replaceCallback A callable (existing strong pointer -> bool).
+        @param replace Function that decides if cache should be replaced
 
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
-    template <class Callback>
+        @return `true` If the key already existed.
+    */
+    template <class R>
     bool
-    canonicalize(key_type const& key, SharedPointerType& data, Callback&& replaceCallback);
+    canonicalize(key_type const& key, SharedPointerType& data, R&& replaceCallback);
 
-    /** Insert/update the canonical entry for `key`, always replacing the
-        cached value with `data`.
-
-        If an entry already exists for `key`, the cached value is unconditionally
-        replaced with `data`; otherwise `data` is inserted. `data` is never
-        written back, so it may be const.
-
-        @param key The key corresponding to the object.
-        @param data A shared pointer to the data corresponding to the object.
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
     bool
     canonicalizeReplaceCache(key_type const& key, SharedPointerType const& data);
 
-    /** Insert the canonical entry for `key`, keeping any existing cached value.
-
-        If an entry already exists for `key`, the cached value is kept and
-        written back into `data` so the caller ends up with the canonical
-        object; otherwise `data` is inserted. Because `data` may be overwritten
-        it must be writable.
-
-        @param key The key corresponding to the object.
-        @param data A shared pointer to the data corresponding to the object;
-                    updated to the canonical value when one already exists.
-
-        @return `true` if an existing live entry was found and used; `false` if a new entry was
-                inserted or an expired tracked entry was re-cached.
-    **/
     bool
     canonicalizeReplaceClient(key_type const& key, SharedPointerType& data);
 
@@ -345,7 +262,7 @@ private:
     sweepHelper(
         clock_type::time_point const& whenExpire,
         [[maybe_unused]] clock_type::time_point const& now,
-        KeyValueCacheType::map_type& partition,
+        typename KeyValueCacheType::map_type& partition,
         SweptPointersVector& stuffToSweep,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&);
@@ -354,7 +271,7 @@ private:
     sweepHelper(
         clock_type::time_point const& whenExpire,
         clock_type::time_point const& now,
-        KeyOnlyCacheType::map_type& partition,
+        typename KeyOnlyCacheType::map_type& partition,
         SweptPointersVector&,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&);

include/xrpl/basics/TaggedCache.ipp

@@ -1,35 +1,10 @@
 #pragma once
 
 #include <xrpl/basics/IntrusivePointer.ipp>
-#include <xrpl/basics/Log.h>  // IWYU pragma: keep
 #include <xrpl/basics/TaggedCache.h>
 
 namespace xrpl {
 
-namespace detail {
-
-// Replace-policy tags selecting how TaggedCache::canonicalizeImpl resolves a
-// collision when the key already exists:
-//   - ReplaceCached: always replace the cached value with `data`. `data` is
-//     never written back and may be const.
-//   - ReplaceClient: keep the cached value and write it back into `data` (the
-//     client's pointer), which must therefore be writable.
-//   - ReplaceDynamically: call the supplied callback to decide per call; `data`
-//     is written back when the cached value is kept, so it must be writable.
-struct ReplaceCached
-{
-};
-
-struct ReplaceClient
-{
-};
-
-struct ReplaceDynamically
-{
-};
-
-}  // namespace detail
-
 template <
     class Key,
     class T,
@@ -325,29 +300,13 @@ template <
     class Hash,
     class KeyEqual,
     class Mutex>
-template <class Policy, class Callback>
+template <class R>
 inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    canonicalizeImpl(
-        key_type const& key,
-        CanonicalizeClientPointerType<Policy> data,
-        [[maybe_unused]] Policy policy,
-        [[maybe_unused]] Callback&& replaceCallback)
+    canonicalize(key_type const& key, SharedPointerType& data, R&& replaceCallback)
 {
     // Return canonical value, store if needed, refresh in cache
     // Return values: true=we had the data already
-
-    // `Policy` is one of:
-    //   - detail::ReplaceCached: always replace the cached value with `data`;
-    //     `data` is never written back and may be const.
-    //   - detail::ReplaceClient: keep the cached value and write it back into
-    //     `data` (the client's pointer), which must therefore be writable.
-    //   - detail::ReplaceDynamically: call `replaceCallback` to decide at run
-    //     time; `data` must be writable.
-    // For the latter two the write-back below requires a mutable `data`, so
-    // passing a const argument is a compile error.
-    constexpr bool replaceCached = std::is_same_v<Policy, detail::ReplaceCached>;
-
     std::scoped_lock const lock(mutex_);
 
     auto cit = cache_.find(key);
@@ -365,14 +324,13 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     Entry& entry = cit->second;
     entry.touch(clock_.now());
 
-    auto shouldReplaceCached = [&] {
-        if constexpr (replaceCached)
+    auto shouldReplace = [&] {
+        if constexpr (std::is_invocable_r_v<bool, R>)
         {
-            return true;
-        }
-        else if constexpr (std::is_same_v<Policy, detail::ReplaceClient>)
-        {
-            return false;
+            // The reason for this extra complexity is for intrusive
+            // strong/weak combo getting a strong is relatively expensive
+            // and not needed for many cases.
+            return replaceCallback();
         }
         else
         {
@@ -382,11 +340,11 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 
     if (entry.isCached())
     {
-        if (shouldReplaceCached())
+        if (shouldReplace())
         {
             entry.ptr = data;
         }
-        else if constexpr (!replaceCached)
+        else
         {
             data = entry.ptr.getStrong();
         }
@@ -398,11 +356,11 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
 
     if (cachedData)
     {
-        if (shouldReplaceCached())
+        if (shouldReplace())
         {
             entry.ptr = data;
         }
-        else if constexpr (!replaceCached)
+        else
         {
             entry.ptr.convertToStrong();
             data = cachedData;
@@ -418,24 +376,6 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     return false;
 }
 
-template <
-    class Key,
-    class T,
-    bool IsKeyCache,
-    class SharedWeakUnionPointer,
-    class SharedPointerType,
-    class Hash,
-    class KeyEqual,
-    class Mutex>
-template <class Callback>
-inline bool
-TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
-    canonicalize(key_type const& key, SharedPointerType& data, Callback&& replaceCallback)
-{
-    return canonicalizeImpl(
-        key, data, detail::ReplaceDynamically{}, std::forward<Callback>(replaceCallback));
-}
-
 template <
     class Key,
     class T,
@@ -449,7 +389,7 @@ inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
     canonicalizeReplaceCache(key_type const& key, SharedPointerType const& data)
 {
-    return canonicalizeImpl(key, data, detail::ReplaceCached{});
+    return canonicalize(key, const_cast<SharedPointerType&>(data), []() { return true; });
 }
 
 template <
@@ -465,7 +405,7 @@ inline bool
 TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash, KeyEqual, Mutex>::
     canonicalizeReplaceClient(key_type const& key, SharedPointerType& data)
 {
-    return canonicalizeImpl(key, data, detail::ReplaceClient{});
+    return canonicalize(key, data, []() { return false; });
 }
 
 template <
@@ -736,7 +676,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     sweepHelper(
         clock_type::time_point const& whenExpire,
         [[maybe_unused]] clock_type::time_point const& now,
-        KeyValueCacheType::map_type& partition,
+        typename KeyValueCacheType::map_type& partition,
         SweptPointersVector& stuffToSweep,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)
@@ -816,7 +756,7 @@ TaggedCache<Key, T, IsKeyCache, SharedWeakUnionPointer, SharedPointerType, Hash,
     sweepHelper(
         clock_type::time_point const& whenExpire,
         clock_type::time_point const& now,
-        KeyOnlyCacheType::map_type& partition,
+        typename KeyOnlyCacheType::map_type& partition,
         SweptPointersVector&,
         std::atomic<int>& allRemovals,
         std::scoped_lock<std::recursive_mutex> const&)

include/xrpl/basics/UnorderedContainers.h

@@ -2,14 +2,12 @@
 
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/basics/partitioned_unordered_map.h>
+#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/hash/xxhasher.h>
 
-#include <functional>
-#include <memory>
 #include <unordered_map>
 #include <unordered_set>
-#include <utility>
 
 /**
  * Use hash_* containers for keys that do not need a cryptographically secure

include/xrpl/basics/base64.h

@@ -34,7 +34,6 @@
 
 #pragma once
 
-#include <cstddef>
 #include <cstdint>
 #include <string>
 #include <string_view>

include/xrpl/basics/base_uint.h

@@ -10,7 +10,6 @@
 #include <xrpl/basics/hardened_hash.h>
 #include <xrpl/basics/partitioned_unordered_map.h>
 #include <xrpl/basics/strHex.h>
-#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/utility/Zero.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
@@ -19,17 +18,8 @@
 
 #include <algorithm>
 #include <array>
-#include <compare>
-#include <cstddef>
-#include <cstdint>
 #include <cstring>
 #include <expected>
-#include <iterator>
-#include <optional>
-#include <ostream>
-#include <stdexcept>
-#include <string>
-#include <string_view>
 #include <type_traits>
 
 namespace xrpl {

include/xrpl/basics/chrono.h

@@ -10,7 +10,6 @@
 #include <cstdint>
 #include <ratio>
 #include <string>
-#include <type_traits>
 
 namespace xrpl {
 

include/xrpl/basics/hardened_hash.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <xrpl/beast/hash/hash_append.h>
 #include <xrpl/beast/hash/xxhasher.h>
 
 #include <cstdint>
@@ -74,7 +75,7 @@ private:
     detail::seed_pair seeds_{detail::makeSeedPair<>()};
 
 public:
-    using result_type = HashAlgorithm::result_type;
+    using result_type = typename HashAlgorithm::result_type;
 
     HardenedHash() = default;
 

include/xrpl/basics/join.h

@@ -1,9 +1,7 @@
 #pragma once
 
-#include <cstddef>
 #include <string>
 #include <string_view>
-#include <utility>
 
 namespace xrpl {
 

include/xrpl/basics/make_SSLContext.h

@@ -2,7 +2,6 @@
 
 #include <boost/asio/ssl/context.hpp>
 
-#include <memory>
 #include <string>
 
 namespace xrpl {

include/xrpl/basics/partitioned_unordered_map.h

@@ -3,10 +3,7 @@
 #include <xrpl/beast/hash/uhash.h>
 #include <xrpl/beast/utility/instrumentation.h>
 
-#include <cstddef>
 #include <functional>
-#include <iterator>
-#include <memory>
 #include <optional>
 #include <string>
 #include <thread>
@@ -60,8 +57,8 @@ public:
     {
         using iterator_category = std::forward_iterator_tag;
         partition_map_type* map{nullptr};
-        partition_map_type::iterator ait{};
-        map_type::iterator mit;
+        typename partition_map_type::iterator ait{};
+        typename map_type::iterator mit;
 
         Iterator() = default;
 
@@ -129,8 +126,8 @@ public:
         using iterator_category = std::forward_iterator_tag;
 
         partition_map_type* map{nullptr};
-        partition_map_type::iterator ait{};
-        map_type::iterator mit;
+        typename partition_map_type::iterator ait{};
+        typename map_type::iterator mit;
 
         ConstIterator() = default;
 

include/xrpl/basics/random.h

@@ -3,6 +3,7 @@
 #include <xrpl/beast/utility/instrumentation.h>
 #include <xrpl/beast/xor_shift_engine.h>
 
+#include <cstddef>
 #include <cstdint>
 #include <limits>
 #include <mutex>
@@ -28,7 +29,6 @@ static_assert(
 namespace detail {
 
 // Determines if a type can be called like an Engine
-// NOLINTNEXTLINE(readability-redundant-typename): typename required by MSVC
 template <class Engine, class Result = typename Engine::result_type>
 using is_engine = std::is_invocable_r<Result, Engine>;
 }  // namespace detail

include/xrpl/basics/rocksdb.h

@@ -0,0 +1,29 @@
+#pragma once
+
+#if XRPL_ROCKSDB_AVAILABLE
+// #include <rocksdb2/port/port_posix.h>
+#include <rocksdb/cache.h>
+#include <rocksdb/compaction_filter.h>
+#include <rocksdb/comparator.h>
+#include <rocksdb/convenience.h>
+#include <rocksdb/db.h>
+#include <rocksdb/env.h>
+#include <rocksdb/filter_policy.h>
+#include <rocksdb/flush_block_policy.h>
+#include <rocksdb/iterator.h>
+#include <rocksdb/memtablerep.h>
+#include <rocksdb/merge_operator.h>
+#include <rocksdb/options.h>
+#include <rocksdb/perf_context.h>
+#include <rocksdb/slice.h>
+#include <rocksdb/slice_transform.h>
+#include <rocksdb/statistics.h>
+#include <rocksdb/status.h>
+#include <rocksdb/table.h>
+#include <rocksdb/table_properties.h>
+#include <rocksdb/transaction_log.h>
+#include <rocksdb/types.h>
+#include <rocksdb/universal_compaction.h>
+#include <rocksdb/write_batch.h>
+
+#endif

include/xrpl/basics/safe_cast.h

@@ -1,5 +1,7 @@
 #pragma once
 
+#include <xrpl/beast/utility/instrumentation.h>
+
 #include <type_traits>
 
 namespace xrpl {

include/xrpl/basics/sanitizers.h

@@ -4,7 +4,7 @@
 /*
  ASAN flags some false positives with sudden jumps in control flow, like
  exceptions, or when encountering coroutine stack switches. This macro can be used to disable ASAN
- instrumentation for specific functions.
+ intrumentation for specific functions.
 */
 #if defined(__GNUC__) || defined(__clang__)
 #define XRPL_NO_SANITIZE_ADDRESS __attribute__((no_sanitize("address", "hwaddress")))

include/xrpl/basics/strHex.h

@@ -3,9 +3,6 @@
 #include <boost/algorithm/hex.hpp>
 #include <boost/endian/conversion.hpp>
 
-#include <iterator>
-#include <string>
-
 namespace xrpl {
 
 template <class FwdIt>

include/xrpl/basics/tagged_integer.h

@@ -7,7 +7,6 @@
 #include <boost/operators.hpp>
 
 #include <iostream>
-#include <string>
 #include <type_traits>
 
 namespace xrpl {

include/xrpl/beast/asio/io_latency_probe.h

@@ -8,7 +8,6 @@
 
 #include <chrono>
 #include <condition_variable>
-#include <cstddef>
 #include <mutex>
 #include <stdexcept>
 
@@ -19,8 +18,8 @@ template <class Clock>
 class IOLatencyProbe
 {
 private:
-    using duration = Clock::duration;
-    using time_point = Clock::time_point;
+    using duration = typename Clock::duration;
+    using time_point = typename Clock::time_point;
 
     std::recursive_mutex mutex_;
     std::condition_variable_any cond_;

include/xrpl/beast/clock/abstract_clock.h

@@ -34,10 +34,10 @@ template <class Clock>
 class AbstractClock
 {
 public:
-    using rep = Clock::rep;
-    using period = Clock::period;
-    using duration = Clock::duration;
-    using time_point = Clock::time_point;
+    using rep = typename Clock::rep;
+    using period = typename Clock::period;
+    using duration = typename Clock::duration;
+    using time_point = typename Clock::time_point;
     using clock_type = Clock;
 
     static bool const is_steady = Clock::is_steady;  // NOLINT(readability-identifier-naming)

include/xrpl/beast/clock/basic_seconds_clock.h

@@ -20,10 +20,10 @@ public:
 
     explicit BasicSecondsClock() = default;
 
-    using rep = Clock::rep;
-    using period = Clock::period;
-    using duration = Clock::duration;
-    using time_point = Clock::time_point;
+    using rep = typename Clock::rep;
+    using period = typename Clock::period;
+    using duration = typename Clock::duration;
+    using time_point = typename Clock::time_point;
 
     static bool const is_steady =  // NOLINT(readability-identifier-naming)
         Clock::is_steady;

include/xrpl/beast/container/aged_container_utility.h

@@ -3,7 +3,6 @@
 #include <xrpl/beast/container/aged_container.h>
 
 #include <chrono>
-#include <cstddef>
 #include <type_traits>
 
 namespace beast {

include/xrpl/beast/container/aged_map.h

@@ -5,7 +5,6 @@
 #include <chrono>
 #include <functional>
 #include <memory>
-#include <utility>
 
 namespace beast {
 

include/xrpl/beast/container/aged_multimap.h

@@ -5,7 +5,6 @@
 #include <chrono>
 #include <functional>
 #include <memory>
-#include <utility>
 
 namespace beast {
 

include/xrpl/beast/container/aged_unordered_map.h

@@ -5,7 +5,6 @@
 #include <chrono>
 #include <functional>
 #include <memory>
-#include <utility>
 
 namespace beast {
 

include/xrpl/beast/container/aged_unordered_multimap.h

@@ -5,7 +5,6 @@
 #include <chrono>
 #include <functional>
 #include <memory>
-#include <utility>
 
 namespace beast {
 

include/xrpl/beast/container/detail/aged_container_iterator.h

@@ -16,15 +16,15 @@ template <bool IsConst, class Iterator>
 class AgedContainerIterator
 {
 public:
-    using iterator_category = std::iterator_traits<Iterator>::iterator_category;
+    using iterator_category = typename std::iterator_traits<Iterator>::iterator_category;
     using value_type = std::conditional_t<
         IsConst,
         typename Iterator::value_type::Stashed::value_type const,
         typename Iterator::value_type::Stashed::value_type>;
-    using difference_type = std::iterator_traits<Iterator>::difference_type;
+    using difference_type = typename std::iterator_traits<Iterator>::difference_type;
     using pointer = value_type*;
     using reference = value_type&;
-    using time_point = Iterator::value_type::Stashed::time_point;
+    using time_point = typename Iterator::value_type::Stashed::time_point;
 
     AgedContainerIterator() = default;