Merge remote-tracking branch 'upstream/mvadari/codify-agents-md' into mvadari/codify-agents-md

- The harness auto-loads every ancestor AGENTS.md (including root), so
  a nested file telling an agent to "see the repo-level AGENTS.md" is
  pure overhead — it can trigger a re-load/duplication-check/discard
  cycle, and some models just retain the duplicate content in context.
  Drop that pointer from every nested AGENTS.md; keep pointers to
  things that are NOT auto-loaded (README.md, docs/consensus.md,
  non-ancestor AGENTS.md like tx/ -> rpc/).
- Root AGENTS.md's Build section is now a short index pointer to
  BUILD.md and docs/build/nix.md instead of restating Nix setup steps,
  per review feedback that AGENTS.md should mostly index other docs
  rather than duplicate them.

Addresses PR review comments:
https://github.com/XRPLF/rippled/pull/8198#discussion_r3979325914
https://github.com/XRPLF/rippled/pull/8198#discussion_r3979424992

.cspell.config.yaml

@@ -386,3 +386,4 @@ words:
   - xxhasher
   - zstdio
   - CGNAT
+  - ungated

.envrc

@@ -1,5 +1,8 @@
 watch_file nix/*.nix
 
+# Pinned Rust toolchain, read by nix/packages.nix via fromRustupToolchainFile.
+watch_file rust-toolchain.toml
+
 # The dev shell derivation includes all of conan/ (see nix/devshell.nix), so any
 # change in there has to invalidate direnv's cached environment.
 watch_dir conan

.github/actions/cargo-cache/action.yml

@@ -0,0 +1,39 @@
+name: Use cargo artifacts cache
+description: >
+  Cache the cargo build artifacts with rust-cache. Never caches ~/.cargo/bin:
+  when saving the cache, rust-cache deletes all binaries that were already
+  present there, which on persistent self-hosted runners wipes the tools
+  installed by prepare-runner. Harmless on ephemeral runners, but kept
+  consistent everywhere.
+
+inputs:
+  workspaces:
+    description: "Workspaces to cache, as 'workspace -> target' lines."
+    required: false
+    default: crates
+  key:
+    description: "Additional part of the cache key."
+    required: false
+    default: ""
+  cache-directories:
+    description: "Additional non-workspace directories to cache."
+    required: false
+    default: ""
+  save-if:
+    description: >
+      Condition for saving the cache after the job. Defaults to save only from develop branch
+    required: false
+    default: ${{ github.ref == 'refs/heads/develop' }}
+
+runs:
+  using: composite
+
+  steps:
+    - name: Use cargo artifacts cache
+      uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      with:
+        cache-bin: "false"
+        cache-directories: ${{ inputs.cache-directories }}
+        key: ${{ inputs.key }}
+        save-if: ${{ inputs.save-if }}
+        workspaces: ${{ inputs.workspaces }}

.github/actions/release-info/action.yml

@@ -7,10 +7,10 @@ outputs:
     value: ${{ steps.version.outputs.version }}
   channel:
     description: "The release channel this build belongs to."
-    value: ${{ steps.channel.outputs.channel }}
+    value: ${{ steps.release_info.outputs.channel }}
   pkg_release:
-    description: "The package release number: 1 for a tag, the run number otherwise."
-    value: ${{ steps.pkg_release.outputs.pkg_release }}
+    description: "The package release number: 1 for a tag, <run number>.<commit date>git<short commit hash> otherwise."
+    value: ${{ steps.release_info.outputs.pkg_release }}
 
 runs:
   using: composite
@@ -39,52 +39,6 @@ runs:
 
         echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
 
-    # Only a tag says how mature a build is: a push is a develop build whatever
-    # its version, and a non-public codebase keeps its packages to itself.
-    - name: Determine release channel
-      id: channel
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        REF_NAME: ${{ github.ref_name }}
-        VISIBILITY: ${{ github.event.repository.visibility }}
-      run: |
-        pre_release=""
-        if [[ "${REF_NAME}" == *-* ]]; then
-            pre_release="${REF_NAME#*-}"
-        fi
-
-        if [[ "${VISIBILITY}" != "public" ]]; then
-            channel=private
-        elif [[ "${IS_TAG}" != "true" ]]; then
-            channel=develop
-        elif [[ -z "${pre_release}" ]]; then
-            channel=stable
-        elif [[ "${pre_release}" =~ ^rc[0-9]+(\+.*)?$ ]]; then
-            channel=unstable
-        elif [[ "${pre_release}" =~ ^b(0|[1-9][0-9]*)(\+.*)?$ ]]; then
-            channel=experimental
-        else
-            echo "Unsupported pre-release in tag '${REF_NAME}'. Use bN or rcN." >&2
-            exit 1
-        fi
-
-        echo "channel=${channel}" | tee -a "${GITHUB_OUTPUT}"
-
-    # A tag is packaged once, so its release number is fixed at 1. Develop builds
-    # repeat the same version, so the run number is what makes each push an
-    # upgrade rather than a reinstall.
-    - name: Determine package release
-      id: pkg_release
-      shell: bash
-      env:
-        IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
-        RUN_NUMBER: ${{ github.run_number }}
-      run: |
-        if [[ "${IS_TAG}" == "true" ]]; then
-            pkg_release=1
-        else
-            pkg_release="${RUN_NUMBER}"
-        fi
-
-        echo "pkg_release=${pkg_release}" | tee -a "${GITHUB_OUTPUT}"
+    - name: Determine release channel and package release
+      id: release_info
+      uses: XRPLF/actions/release-info@7cc0e4a8d9d0b838f92c48d312856b190341bbba

.github/actions/setup-nix-env/action.yml

@@ -40,10 +40,11 @@ runs:
         # Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
         # own trust store, and pinning would break TLS to hosts relying on it.
 
-        # Workspace-local, so `cleanup-workspace` clears it, but not the
-        # `.conan2` prepare-runner hands the system toolchain: that Conan is a
-        # different version, and the two would migrate each other's cache.
-        echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
+        # In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
+        # prepare-runner hands the system toolchain - but under its own name:
+        # that Conan is a different version, and the two would migrate each
+        # other's cache.
+        echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
 
     # Config, profiles and remote, exactly as the dev shell sets them up on
     # entry; the `setup-conan` action is skipped for this toolchain.

.github/dependabot.yml

@@ -4,6 +4,7 @@ updates:
     directories:
       - /
       - .github/actions/build-deps/
+      - .github/actions/cargo-cache/
       - .github/actions/release-info/
       - .github/actions/set-compiler-env/
       - .github/actions/setup-conan/

.github/pull_request_template.md

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
 If there is a relevant task or issue, please link it here.
 -->
 
-### Context of Change
+## Context of Change
 
 <!--
 Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
 If there is a spec or design document for this feature, please link it here.
 -->
 
-### API Impact
+## API Impact
 
 <!--
 Please check [x] relevant options, delete irrelevant ones.

.github/scripts/strategy-matrix/generate.py

@@ -23,6 +23,19 @@ _SANITIZER_SUFFIX: dict[str, str] = {
 }
 
 
+def config_name(
+    distro: str,
+    compiler: str,
+    build_type: str,
+    arch: str,
+    suffix: str = "",
+    sanitizer: str = "",
+) -> str:
+    """Name a config. Its artifacts are named after it, so packaging reuses this."""
+    parts = [s for s in [suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s]
+    return "-".join([f"{distro}-{compiler}-{build_type.lower()}-{arch}", *parts])
+
+
 def get_cmake_args(build_type: str, extra_args: str) -> str:
     """Get the full list of CMake arguments for a config."""
     args = _BASE_CMAKE_ARGS.copy()
@@ -37,17 +50,27 @@ def get_cmake_args(build_type: str, extra_args: str) -> str:
 
 
 # Every config must declare 'minimal'. Minimal configs form the reduced matrix
-# built for pull requests by default; the full matrix adds the rest. Packaging
-# configs declare it too, but packaging is gated in the workflow, not by it.
+# built for pull requests by default; the full matrix adds the rest.
 #
-# Configs may also opt into 'benchmark' to smoke-run the benchmarks. Note that
-# the flag applies to every entry a config expands into, so only set it on
-# configs that expand to a single combination.
+# Configs may also opt into 'benchmark' to smoke-run the benchmarks, or carry a
+# 'package' map to be packaged as well. Note that either applies to every entry
+# a config expands into, so only set them on configs that expand to a single
+# combination.
+
+
+@dataclasses.dataclass
+class PackageConfig:
+    """The 'package' map of a config whose binaries are also packaged."""
+
+    type: str  # "deb" or "rpm"; has to match what the image provides
+    # The packaging container image: a vanilla distro image, not the nix image
+    # the config itself builds in.
+    image: str
 
 
 @dataclasses.dataclass
 class LinuxConfig:
-    """One entry in linux.json's 'configs' or 'package_configs' arrays."""
+    """One entry in a linux.json 'configs' array."""
 
     compiler: list[str]
     build_type: list[str]
@@ -57,7 +80,11 @@ class LinuxConfig:
     sanitizers: list[str] = dataclasses.field(default_factory=list)
     suffix: str = ""
     extra_cmake_args: str = ""
-    image: str = ""  # only used by package_configs entries
+    package: PackageConfig | None = None  # set to also package this config
+
+    def __post_init__(self) -> None:
+        if isinstance(self.package, dict):
+            self.package = PackageConfig(**self.package)
 
 
 @dataclasses.dataclass
@@ -66,22 +93,16 @@ class LinuxFile:
 
     image_tag: str
     configs: dict[str, list[LinuxConfig]]  # distro → configs
-    package_configs: dict[str, list[LinuxConfig]]  # distro → packaging configs
 
     @classmethod
     def load(cls, path: Path) -> "LinuxFile":
         data = json.loads(path.read_text())
-
-        def parse(section: dict) -> dict[str, list[LinuxConfig]]:
-            return {
-                distro: [LinuxConfig(**c) for c in cfgs]
-                for distro, cfgs in section.items()
-            }
-
         return cls(
             image_tag=data["image_tag"],
-            configs=parse(data["configs"]),
-            package_configs=parse(data.get("package_configs", {})),
+            configs={
+                distro: [LinuxConfig(**c) for c in cfgs]
+                for distro, cfgs in data["configs"].items()
+            },
         )
 
 
@@ -156,7 +177,7 @@ class PackagingEntry:
     xrpld_artifact_name: str
     validator_keys_artifact_name: str
     image: str
-    distro: str  # e.g. "debian" or "rhel"; drives package-format-specific steps
+    package_type: str  # "deb" or "rpm"; drives the format-specific steps
 
 
 # ---------------------------------------------------------------------------
@@ -197,13 +218,9 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
                 effective_sanitizers,
                 effective_archs.items(),
             ):
-                name = f"{distro}-{compiler}-{build_type.lower()}-{arch}"
-                suffix_parts = [
-                    s for s in [cfg.suffix, _SANITIZER_SUFFIX.get(sanitizer, "")] if s
-                ]
-                if suffix_parts:
-                    name += "-" + "-".join(suffix_parts)
-
+                name = config_name(
+                    distro, compiler, build_type, arch, cfg.suffix, sanitizer
+                )
                 entries.append(
                     MatrixEntry(
                         config_name=name,
@@ -223,27 +240,33 @@ def expand_linux_matrix(linux: LinuxFile, minimal: bool) -> list[MatrixEntry]:
 
 
 def expand_linux_packaging(linux: LinuxFile) -> list[PackagingEntry]:
-    """Generate the packaging matrix from a LinuxFile's package_configs section.
+    """Generate the packaging matrix from the configs that carry a 'package' map.
 
-    Packaging uses vanilla distro images (debian:bookworm, almalinux:9) instead of
-    the nix-based build images, because deb/rpm tooling (debhelper, rpm-build)
-    is taken from the distro's archive rather than from nixpkgs. Each config
-    entry carries its own 'image'.
+    Packaging consumes the binaries that config's build job uploaded, so the
+    artifact names come from the same config name, and a packaged config is one
+    that passes -Dvalidator_keys=ON.
 
-    The artifact names must match what the build job uploads: one artifact per
-    binary, each named after the build config.
+    Packaging itself runs in vanilla distro images (debian:trixie, almalinux:10)
+    instead of the nix-based build images, because deb/rpm tooling (debhelper,
+    rpm-build) is taken from the distro's archive rather than from nixpkgs.
     """
     entries = []
-    for distro, configs in linux.package_configs.items():
+    for distro, configs in linux.configs.items():
         for cfg in configs:
-            for compiler, build_type in itertools.product(cfg.compiler, cfg.build_type):
-                config_name = f"{distro}-{compiler}-{build_type.lower()}-amd64"
+            if cfg.package is None:
+                continue
+            for compiler, build_type, arch in itertools.product(
+                cfg.compiler, cfg.build_type, cfg.arch
+            ):
+                # The packaging workflow hardcodes an amd64 runner.
+                assert arch == "amd64", f"cannot package {distro} on {arch}"
+                name = config_name(distro, compiler, build_type, arch, cfg.suffix)
                 entries.append(
                     PackagingEntry(
-                        xrpld_artifact_name=f"xrpld-{config_name}",
-                        validator_keys_artifact_name=f"validator-keys-{config_name}",
-                        image=cfg.image,
-                        distro=distro,
+                        xrpld_artifact_name=f"xrpld-{name}",
+                        validator_keys_artifact_name=f"validator-keys-{name}",
+                        image=cfg.package.image,
+                        package_type=cfg.package.type,
                     )
                 )
 

.github/scripts/strategy-matrix/linux.json

@@ -1,5 +1,5 @@
 {
-  "image_tag": "sha-a0074f8",
+  "image_tag": "sha-473fe44",
   "configs": {
     "ubuntu": [
       {
@@ -71,7 +71,11 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
+        "extra_cmake_args": "-Dvalidator_keys=ON",
+        "package": {
+          "type": "deb",
+          "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10"
+        }
       }
     ],
 
@@ -81,28 +85,11 @@
         "build_type": ["Release"],
         "arch": ["amd64"],
         "minimal": false,
-        "extra_cmake_args": "-Dvalidator_keys=ON"
-      }
-    ]
-  },
-  "package_configs": {
-    "debian": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-a6983f8"
-      }
-    ],
-
-    "rhel": [
-      {
-        "compiler": ["gcc"],
-        "build_type": ["Release"],
-        "arch": ["amd64"],
-        "minimal": false,
-        "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-a6983f8"
+        "extra_cmake_args": "-Dvalidator_keys=ON",
+        "package": {
+          "type": "rpm",
+          "image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-49cdc10"
+        }
       }
     ]
   }

.github/workflows/build-nix-images.yml

@@ -12,6 +12,7 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
+      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
@@ -24,6 +25,7 @@ on:
       - "nix/**"
       - "!nix/docker/README.md"
       - "!nix/devshell.nix"
+      - "!nix/check-tools/*.txt"
       - "bin/check-tools.sh"
       - "bin/default-loader-path.sh"
       - "bin/install-sanitizer-libs.sh"
@@ -58,7 +60,7 @@ jobs:
             base_image: debian:bookworm
           - name: rhel
             base_image: registry.access.redhat.com/ubi9/ubi:latest
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
     with:
       image_name: xrpld/nix-${{ matrix.distro.name }}
       dockerfile: nix/docker/Dockerfile

.github/workflows/build-packaging-images.yml

@@ -6,13 +6,13 @@ on:
       - develop
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "package/Dockerfile"
-      - "package/install-packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
+      - "package/docker/**"
   pull_request:
     paths:
       - ".github/workflows/build-packaging-images.yml"
-      - "package/Dockerfile"
-      - "package/install-packaging-tools.sh"
+      - "bin/install-packaging-tools.sh"
+      - "package/docker/**"
   workflow_dispatch:
 
 concurrency:
@@ -33,15 +33,17 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # Newest of each distro: these images only wrap pre-built binaries, so
+        # they set no floor for consumers. build_pkg.py pins the RPM dist tag.
         distro:
           - name: debian
-            base_image: debian:bookworm
-          # AlmaLinux rather than UBI9, which does not ship rpm-sign.
+            base_image: debian:trixie
+          # AlmaLinux rather than UBI, which does not ship rpm-sign.
           - name: rhel
-            base_image: almalinux:9
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+            base_image: almalinux:10
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
     with:
       image_name: xrpld/packaging-${{ matrix.distro.name }}
-      dockerfile: package/Dockerfile
+      dockerfile: package/docker/Dockerfile
       base_image: ${{ matrix.distro.base_image }}
       push: ${{ github.event_name == 'push' }}

.github/workflows/build-pre-commit-image.yml

@@ -30,7 +30,7 @@ jobs:
     permissions:
       contents: read
       packages: write
-    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@9e7e4e80af9e684c116b38369add8eea64451f32
+    uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
     with:
       image_name: xrpld/pre-commit
       dockerfile: bin/pre-commit/Dockerfile

.github/workflows/cargo-audit.yml

@@ -34,7 +34,7 @@ permissions:
 jobs:
   audit:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     permissions:
       contents: read
       # Needed to open an issue on scheduled failures.

.github/workflows/check-tools.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 

.github/workflows/pre-commit.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   # Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
   run-hooks:
-    uses: XRPLF/actions/.github/workflows/pre-commit.yml@3ba08d6ddf114092891d48491fc2e26c3ba15552
+    uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
     with:
       runs_on: ubuntu-latest
-      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-f56b79f" }'
+      container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

.github/workflows/publish-docs.yml

@@ -41,13 +41,13 @@ env:
 jobs:
   build:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -91,4 +91,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deploy
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/reusable-build-test-config.yml

@@ -129,7 +129,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: ${{ inputs.ccache_enabled }}
 
@@ -163,11 +163,10 @@ jobs:
           compiler: ${{ inputs.compiler }}
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: ./.github/actions/cargo-cache
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
           key: ${{ inputs.config_name }}
-          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           # two workspaces here because build artifacts are located in 2 places:
           # - crates/target when cargo is called directly
           # - build/cargo when cargo is called by cmake

.github/workflows/reusable-clang-tidy.yml

@@ -27,14 +27,14 @@ jobs:
   determine-files:
     permissions:
       contents: read
-    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@d041ac9f1fa9f07a4ba335eb4c1c82233fb3fef6
+    uses: XRPLF/actions/.github/workflows/determine-tidy-files.yml@70145243b905dc3e040a61d39c00e178cfb96f71
 
   run-clang-tidy:
     name: Run clang tidy
     needs: [determine-files]
     if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
-    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-a0074f8"
+    container: "ghcr.io/xrplf/xrpld/nix-debian:sha-473fe44"
     permissions:
       contents: read
       issues: write
@@ -43,7 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@51af40f99ea91a08c3528ddf16d98132dcc7e63c
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 
@@ -60,10 +60,9 @@ jobs:
           compiler: ${{ env.COMPILER }}
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: ./.github/actions/cargo-cache
         with:
           cache-directories: ${{ env.BUILD_DIR }}/corrosion
-          save-if: ${{ github.ref == 'refs/heads/develop' || startsWith(github.ref, 'refs/heads/release') }}
           workspaces: crates -> ../${{ env.BUILD_DIR }}/cargo
 
       - name: Setup Conan

.github/workflows/reusable-package.yml

@@ -1,11 +1,14 @@
-# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
+# Build, verify and publish Linux packages from the pre-built xrpld and
+# validator-keys artifacts, in three stages:
 #
-#   - one job per distro, taken from "package_configs" in linux.json
-#   - each job runs in that distro's container, which is what decides DEB or RPM
-#   - with 'publish: true' a job also uploads what it built
-#     (see package/publish_pkg.sh)
+#   - 'package' builds and signs one format per config that carries a "package"
+#     map in linux.json; that map names the container image and the format
+#   - 'test-install' installs what was built on a range of distros and runs the
+#     binaries there, so a package that cannot be installed never reaches Nexus
+#   - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
+#     unless 'publish: true'
 #
-# Only linux/amd64 is supported; the runner is hardcoded in the job below.
+# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
 name: Package
 
 on:
@@ -39,6 +42,7 @@ defaults:
 
 env:
   BUILD_DIR: build
+  PACKAGE_DIR: packages
 
 jobs:
   generate-matrix:
@@ -70,12 +74,17 @@ jobs:
       contents: read
     runs-on: ["self-hosted", "Linux", "X64", "heavy"]
     container: ${{ matrix.image }}
-    timeout-minutes: 30
+    timeout-minutes: 10
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        with:
+          enable_ccache: false
+
       - name: Download pre-built xrpld binary
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -97,33 +106,204 @@ jobs:
 
       - name: Build package
         env:
+          PACKAGE_TYPE: ${{ matrix.package_type }}
           PKG_RELEASE: ${{ steps.release_info.outputs.pkg_release }}
-          PKG_CHANNEL: ${{ steps.release_info.outputs.channel }}
-        run: ./package/build_pkg.sh
+          CHANNEL: ${{ steps.release_info.outputs.channel }}
+        run: |
+          ./package/build_pkg.py \
+              --package-type "${PACKAGE_TYPE}" \
+              --build-dir "${BUILD_DIR}" \
+              --pkg-release "${PKG_RELEASE}" \
+              --channel "${CHANNEL}"
 
-      # Before the upload, so the artifact and the published package are the
-      # same bytes. DEBs are not signed, so the key is never set on that job.
+      # Before the upload, so the artifact, the tested package and the published
+      # package are the same bytes.
       - name: Sign RPM
-        if: ${{ inputs.publish && matrix.distro == 'rhel' }}
+        if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
         env:
           PKG_SIGNING_KEY: ${{ secrets.signing_key }}
-        run: ./package/sign_rpm.sh "${BUILD_DIR}"
+        run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
 
+      # Split from the debug symbols, which are an order of magnitude larger, so
+      # that test-install downloads only what it installs.
       - name: Upload package artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.xrpld_artifact_name }}-pkg
           path: |
-            ${{ env.BUILD_DIR }}/debbuild/*.deb
-            ${{ env.BUILD_DIR }}/debbuild/*.ddeb
-            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
+            ${{ env.BUILD_DIR }}/debbuild/xrpld_*.deb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-[0-9]*.rpm
           if-no-files-found: error
 
+      - name: Upload debug symbol artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
+          path: |
+            ${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.deb
+            ${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.ddeb
+            ${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-debuginfo-*.rpm
+          if-no-files-found: error
+
+  # Every distro family the packages target, oldest release first, so both ends
+  # of the dependency range they declare are exercised.
+  test-install:
+    needs: [package]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - package_type: deb
+            image: debian:11
+          - package_type: deb
+            image: debian:12
+          - package_type: deb
+            image: debian:13
+          - package_type: deb
+            image: ubuntu:20.04
+          - package_type: deb
+            image: ubuntu:22.04
+          - package_type: deb
+            image: ubuntu:24.04
+          - package_type: deb
+            image: ubuntu:26.04
+
+          - package_type: rpm
+            image: almalinux:9
+          - package_type: rpm
+            image: almalinux:10
+          - package_type: rpm
+            image: rockylinux/rockylinux:9
+          - package_type: rpm
+            image: rockylinux/rockylinux:10
+          - package_type: rpm
+            image: registry.access.redhat.com/ubi9/ubi
+          - package_type: rpm
+            image: registry.access.redhat.com/ubi10/ubi
+    name: "install ${{ matrix.package_type }} on ${{ matrix.image }}"
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    container: ${{ matrix.image }}
+    timeout-minutes: 5
+
+    steps:
+      # Both formats land in one directory; the step below picks its own by
+      # extension, so this stays independent of the artifact names.
+      - name: Download package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: "*-pkg"
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
+
+      - name: Find the package
+        id: find
+        env:
+          PACKAGE_TYPE: ${{ matrix.package_type }}
+        run: |
+          package="$(find "${PACKAGE_DIR}" -type f -name "*.${PACKAGE_TYPE}" -print -quit)"
+          test -n "${package}" || {
+              echo "no .${PACKAGE_TYPE} found in ${PACKAGE_DIR}" >&2
+              exit 1
+          }
+          echo "package=${package}" >>"${GITHUB_OUTPUT}"
+
+      # Debian 11 went end-of-life on 2026-08-31
+      # (https://www.debian.org/News/2026/20260831) and its packages are
+      # already partly gone from deb.debian.org, so switch to the
+      # snapshot.debian.org entries the image ships commented out in its
+      # sources.list: they are pinned to the snapshot the image was built
+      # from, so they serve every version it needs and never go away.
+      # Snapshots keep their original, long-passed Valid-Until, hence the
+      # disabled check; the retries absorb snapshot.debian.org's throttling.
+      - name: Switch Debian 11 to snapshot.debian.org
+        if: ${{ matrix.image == 'debian:11' }}
+        run: |
+          sed -i 's|^deb |# deb |; s|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list
+          printf '%s\n' \
+              'Acquire::Check-Valid-Until "false";' \
+              'Acquire::Retries "3";' \
+              >/etc/apt/apt.conf.d/99snapshot
+
+      - name: Install the DEB
+        if: ${{ matrix.package_type == 'deb' }}
+        env:
+          DEBIAN_FRONTEND: noninteractive
+          PACKAGE: ${{ steps.find.outputs.package }}
+        run: |
+          # Stock Debian and Ubuntu images carry no package lists, so apt has
+          # nothing to resolve the systemd dependency from until it fetches them.
+          apt-get update -qq
+          apt-get install -y "./${PACKAGE}"
+
+      - name: Install the RPM
+        if: ${{ matrix.package_type == 'rpm' }}
+        env:
+          PACKAGE: ${{ steps.find.outputs.package }}
+        run: dnf install -y "./${PACKAGE}"
+
+      - name: Run xrpld
+        run: xrpld --version
+
+      - name: Run validator-keys
+        run: validator-keys --version
+
+      - name: Run rippled, the legacy compatibility symlink
+        run: rippled --version
+
+      - name: Check the service account
+        run: id xrpld
+
+      - name: Check the state directory
+        run: test -d /var/lib/xrpld
+
+      - name: Check the log directory
+        run: test -d /var/log/xrpld
+
+  publish:
+    needs: [generate-matrix, package, test-install]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+    name: "publish ${{ matrix.xrpld_artifact_name }}"
+    permissions:
+      contents: read
+    runs-on: ["self-hosted", "Linux", "X64", "heavy"]
+    container: ${{ matrix.image }}
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        with:
+          enable_ccache: false
+
+      # Both artifacts, so the debug symbols are published alongside the package.
+      - name: Download package artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
+          merge-multiple: true
+          path: ${{ env.PACKAGE_DIR }}
+
+      - name: Determine release info
+        id: release_info
+        uses: ./.github/actions/release-info
+
       - name: Publish package
-        if: ${{ inputs.publish }}
         env:
           CHANNEL: ${{ steps.release_info.outputs.channel }}
+          DRY_RUN_OPTION: ${{ !inputs.publish && '--dry-run' || '' }}
           NEXUS_URL: ${{ inputs.nexus_url }}
-          NEXUS_USERNAME: ${{ secrets.remote_username }}
-          NEXUS_PASSWORD: ${{ secrets.remote_password }}
-        run: ./package/publish_pkg.sh "${CHANNEL}" "${BUILD_DIR}"
+          NEXUS_USERNAME: ${{ inputs.publish && secrets.remote_username || '' }}
+          NEXUS_PASSWORD: ${{ inputs.publish && secrets.remote_password || '' }}
+        run: |
+          publish_pkg.py \
+              --channel "${CHANNEL}" \
+              --package-dir "${PACKAGE_DIR}" \
+              --nexus-url "${NEXUS_URL}" \
+              ${DRY_RUN_OPTION}

.github/workflows/reusable-rust.yml

@@ -27,30 +27,26 @@ permissions:
 jobs:
   clippy:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Run clippy
         run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
 
   coverage:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Generate coverage report
         run: cargo llvm-cov nextest --workspace --all-features --locked --no-tests=warn --lcov --output-path lcov.info
@@ -70,15 +66,13 @@ jobs:
 
   doc:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use cargo artifacts cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
-        with:
-          workspaces: crates
+        uses: ./.github/actions/cargo-cache
 
       - name: Build documentation
         env:

.github/workflows/reusable-upload-recipe.yml

@@ -40,7 +40,7 @@ defaults:
 jobs:
   upload:
     runs-on: ubuntu-latest
-    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-a0074f8
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
     env:
       REMOTE_NAME: ${{ inputs.remote_name }}
       CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -49,6 +49,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
+      - name: Prepare runner
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
+        with:
+          enable_ccache: false
+
       - name: Determine release info
         id: release_info
         uses: ./.github/actions/release-info

.github/workflows/upload-conan-deps.yml

@@ -68,7 +68,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare runner
-        uses: XRPLF/actions/prepare-runner@c00c22ada3bd6bcda48fcb0d62fbbab49fec8a0f
+        uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
         with:
           enable_ccache: false
 

.gitignore

@@ -72,11 +72,16 @@ DerivedData
 /.zed/
 
 # AI tools.
+# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
+# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
+# personal/local variants below are ignored.
 /.agent
 /.agents
 /.augment
-/.claude
-/CLAUDE.md
+/.claude/settings.local.json
+AGENTS.override.md
+CLAUDE.local.md
+GEMINI.local.md
 
 # Python
 __pycache__

.pre-commit-config.yaml

@@ -82,11 +82,27 @@ repos:
       - id: prettier
         args: [--end-of-line=auto]
 
+  # Scoped to package/: the rest of the repo's Python has pre-existing findings,
+  # so widening these is its own change.
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: 7c55798a78262d14b2074abf623d8a992ebb70d4 # frozen: v0.16.2
+    hooks:
+      - id: ruff-check
+        args: [--fix]
+        files: ^package/.*\.py$
+
   - repo: https://github.com/psf/black-pre-commit-mirror
     rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
 
+  - repo: https://github.com/pre-commit/mirrors-mypy
+    rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
+    hooks:
+      - id: mypy
+        args: [--strict]
+        files: ^package/.*\.py$
+
   - repo: https://github.com/scop/pre-commit-shfmt
     rev: 05c1426671b9237fb5e1444dd63aa5731bec0dfb # frozen: v3.13.1-1
     hooks:

AGENTS.md

@@ -0,0 +1,36 @@
+# AGENTS.md
+
+This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
+
+## Build
+
+For the build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`). Nix development shells are available in the repo (not required) — see [docs/build/nix.md](./docs/build/nix.md) for setup and variants.
+
+Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
+
+## Testing
+
+Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
+
+- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
+- `--unittest-arg` does nothing — don't use it.
+- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
+- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/` (see [src/test/AGENTS.md](./src/test/AGENTS.md) for conventions specific to that directory). `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
+
+## Lint/Format
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
+
+## Code Style
+
+New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages). New public functions/methods need a Doxygen-style comment.
+
+Comments should explain _why_, not _what_/_how_ — the code already shows that. Only describe what/how when the code itself would otherwise be confusing (a non-obvious workaround, a subtle invariant, a surprising constraint).
+
+## Architecture
+
+See [ARCHITECTURE.md](./ARCHITECTURE.md) for the directory-by-directory map of the codebase.
+
+## Keeping docs current
+
+When you add or change a convention, or touch a subsystem that has its own `AGENTS.md`, `README.md`, or `ARCHITECTURE.md`, update that documentation in the same change rather than leaving it stale.

API-CHANGELOG.md

@@ -22,17 +22,47 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
 
 This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
 
-## Unreleased
+## XRP Ledger server version 3.4.0
 
-This section contains changes targeting a future version.
+Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
 
-### Additions
+### Additions in 3.4.0
 
-- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
-  When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
+- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
+
+### Bugfixes in 3.4.0
+
+- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
+- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
+- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
+- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
+- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
+- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
+- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
+
+## XRP Ledger server version 3.3.0
+
+[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
+
+### Additions in 3.3.0
+
+- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
+
+## XRP Ledger server version 3.2.1
+
+[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.2.0
+
+[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
+
+### Additions in 3.2.0
 
 - `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
-
 - `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
   - `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
   - `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -40,9 +70,8 @@ This section contains changes targeting a future version.
   - `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
   - `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
 
-### Bugfixes
+### Bugfixes in 3.2.0
 
-- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
 - Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
 - `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
 - gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -54,8 +83,24 @@ This section contains changes targeting a future version.
 - `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
 - Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
-- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
-- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
+
+## XRP Ledger server version 3.1.3
+
+[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.1.2
+
+[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
+
+This release contains bug fixes only and no API changes.
+
+## XRP Ledger server version 3.1.1
+
+[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
+
+This release contains bug fixes only and no API changes.
 
 ## XRP Ledger server version 3.1.0
 

ARCHITECTURE.md

@@ -0,0 +1,9 @@
+# Architecture
+
+Paths below reflect the current layout; update this doc if modularization moves a subsystem to a different directory.
+
+- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths — see [src/libxrpl/tx/AGENTS.md](./src/libxrpl/tx/AGENTS.md) for amendment-gating conventions). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`.
+- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
+- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
+- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
+- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CONTRIBUTING.md

@@ -59,6 +59,17 @@ to an existing XLS. Neither change will be released (in an amendment's
 case, marked as `Supported::yes`) until the corresponding XLS's status
 is `Final`.
 
+## AI coding agents
+
+[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
+
+If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
+
+- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
+- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
+
+Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
+
 ## Before making a pull request
 
 (Or marking a draft pull request as ready.)
@@ -82,7 +93,7 @@ If you create new source files, they must be organized as follows:
   under `include/xrpl`, and source (`.cpp`) files must go under
   `src/libxrpl`.
 - All other non-test files must go under `src/xrpld`.
-- All test source files must go under `src/test`.
+- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
 - All benchmark source files must go under `src/benchmarks`.
 
 The source must be formatted according to the style guide below. The easiest

bin/install-packaging-tools.sh

@@ -25,34 +25,38 @@ esac
 # Packaging runs in a vanilla distro image, so the tooling comes from the distro's
 # archive rather than from nixpkgs:
 #
-#   - debhelper and dpkg-dev build the DEB
+#   - debhelper and dpkg-dev build the DEB, and lintian checks it
+#   - binutils gives debian/rules the readelf its glibc-floor check runs; it
+#     already arrives via dpkg-dev, but that tool is called directly
 #   - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
 #     supplying the systemd and find-debuginfo macros the spec uses
-#   - rpm-sign signs the built RPM
-#   - git gives build_pkg.sh a real history to read SOURCE_DATE_EPOCH from;
-#     without one the timestamp falls back to the wall clock
-#   - curl uploads the finished packages in publish_pkg.sh
-#   - ca-certificates lets curl and git verify TLS
+#   - rpm-sign and gnupg2 sign the built RPM
+#   - python3 runs the packaging scripts
+#   - git gives build_pkg.py the commit timestamp it stamps files with
+#   - ca-certificates lets git and the packaging scripts verify TLS
 function install() {
     case "${ID}" in
         debian | ubuntu)
             apt-get update -y
             apt-get install -y --no-install-recommends \
+                binutils \
                 ca-certificates \
-                curl \
                 debhelper \
                 debhelper-compat \
                 dpkg-dev \
-                git
+                git \
+                lintian \
+                python3
             ;;
 
         rhel | centos | rocky | almalinux)
             dnf install -y --setopt=install_weak_deps=False \
-                curl-minimal \
                 git \
+                gnupg2 \
+                python3 \
+                redhat-rpm-config \
                 rpm-build \
                 rpm-sign \
-                redhat-rpm-config \
                 systemd-rpm-macros
             ;;
     esac

cfg/xrpld-example.cfg

@@ -1094,8 +1094,8 @@
 #                           Default is 100.
 #
 #       back_off_milliseconds
-#                           Number of milliseconds to wait between
-#                           online_delete batches to allow other functions
+#                           Number of milliseconds to wait between online_delete
+#                           SQL deletion batches to allow other functions
 #                           to catch up.
 #                           Default is 100.
 #
@@ -1109,10 +1109,22 @@
 #                           The online delete process checks periodically
 #                           that xrpld is still in sync with the network,
 #                           and that the validated ledger is less than
-#                           'age_threshold_seconds' old. If not, then continue
+#                           'age_threshold_seconds' old, and that all
+#                           recent ledgers are available. If not, then continue
 #                           sleeping for this number of seconds and
 #                           checking until healthy.
-#                           Default is 5.
+#                           Default is 2.
+#
+#       max_waiting_ledgers
+#                           The maximum number of ledgers that may be validated
+#                           while online deletion is waiting for the node to get
+#                           fully synced with the rest of the network. If more than
+#                           this number of ledgers are validated while waiting, then
+#                           online deletion gives up on the current ledger and tries
+#                           again later. Note this only affects situations that cause
+#                           rotation to wait, such as going out of sync, or missing
+#                           ledgers. Forward progress is not penalized. Minimum is 64.
+#                           Default is the online_delete value.
 #
 #   Notes:
 #       The 'node_db' entry configures the primary, persistent storage.

cmake/XrplCompiler.cmake

@@ -120,7 +120,10 @@ if(MSVC)
             _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS
             $<$<AND:$<COMPILE_LANGUAGE:CXX>,$<CONFIG:Debug>>:_CRTDBG_MAP_ALLOC>
     )
-    target_link_libraries(common INTERFACE -errorreport:none -machine:X64)
+    target_link_libraries(
+        common
+        INTERFACE -errorreport:none -machine:X64 -ignore:4099
+    )
 else()
     target_compile_options(
         common

cmake/XrplPackaging.cmake

@@ -1,7 +1,7 @@
 #[===================================================================[
    Linux packaging support: 'package' target.
 
-   The packaging script (package/build_pkg.sh) installs to FHS-standard
+   The packaging script (package/build_pkg.py) installs to FHS-standard
    paths (/usr/bin, /etc/xrpld, etc.) regardless of CMAKE_INSTALL_PREFIX,
    so no prefix guard is needed here.
 #]===================================================================]
@@ -38,19 +38,20 @@ if(NOT TARGET validator-keys)
     return()
 endif()
 
-set(package_env
-    SRC_DIR=${CMAKE_SOURCE_DIR}
-    BUILD_DIR=${CMAKE_BINARY_DIR}
-    PKG_RELEASE=${pkg_release}
-)
+if(DPKG_BUILDPACKAGE_EXECUTABLE)
+    set(pkg_type deb)
+else()
+    set(pkg_type rpm)
+endif()
 
 add_custom_target(
     package
     COMMAND
-        ${CMAKE_COMMAND} -E env ${package_env}
-        ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
+        ${CMAKE_SOURCE_DIR}/package/build_pkg.py --package-type=${pkg_type}
+        --build-dir=${CMAKE_BINARY_DIR} --pkg-release=${pkg_release}
+        --channel=UNRELEASED
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
     DEPENDS xrpld validator-keys
-    COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
+    COMMENT "Building Linux ${pkg_type} package"
     VERBATIM
 )

cmake/scripts/codegen/generate_tx_classes.py

@@ -8,6 +8,7 @@ Uses pcpp to preprocess the macro file and pyparsing to parse the DSL.
 
 import io
 import argparse
+import re
 from pathlib import Path
 import pyparsing as pp
 
@@ -53,28 +54,89 @@ def create_transaction_parser():
     return macro_parser
 
 
+# Defaults for xrpl::TxSettings members, mirroring
+# include/xrpl/protocol/TxSettings.h. A transaction's settings blob only names
+# the members that differ from these.
+SETTING_DEFAULTS = {
+    "delegable": "Delegation::NotDelegable",
+    "amendment": "uint256{}",
+    "privileges": "Privilege::NoPriv",
+}
+
+
+def parse_settings(settings_str):
+    """Parse a TxSettings blob into a dict, filling in defaults.
+
+    Args:
+        settings_str: A string like '({.delegable = Delegation::NotDelegable,
+                      .privileges = Privilege::CreateAcct})', or '({})'.
+
+    Returns:
+        A dict with a value for every key in SETTING_DEFAULTS.
+    """
+    body = settings_str.strip()
+    if not (body.startswith("(") and body.endswith(")")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1].strip()
+    if not (body.startswith("{") and body.endswith("}")):
+        raise ValueError(
+            f"Malformed settings blob, expected '({{...}})': {settings_str!r}"
+        )
+    body = body[1:-1]
+
+    # Strip comments, which may be interleaved with the designated initializers.
+    body = re.sub(r"//[^\n]*", "", body)
+
+    settings = dict(SETTING_DEFAULTS)
+    seen = set()
+    # Each entry runs from '.key =' up to the next '.key =' or the end.
+    for key, value in re.findall(
+        r"\.(\w+)\s*=\s*(.*?)(?=,\s*\.\w+\s*=|,?\s*$)", body, re.S
+    ):
+        if key not in SETTING_DEFAULTS:
+            raise ValueError(f"Unknown TxSettings member '.{key}' in {settings_str!r}")
+        settings[key] = " ".join(value.split()).rstrip(",")
+        seen.add(key)
+
+    # Catch a typo'd or unparsed initializer rather than silently defaulting it.
+    # Every '.member' in the blob must have been consumed above.
+    if len(re.findall(r"\.\w+", body)) != len(seen):
+        raise ValueError(f"Could not parse every setting in {settings_str!r}")
+
+    # A blob with content but no designated initializer is positional, which
+    # would otherwise be read as "all defaults" and silently generate the
+    # wrong output.
+    if body.strip() and not seen:
+        raise ValueError(
+            "TxSettings requires designated initializers (.member = value), "
+            f"got {settings_str!r}"
+        )
+
+    return settings
+
+
 def parse_transaction_args(args_list):
     """Parse the arguments of a TRANSACTION macro call.
 
     Args:
         args_list: A list of parsed arguments from pyparsing, e.g.,
-                   ['ttPAYMENT', '0', 'Payment', 'Delegation::delegable',
-                    'uint256{}', 'createAcct', '({...})']
+                   ['ttPAYMENT', '0', 'Payment',
+                    '({.privileges = Privilege::CreateAcct})', '({...})']
 
     Returns:
         A dict with parsed transaction information.
     """
-    if len(args_list) < 7:
+    if len(args_list) < 5:
         raise ValueError(
-            f"Expected at least 7 parts in TRANSACTION, got {len(args_list)}: {args_list}"
+            f"Expected at least 5 parts in TRANSACTION, got {len(args_list)}: {args_list}"
         )
 
     tag = args_list[0]
     value = args_list[1]
     name = args_list[2]
-    delegable = args_list[3]
-    amendments = args_list[4]
-    privileges = args_list[5]
+    settings = parse_settings(args_list[3])
     fields_str = args_list[-1]
 
     # Parse fields: ({field1, field2, ...})
@@ -84,9 +146,9 @@ def parse_transaction_args(args_list):
         "tag": tag,
         "value": value,
         "name": name,
-        "delegable": delegable,
-        "amendments": amendments,
-        "privileges": privileges,
+        "delegable": settings["delegable"],
+        "amendments": settings["amendment"],
+        "privileges": settings["privileges"],
         "fields": fields,
     }
 

crates/Cargo.lock

@@ -57,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "cxx"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6fe442a792c7c736eea18b32a7f8a3b63cf8aafabda6760042dc2fdeda456291"
+checksum = "824894a4a85dca76d4c95c2b9098c036f5a29f627b30c12780774f6654e60974"
 dependencies = [
  "cc",
  "cxx-build",
@@ -72,9 +72,9 @@ dependencies = [
 
 [[package]]
 name = "cxx-build"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3184a94384c663718698311a78a51ac00c484c10b4eeac06fb0a068c5f64fa2"
+checksum = "f1ae0b651ea5b0000b19513aef5a03f194d7e3486f2d9258b658da8677fe9036"
 dependencies = [
  "cc",
  "codespan-reporting",
@@ -87,9 +87,9 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-cmd"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0148d8fd1199329ddf1d157a5e134e51ceff37c6a7ddd38615c399d81cb05d8d"
+checksum = "fb05f91d3fb8435d9bab6ac5ce6ac1868be774325fb7fb2a91be39393b21388e"
 dependencies = [
  "clap",
  "codespan-reporting",
@@ -101,15 +101,15 @@ dependencies = [
 
 [[package]]
 name = "cxxbridge-flags"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52850339faed2eaadd24e286dc1d8268cc6f8a7bd9524d713adc9099566b4c89"
+checksum = "bf293202e0e3e98495785745389e8d0755b217e66f19194a5c695c25e03282ef"
 
 [[package]]
 name = "cxxbridge-macro"
-version = "1.0.198"
+version = "1.0.199"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c77c856545d886c9bd5215409ebb63b925e262135248b50c79e5a5f194ee47c"
+checksum = "ca001d746947c7249ed9d332a10f7a59daedbafeb0ec68c5c18a7db7a93f6ccc"
 dependencies = [
  "indexmap",
  "proc-macro2",

docs/install.md

@@ -13,9 +13,9 @@ To build from source instead, see [BUILD.md](../BUILD.md).
 
 Packages are published to four channels:
 
-- `stable` - the latest production release
-- `unstable` - release candidates
-- `experimental` - beta builds
+- `stable` - production releases
+- `rc` - release candidates
+- `beta` - beta builds
 - `develop` - every push to the [`develop` branch](https://github.com/XRPLF/rippled/tree/develop)
 
 See [Publishing packages](../package/README.md#publishing-packages) for how channels are produced.
@@ -65,7 +65,7 @@ wherever it appears in the repository configuration.
 4.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable focal main" | \
+    echo "deb [signed-by=/etc/apt/keyrings/xrplf.asc] https://packages.xrplf.org/repository/deb-stable any main" | \
         sudo tee /etc/apt/sources.list.d/xrplf.list
     ```
 
@@ -92,19 +92,19 @@ wherever it appears in the repository configuration.
 2.  Add the repository, using the channel you picked in [Release channels](#release-channels):
 
     ```bash
-    cat << REPOFILE | sudo tee /etc/yum.repos.d/xrplf.repo
+    cat << 'REPOFILE' | sudo tee /etc/yum.repos.d/xrplf.repo
     [xrplf-stable]
     name=XRP Ledger Packages
     enabled=1
-    baseurl=https://packages.xrplf.org/repository/rpm-stable/
+    baseurl=https://packages.xrplf.org/repository/rpm-stable/$basearch/
     gpgcheck=1
-    repo_gpgcheck=0
+    repo_gpgcheck=1
     gpgkey=https://packages.xrplf.org/xrplf.asc
     REPOFILE
     ```
 
     `gpgcheck=1` verifies each package against the key above.
-    `repo_gpgcheck` is off because the repository metadata is generated by the server and is not signed.
+    `repo_gpgcheck=1` verifies the repository metadata, which the server signs with the same key.
 
 3.  Install the `xrpld` package:
 

include/xrpl/beast/net/IPAddress.h

@@ -103,7 +103,7 @@ namespace boost {
 template <>
 struct hash<::beast::ip::Address>
 {
-    explicit hash() = default;
+    hash() = default;
 
     std::size_t
     operator()(::beast::ip::Address const& addr) const

include/xrpl/config/Constants.h

@@ -125,6 +125,7 @@ struct Keys
     static constexpr auto kMaximumTxnInLedger = "maximum_txn_in_ledger";
     static constexpr auto kMaximumTxnPerAccount = "maximum_txn_per_account";
     static constexpr auto kMemoryLevel = "memory_level";
+    static constexpr auto kMaxWaitingLedgers = "max_waiting_ledgers";
     static constexpr auto kMinLedgersToComputeSizeLimit = "min_ledgers_to_compute_size_limit";
     static constexpr auto kMinimumEscalationMultiplier = "minimum_escalation_multiplier";
     static constexpr auto kMinimumLastLedgerBuffer = "minimum_last_ledger_buffer";

include/xrpl/consensus/AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md — consensus
+
+See [README.md](./README.md) for a short pointer, and [docs/consensus.md](../../../docs/consensus.md) for the full consensus design.

include/xrpl/consensus/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

include/xrpl/core/HashRouter.h

@@ -34,7 +34,10 @@ enum class HashRouterFlags : std::uint16_t {
     PRIVATE4 = 0x0800,
     // Used in EscrowFinish.cpp
     PRIVATE5 = 0x1000,
-    PRIVATE6 = 0x2000
+    PRIVATE6 = 0x2000,
+    // Used in apply.cpp
+    PRIVATE7 = 0x4000,
+    PRIVATE8 = 0x8000
 };
 
 constexpr HashRouterFlags

include/xrpl/ledger/View.h

@@ -24,6 +24,7 @@
 #include <optional>
 #include <set>
 #include <utility>
+#include <vector>
 
 namespace xrpl {
 
@@ -198,7 +199,10 @@ dirLink(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials passed in to already exist in the ledger, and
+ *      returns an internal error otherwise. Validate them beforehand with
+ *      credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -209,7 +213,8 @@ canWithdraw(
     AccountID const& to,
     SLE::const_ref toSle,
     STAmount const& amount,
-    bool hasDestinationTag);
+    bool hasDestinationTag,
+    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
@@ -222,7 +227,10 @@ canWithdraw(
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials passed in to already exist in the ledger, and
+ *      returns an internal error otherwise. Validate them beforehand with
+ *      credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */
@@ -232,20 +240,25 @@ canWithdraw(
     AccountID const& from,
     AccountID const& to,
     STAmount const& amount,
-    bool hasDestinationTag);
+    bool hasDestinationTag,
+    std::optional<std::vector<uint256>> const& credentialIDs = std::nullopt);
 
 /**
  * Checks that can withdraw funds from an object to itself or a destination.
  *
  * The receiver may be either the submitting account (sfAccount) or a different
- * destination account (sfDestination).
+ * destination account (sfDestination). Credentials, if any, are taken from the
+ * transaction's sfCredentialIDs field.
  *
  *    - Checks that the receiver account exists.
  *    - If the receiver requires a destination tag, check that one exists, even
  *      if withdrawing to self.
  *    - If withdrawing to self, succeed.
  *    - If not, checks if the receiver requires deposit authorization, and if
- *      the sender has it.
+ *      the sender has it (account-based or credential-based).
+ *    - Expects any credentials in sfCredentialIDs to already exist in the
+ *      ledger, and returns an internal error otherwise. Validate them
+ *      beforehand with credentials::valid().
  *    - Checks that the receiver will not exceed the limit (IOU trustline limit
  *      or MPT MaximumAmount).
  */

include/xrpl/ledger/helpers/AccountRootHelpers.h

@@ -15,7 +15,6 @@
 #include <cstdint>
 #include <expected>
 #include <optional>
-#include <set>
 #include <vector>
 
 namespace xrpl {
@@ -353,14 +352,14 @@ pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
  *
  * The list is constructed during initialization and is const after that.
  * Pseudo-account designator fields MUST be maintained by including the
- * SField::sMD_PseudoAccount flag in the SField definition.
+ * SField::kSmdPseudoAccount flag in the SField definition.
  */
 [[nodiscard]] std::vector<SField const*> const&
 getPseudoAccountFields();
 
 /**
- * Returns true if and only if sleAcct is a pseudo-account or specific
- * pseudo-accounts in pseudoFieldFilter.
+ * Returns true if and only if sleAcct is a pseudo-account of any kind
+ * (i.e. carries at least one field flagged with SField::kSmdPseudoAccount).
  *
  * Returns false if sleAcct is:
  * - NOT a pseudo-account OR
@@ -368,18 +367,15 @@ getPseudoAccountFields();
  * - null pointer
  */
 [[nodiscard]] bool
-isPseudoAccount(SLE::const_pointer sleAcct, std::set<SField const*> const& pseudoFieldFilter = {});
+isPseudoAccount(SLE::const_pointer sleAcct);
 
 /**
  * Convenience overload that reads the account from the view.
  */
 [[nodiscard]] inline bool
-isPseudoAccount(
-    ReadView const& view,
-    AccountID const& accountId,
-    std::set<SField const*> const& pseudoFieldFilter = {})
+isPseudoAccount(ReadView const& view, AccountID const& accountId)
 {
-    return isPseudoAccount(view.read(keylet::account(accountId)), pseudoFieldFilter);
+    return isPseudoAccount(view.read(keylet::account(accountId)));
 }
 
 /**

include/xrpl/ledger/helpers/LendingHelpers.h

@@ -324,6 +324,12 @@ computeFullPaymentInterest(
     std::uint32_t startDate,
     TenthBips32 closeInterestRate);
 
+// Returns true if the loan's next payment is late per protocol rules. The
+// boundary is amendment-gated: with fixCleanup3_4_0 the due date must be
+// strictly in the past, otherwise the exact due-date instant counts as late.
+[[nodiscard]] bool
+isPaymentLate(ReadView const& view, SLE::const_ref loanSle);
+
 // Deltas applied to Vault.AssetsTotal and LoanBroker.DebtTotal at a single
 // accounting touch point (origination, payment, impair/unimpair/default).
 struct AccountingDeltas

include/xrpl/ledger/helpers/RippleStateHelpers.h

@@ -239,8 +239,13 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
 //------------------------------------------------------------------------------
 
 /**
- * Any transactors that call addEmptyHolding() in doApply must call
- * canAddHolding() in preflight with the same View and Asset
+ * XRP and the issuer itself are always tesSUCCESS. Otherwise, after
+ * fixCleanup3_4_0, an existing trust line returns tecDUPLICATE without
+ * consulting issuer freeze or DefaultRipple; both still apply on the create
+ * path (DefaultRipple off is terNO_RIPPLE). canAddHolding() ignores existing
+ * holdings, so transactors that may create a holding in doApply should gate
+ * their preclaim call on it: after the amendment only when no holding
+ * exists, before it always.
  */
 [[nodiscard]] TER
 addEmptyHolding(

include/xrpl/ledger/helpers/TokenHelpers.h

@@ -38,6 +38,12 @@ enum class FreezeHandling { IgnoreFreeze, ZeroIfFrozen };
  */
 enum class AuthHandling { IgnoreAuth, ZeroIfUnauthorized };
 
+/**
+ * Controls whether the recipient owner-reserve check is enforced when
+ * auto-creating a trustline or MPToken during AMMWithdraw or AMMClawback.
+ */
+enum class ReserveHandling : bool { EnforceReserve, IgnoreReserve };
+
 /**
  * Controls whether to include the account's full spendable balance
  */
@@ -294,6 +300,14 @@ accountFunds(
     AuthHandling authHandling,
     beast::Journal j);
 
+/**
+ * Returns the transfer fee as Rate based on the type of token
+ * @param view The ledger view
+ * @param asset The asset being transferred
+ */
+[[nodiscard]] Rate
+transferRate(ReadView const& view, Asset const& asset);
+
 /**
  * Returns the transfer fee as Rate based on the type of token
  * @param view The ledger view
@@ -311,6 +325,12 @@ transferRate(ReadView const& view, STAmount const& amount);
 [[nodiscard]] TER
 canAddHolding(ReadView const& view, Asset const& asset);
 
+/**
+ * True if the account already holds this asset (or is the issuer / XRP).
+ */
+[[nodiscard]] bool
+holdingExists(ReadView const& view, AccountID const& account, Asset const& asset);
+
 [[nodiscard]] TER
 addEmptyHolding(
     ApplyViewContext ctx,

include/xrpl/ledger/helpers/VaultHelpers.h

@@ -7,8 +7,10 @@
 #include <xrpl/protocol/Protocol.h>
 #include <xrpl/protocol/STAmount.h>
 #include <xrpl/protocol/STLedgerEntry.h>
+#include <xrpl/protocol/TER.h>
 
 #include <cstdint>
+#include <expected>
 #include <optional>
 
 namespace xrpl {
@@ -43,6 +45,32 @@ assetsToSharesDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount co
 [[nodiscard]] std::optional<STAmount>
 sharesToAssetsDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount const& shares);
 
+/**
+ * Adjusts a requested asset change (`delta`) to match the decimal scale of the
+ * updated total vault assets. This ensures `sfAssetsTotal`, `sfAssetsAvailable`,
+ * and the actual asset transfer change by the exact same representable amount.
+ *
+ * Rounding strategy:
+ * - Debits (withdrawals): Rounds down `|delta|` on the new scale to prevent
+ *   paying out more than requested.
+ * - Credits (deposits): Floors the resulting total asset balance and returns the
+ *   difference from the current total. This prevents crediting the vault with
+ *   more assets than the user deposited.
+ *
+ * Key rules:
+ * - The returned magnitude never exceeds `|delta|`.
+ * - Returns `tecPRECISION_LOSS` if the change is smaller than 1 ULP of the target scale
+ *   (prevents share operations when totals cannot change).
+ * - For integer assets (XRP, MPT), rounding is a no-op.
+ *
+ * @param vault The vault ledger entry.
+ * @param delta The requested signed change to sfAssetsTotal.
+ * @return The rounded, positive magnitude, or `tecPRECISION_LOSS` if the
+ *         change is below representable precision.
+ */
+[[nodiscard]] std::expected<STAmount, TER>
+clampToAssetsTotalScale(SLE::const_ref vault, STAmount const& delta);
+
 /**
  * Controls whether to truncate shares instead of rounding.
  */
@@ -58,33 +86,30 @@ enum class TruncateShares : bool { No = false, Yes = true };
 enum class WaiveUnrealizedLoss : bool { No = false, Yes = true };
 
 /**
- * Returns the effective total of assets backing outstanding shares for the
- * purposes of a withdrawal, i.e. sfAssetsTotal, discounted by sfLossUnrealized
- * unless waived. This is the numerator used by both withdraw conversion
- * helpers (assetsToSharesWithdraw and sharesToAssetsWithdraw) to compute the
- * share/asset exchange rate.
+ * Returns the assets backing outstanding shares for a withdrawal:
+ * sfAssetsTotal minus sfLossUnrealized, or sfAssetsTotal alone when the
+ * unrealized loss is waived. Used by assetsToSharesWithdraw and
+ * sharesToAssetsWithdraw as the numerator of the share/asset exchange rate.
  *
  * @param vault The vault SLE.
- * @param waive Whether to waive (i.e. not subtract) the vault's unrealized
- *              loss.
+ * @param waive Whether to skip subtracting the unrealized loss.
  */
 [[nodiscard]] Number
 assetsTotalForWithdrawal(SLE::const_ref vault, WaiveUnrealizedLoss waive);
 
 /**
- * Returns whether debiting `amount` from `total` — the current value of a
- * vault's sfAssetsTotal or sfAssetsAvailable field — would canonicalize back
- * to the exact same STAmount value it started at. This happens when a
- * genuinely non-zero debit is dust relative to a `total` large enough to
- * exceed STAmount's significant-digit precision: the shares still move, but
- * the stored total doesn't change, which otherwise trips the ValidVault
- * invariant after the fact instead of failing cleanly upfront.
+ * Returns true if debiting `amount` from `total` (the current value of a
+ * vault's sfAssetsTotal or sfAssetsAvailable) would canonicalize to the
+ * same STAmount value. This happens when `amount` is non-zero but too small
+ * to change the stored total at STAmount's precision. Shares would still
+ * move, so the ValidVault invariant would fail after apply; callers use
+ * this to reject the transaction upfront instead.
  *
- * @param asset The vault's underlying asset, used to canonicalize both sides
- *              the same way the ledger will when the field is stored.
+ * @param asset The vault's underlying asset, used to canonicalize both
+ *              sides the same way the ledger will when the field is stored.
  * @param total The field's current value.
- * @param amount The amount to debit. A value of zero always returns false;
- *               that case is rejected separately and unconditionally.
+ * @param amount The amount to debit. Zero always returns false; that case
+ *               is rejected separately.
  */
 [[nodiscard]] bool
 debitIsNonZeroDust(Asset const& asset, Number const& total, Number const& amount);
@@ -238,4 +263,40 @@ getVaultPhase(
     std::optional<std::uint32_t> subscriptionDate,
     std::optional<std::uint32_t> redemptionDate);
 
+/**
+ * Controls whether checkVaultDomain reports an expired credential as an
+ * error. A caller that deletes expired credentials later, in doApply, passes
+ * Yes and treats the subject as authorized; a caller with no such cleanup
+ * step must keep the error.
+ */
+enum class SuppressExpired : bool { No = false, Yes = true };
+
+/**
+ * Checks that subject belongs to the permissioned domain governing a vault's
+ * shares.
+ *
+ * The domain is read from the share issuance rather than from the vault. Vault
+ * shares are issued by the vault's pseudo-account, which cannot grant an
+ * authorization explicitly, so domain membership is the only route to being
+ * authorized: a vault with no domain set has no authorized participants at
+ * all, and every subject fails with tecNO_AUTH.
+ *
+ * Which accounts to check, and whether to check at all, is left to the caller.
+ * This says nothing about vault privacy or about the roles of the accounts.
+ *
+ * @param view The ledger view.
+ * @param issuance The MPTokenIssuance SLE for the vault's shares.
+ * @param subject The account whose domain membership is checked.
+ * @param suppressExpired Whether an expired credential counts as authorized.
+ *
+ * @return tesSUCCESS if the subject is a domain member, otherwise the reason
+ * it is not.
+ */
+[[nodiscard]] TER
+checkVaultDomain(
+    ReadView const& view,
+    SLE::const_ref issuance,
+    AccountID const& subject,
+    SuppressExpired suppressExpired);
+
 }  // namespace xrpl

include/xrpl/nodestore/AGENTS.md

@@ -0,0 +1,3 @@
+# AGENTS.md — nodestore
+
+See [README.md](./README.md) for backend and benchmark design.

include/xrpl/nodestore/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

include/xrpl/protocol/AMMCore.h

@@ -91,6 +91,17 @@ getFee(std::uint16_t tfee)
     return Number{tfee} / kAuctionSlotFeeScaleFactor;
 }
 
+/**
+ * Minimum auction slot price: LPTokens * TradingFee / kAuctionSlotMinFeeFraction
+ * @param lptAMMBalance  AMM LP token balance
+ * @param tradingFee     trading fee in {0, 1000}
+ */
+inline Number
+ammAuctionMinSlotPrice(Number const& lptAMMBalance, std::uint16_t tradingFee)
+{
+    return lptAMMBalance * getFee(tradingFee) / kAuctionSlotMinFeeFraction;
+}
+
 /**
  * Get fee multiplier (1 - tfee)
  * @tfee trading fee in basis points

include/xrpl/protocol/Book.h

@@ -133,7 +133,7 @@ private:
     using id_hash_type = boost::base_from_member<std::hash<xrpl::MPTID>, 0>;
 
 public:
-    explicit hash() = default;
+    hash() = default;
 
     using value_type = std::size_t;
     using argument_type = xrpl::MPTIssue;
@@ -160,7 +160,7 @@ private:
     mptissue_hasher mMptissueHasher_;
 
 public:
-    explicit hash() = default;
+    hash() = default;
 
     value_type
     operator()(argument_type const& asset) const
@@ -227,7 +227,7 @@ struct hash<xrpl::Issue> : std::hash<xrpl::Issue>
 template <>
 struct hash<xrpl::MPTIssue> : std::hash<xrpl::MPTIssue>
 {
-    explicit hash() = default;
+    hash() = default;
 
     using Base = std::hash<xrpl::MPTIssue>;
 };
@@ -235,7 +235,7 @@ struct hash<xrpl::MPTIssue> : std::hash<xrpl::MPTIssue>
 template <>
 struct hash<xrpl::Asset> : std::hash<xrpl::Asset>
 {
-    explicit hash() = default;
+    hash() = default;
 
     using Base = std::hash<xrpl::Asset>;
 };

include/xrpl/protocol/HashPrefix.h

@@ -92,6 +92,26 @@ enum class HashPrefix : std::uint32_t {
      * Batch
      */
     Batch = detail::makeHashPrefix('B', 'C', 'H'),
+
+    /**
+     * inner transaction to sign as the counterparty
+     */
+    CounterpartyTxSign = detail::makeHashPrefix('C', 'P', 'T'),
+
+    /**
+     * inner transaction to multi-sign as the counterparty
+     */
+    CounterpartyTxMultiSign = detail::makeHashPrefix('C', 'P', 'M'),
+
+    /**
+     * inner transaction to sign as the sponsor
+     */
+    SponsorTxSign = detail::makeHashPrefix('S', 'P', 'N'),
+
+    /**
+     * inner transaction to multi-sign as the sponsor
+     */
+    SponsorTxMultiSign = detail::makeHashPrefix('S', 'P', 'M'),
 };
 
 template <class Hasher>

include/xrpl/protocol/MPTAmount.h

@@ -9,6 +9,7 @@
 
 #include <cstdint>
 #include <limits>
+#include <optional>
 #include <ostream>
 #include <stdexcept>
 #include <string>
@@ -174,4 +175,17 @@ mulRatio(MPTAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundU
     return MPTAmount(r.convert_to<MPTAmount::value_type>());
 }
 
+inline std::optional<MPTAmount>
+tryMulRatio(MPTAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundUp)
+{
+    try
+    {
+        return mulRatio(amt, num, den, roundUp);
+    }
+    catch (std::overflow_error const&)
+    {
+        return std::nullopt;
+    }
+}
+
 }  // namespace xrpl

include/xrpl/protocol/MPTIssue.h

@@ -151,7 +151,7 @@ namespace std {
 template <>
 struct hash<xrpl::MPTID> : xrpl::MPTID::hasher
 {
-    explicit hash() = default;
+    hash() = default;
 };
 
 }  // namespace std

include/xrpl/protocol/NFTSyntheticSerializer.h

@@ -1,19 +0,0 @@
-#pragma once
-
-#include <xrpl/json/json_forwards.h>
-#include <xrpl/protocol/STTx.h>
-#include <xrpl/protocol/TxMeta.h>
-
-#include <memory>
-
-namespace xrpl::rpc {
-
-/**
- * Adds common synthetic fields to transaction-related JSON responses
- */
-/** @{ */
-void
-insertNFTSyntheticInJson(json::Value&, std::shared_ptr<STTx const> const&, TxMeta const&);
-/** @} */
-
-}  // namespace xrpl::rpc

include/xrpl/protocol/Permissions.h

@@ -4,6 +4,7 @@
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SOTemplate.h>
 #include <xrpl/protocol/TxFormats.h>
+#include <xrpl/protocol/TxSettings.h>
 
 #include <cstdint>
 #include <functional>
@@ -38,11 +39,6 @@ enum GranularPermissionType : std::uint32_t {
 #pragma pop_macro("GRANULAR_PERMISSION")
 };
 
-// Injected bare enumerators (xrpl::delegable / xrpl::notDelegable) are required by preprocessor
-// tricks in tests and macro-generated code; enum class would break that.
-// NOLINTNEXTLINE(cppcoreguidelines-use-enum-class)
-enum Delegation { Delegable, NotDelegable };
-
 class Permission
 {
 private:
@@ -65,7 +61,7 @@ private:
     struct TxDelegationEntry
     {
         uint256 amendment;
-        Delegation delegable{NotDelegable};
+        Delegation delegable{Delegation::NotDelegable};
     };
 
     std::unordered_set<TxType> granularTxTypes_;

include/xrpl/protocol/Protocol.h

@@ -12,6 +12,7 @@
 #include <chrono>
 #include <cstddef>
 #include <cstdint>
+#include <limits>
 
 namespace xrpl {
 
@@ -348,13 +349,24 @@ enum class VaultPhase : std::uint8_t {
     Redemption,
 };
 
+/**
+ * Minimum gap between a closed-ended loan's final scheduled payment and the
+ * vault's RedemptionDate. LoanSet rejects a schedule whose final payment is
+ * fewer than this many seconds before RedemptionDate.
+ */
+constexpr std::uint32_t kLoanRedemptionBuffer = std::chrono::seconds{60}.count();
+
 /**
  * Bounds on the length of a closed-ended vault's Investment phase
  * (RedemptionDate - SubscriptionDate). At vault creation the gap must satisfy
  * kMinInvestmentPeriod <= gap < kMaxInvestmentPeriod.
+ *
+ * 180s is enough to originate a loan that uses the minimum payment interval
+ * and kLoanRedemptionBuffer after StartDate, which is strictly after
+ * SubscriptionDate. The interval and buffer need not be equal; only their
+ * sum plus one second must fit in this floor.
  */
-constexpr std::uint32_t kMinInvestmentPeriod =
-    std::chrono::seconds{std::chrono::minutes{1}}.count();
+constexpr std::uint32_t kMinInvestmentPeriod = std::chrono::seconds{180}.count();
 // This is 946708560 seconds which 30 x 365.2425 days (the average length of a Gregorian year).
 constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono::years{30}}.count();
 
@@ -533,6 +545,11 @@ constexpr std::size_t kEcClawbackProofLength = SECP256K1_COMPACT_CLAWBACK_PROOF_
  */
 constexpr std::uint32_t kConfidentialFeeMultiplier = 9;
 
+/**
+ * Maximum value a confidential MPT key epoch may reach.
+ */
+constexpr std::uint32_t kMaxKeyEpoch = std::numeric_limits<std::uint32_t>::max();
+
 /**
  * Compressed EC point prefix for even y-coordinate
  */

include/xrpl/protocol/STLedgerEntry.h

@@ -19,7 +19,7 @@ namespace xrpl {
 
 class Rules;
 namespace test {
-class Invariants_test;
+class InvariantsMisc_test;
 }  // namespace test
 
 class STLedgerEntry final : public STObject, public CountedObject<STLedgerEntry>
@@ -83,8 +83,8 @@ private:
     void
     setSLEType();
 
-    friend test::Invariants_test;  // this test wants access to the private
-                                   // type_
+    friend test::InvariantsMisc_test;  // this test wants access to the
+                                       // private type_
 
     STBase*
     copy(std::size_t n, void* buf) const override;

include/xrpl/protocol/STTx.h

@@ -5,6 +5,7 @@
 #include <xrpl/basics/base_uint.h>
 #include <xrpl/json/json_value.h>
 #include <xrpl/protocol/AccountID.h>
+#include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/PublicKey.h>
 #include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
@@ -13,6 +14,7 @@
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/SeqProxy.h>
 #include <xrpl/protocol/Serializer.h>
+#include <xrpl/protocol/Sign.h>
 #include <xrpl/protocol/TxFormats.h>
 
 #include <boost/container/flat_set.hpp>
@@ -105,14 +107,36 @@ public:
     [[nodiscard]] json::Value
     getJson(JsonOptions options, bool binary) const;
 
+    /**
+     * Sign the transaction as its account.
+     *
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     */
+    void
+    sign(PublicKey const& publicKey, SecretKey const& secretKey);
+
+    /**
+     * Sign the transaction in one of its signature fields.
+     *
+     * The signature is bound to the role that made it, so it cannot be moved
+     * into another role.
+     *
+     * @param publicKey The public key for signing.
+     * @param secretKey The secret key for signing.
+     * @param role The role signing the transaction.
+     * @param rules The current ledger rules.
+     */
     void
     sign(
         PublicKey const& publicKey,
         SecretKey const& secretKey,
-        std::optional<std::reference_wrapper<SField const>> signatureTarget = {});
+        SignatureRole role,
+        Rules const& rules);
 
     /**
      * Check the signature.
+     *
      * @param rules The current ledger rules.
      * @return `true` if valid signature. If invalid, the error message string.
      */
@@ -120,7 +144,7 @@ public:
     checkSign(Rules const& rules) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkBatchSign(Rules const& rules) const;
+    checkBatchSign() const;
 
     // SQL Functions with metadata.
     static std::string const&
@@ -162,28 +186,28 @@ public:
 private:
     /**
      * Check the signature.
+     *
      * @param rules The current ledger rules.
      * @param sigObject Reference to object that contains the signature fields.
      *     Will be *this more often than not.
+     * @param role The role that made the signature in sigObject. Determines
+     *     the signing prefix, which binds the signature to that role.
      * @return `true` if valid signature. If invalid, the error message string.
      */
     [[nodiscard]] std::expected<void, std::string>
-    checkSign(Rules const& rules, STObject const& sigObject) const;
+    checkSign(Rules const& rules, STObject const& sigObject, SignatureRole role) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkSingleSign(STObject const& sigObject) const;
+    checkSingleSign(STObject const& sigObject, HashPrefix prefix) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkMultiSign(Rules const& rules, STObject const& sigObject) const;
+    checkMultiSign(STObject const& sigObject, HashPrefix prefix) const;
 
     [[nodiscard]] std::expected<void, std::string>
     checkBatchSingleSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
 
     [[nodiscard]] std::expected<void, std::string>
-    checkBatchMultiSign(
-        STObject const& batchSigner,
-        Rules const& rules,
-        std::vector<uint256> const& txIds) const;
+    checkBatchMultiSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
 
     void
     buildBatchTxns();

include/xrpl/protocol/Sign.h

@@ -4,13 +4,65 @@
 #include <xrpl/protocol/HashPrefix.h>
 #include <xrpl/protocol/KeyType.h>
 #include <xrpl/protocol/PublicKey.h>
+#include <xrpl/protocol/Rules.h>
 #include <xrpl/protocol/SField.h>
 #include <xrpl/protocol/STObject.h>
 #include <xrpl/protocol/SecretKey.h>
 #include <xrpl/protocol/Serializer.h>
 
+#include <optional>
+
 namespace xrpl {
 
+/**
+ * The signature slots on a transaction.
+ *
+ * Each role signs different bytes, so a signature cannot be moved from the
+ * role that made it into another role. See signingPrefix.
+ */
+enum class SignatureRole {
+    /**
+     * The transaction's own signature, in sfTxnSignature or sfSigners.
+     */
+    Transaction,
+    /**
+     * The counterparty's signature, in sfCounterpartySignature.
+     */
+    Counterparty,
+    /**
+     * The sponsor's signature, in sfSponsorSignature.
+     */
+    Sponsor
+};
+
+/**
+ * The field that holds this role's signature.
+ *
+ * @return The signature field, or nullptr for SignatureRole::Transaction,
+ * whose signature lives at the top level of the transaction.
+ */
+[[nodiscard]] SField const*
+signatureField(SignatureRole role);
+
+/**
+ * The role that signs into the given field.
+ *
+ * @return The role, or an unseated optional if the field does not hold a
+ * transaction signature.
+ */
+[[nodiscard]] std::optional<SignatureRole>
+signatureRole(SField const& sigField);
+
+/**
+ * The hash prefix that binds a transaction signature to the role that made it.
+ *
+ * @param role The role making the signature.
+ * @param multiSigning Whether the signature is a multi-signature.
+ * @param rules The current ledger rules.
+ */
+[[nodiscard]] HashPrefix
+signingPrefix(SignatureRole role, bool multiSigning, Rules const& rules);
+
 /**
  * Sign an STObject
  *
@@ -49,9 +101,12 @@ verify(
 
 /**
  * Return a Serializer suitable for computing a multisigning TxnSignature.
+ *
+ * @param prefix Prefix to insert before the serialized object. Get it from
+ * signingPrefix, so that the signature is bound to the role making it.
  */
 Serializer
-buildMultiSigningData(STObject const& obj, AccountID const& signingID);
+buildMultiSigningData(STObject const& obj, AccountID const& signingID, HashPrefix prefix);
 
 /**
  * Break the multi-signing hash computation into 2 parts for optimization.
@@ -67,7 +122,7 @@ buildMultiSigningData(STObject const& obj, AccountID const& signingID);
  *     signer's unique data.
  */
 Serializer
-startMultiSigningData(STObject const& obj);
+startMultiSigningData(STObject const& obj, HashPrefix prefix);
 
 inline void
 finishMultiSigningData(AccountID const& signingID, Serializer& s)

include/xrpl/protocol/TxSettings.h

@@ -0,0 +1,96 @@
+#pragma once
+
+#include <xrpl/basics/base_uint.h>
+#include <xrpl/basics/safe_cast.h>
+
+#include <cstdint>
+#include <type_traits>
+
+namespace xrpl {
+
+enum class Delegation { Delegable, NotDelegable };
+
+/**
+ * Operations a transaction is permitted to perform, as a bitfield.
+ *
+ * These are declared per-transaction in transactions.macro (via
+ * TxSettings::privileges) and enforced in InvariantCheck.cpp.
+ */
+enum class Privilege : std::uint16_t {
+    NoPriv = 0x0000,              // The transaction can not do any of the enumerated operations
+    CreateAcct = 0x0001,          // The transaction can create a new ACCOUNT_ROOT object.
+    CreatePseudoAcct = 0x0002,    // The transaction can create a pseudo account,
+                                  // which implies createAcct
+    MustDeleteAcct = 0x0004,      // The transaction must delete an ACCOUNT_ROOT object
+    MayDeleteAcct = 0x0008,       // The transaction may delete an ACCOUNT_ROOT
+                                  // object, but does not have to
+    OverrideFreeze = 0x0010,      // The transaction can override some freeze rules
+    ChangeNftCounts = 0x0020,     // The transaction can mint or burn an NFT
+    CreateMptIssuance = 0x0040,   // The transaction can create a new MPT issuance
+    DestroyMptIssuance = 0x0080,  // The transaction can destroy an MPT issuance
+    MustAuthorizeMpt = 0x0100,    // The transaction MUST create or delete an MPT
+                                  // object (except by issuer)
+    MayAuthorizeMpt = 0x0200,     // The transaction MAY create or delete an MPT
+                                  // object (except by issuer)
+    MayDeleteMpt = 0x0400,        // The transaction MAY delete an MPT object. May not create.
+    MustModifyVault = 0x0800,     // The transaction must modify, delete or create, a vault
+    MayModifyVault = 0x1000,      // The transaction MAY modify, delete or create, a vault
+    MayCreateMpt = 0x2000,        // The transaction MAY create an MPT object, except for issuer.
+};
+
+// The inner static_cast is not redundant: the underlying type is narrower than
+// `int`, so the operands integer-promote and the result has to be narrowed back.
+// safeCast rejects that narrowing, but every input bit is a Privilege bit by
+// construction, so the result is always representable.
+constexpr Privilege
+operator|(Privilege lhs, Privilege rhs)
+{
+    using Underlying = std::underlying_type_t<Privilege>;
+    return static_cast<Privilege>(
+        static_cast<Underlying>(safeCast<Underlying>(lhs) | safeCast<Underlying>(rhs)));
+}
+
+constexpr Privilege
+operator&(Privilege lhs, Privilege rhs)
+{
+    using Underlying = std::underlying_type_t<Privilege>;
+    return static_cast<Privilege>(
+        static_cast<Underlying>(safeCast<Underlying>(lhs) & safeCast<Underlying>(rhs)));
+}
+
+/**
+ * Per-transaction metadata declared in transactions.macro.
+ *
+ * Every member has a default, so a transaction only needs to name the settings
+ * that differ from the common case. See the documentation at the top of
+ * transactions.macro for the authoring syntax.
+ *
+ * This is deliberately not a constexpr-friendly type: amendment identifiers are
+ * runtime-initialized `extern uint256 const` globals (see Feature.h), so a
+ * TxSettings can only be built at runtime.
+ */
+struct TxSettings
+{
+    /**
+     * Whether an account may delegate this transaction to another account.
+     */
+    Delegation delegable{Delegation::NotDelegable};
+
+    /**
+     * The amendment gating this transaction, or uint256{} if always available.
+     */
+    // The `{}` looks redundant, because BaseUInt's default constructor already
+    // zeroes the value. It is not: without a default member initializer here,
+    // every partial designated initializer in transactions.macro trips the
+    // missing-designated-field-initializers warning, which the build treats as
+    // an error.
+    // NOLINTNEXTLINE(readability-redundant-member-init)
+    uint256 amendment{};
+
+    /**
+     * Operations this transaction is permitted to perform.
+     */
+    Privilege privileges{Privilege::NoPriv};
+};
+
+}  // namespace xrpl

include/xrpl/protocol/detail/features.macro

@@ -15,10 +15,13 @@
 // Add new amendments to the top of this list.
 // Keep it sorted in reverse chronological order.
 
+XRPL_FEATURE(LendingProtocolV1_2,         Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FIX    (Cleanup3_5_0,                Supported::Yes, VoteBehavior::DefaultNo)
+XRPL_FEATURE(ConfidentialMPTKeyRotation,  Supported::No,  VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_4_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(Sponsor,                     Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FEATURE(BatchV1_1,                   Supported::Yes, VoteBehavior::DefaultNo)
-XRPL_FEATURE(LendingProtocolV1_1,         Supported::No,  VoteBehavior::DefaultNo)
+XRPL_FEATURE(LendingProtocolV1_1,         Supported::Yes,  VoteBehavior::DefaultNo)
 XRPL_FEATURE(ConfidentialTransfer,        Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_3_0,                Supported::Yes, VoteBehavior::DefaultNo)
 XRPL_FIX    (Cleanup3_2_0,                Supported::Yes, VoteBehavior::DefaultNo)

include/xrpl/protocol/detail/ledger_entries.macro

@@ -408,6 +408,8 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
     {sfReferenceHolding,         SoeOptional},
     {sfIssuerEncryptionKey,      SoeOptional},
     {sfAuditorEncryptionKey,     SoeOptional},
+    {sfIssuerKeyEpoch,           SoeOptional},
+    {sfAuditorKeyEpoch,          SoeOptional},
     {sfConfidentialOutstandingAmount, SoeDefault},
 }))
 

include/xrpl/protocol/detail/sfields.macro

@@ -119,6 +119,10 @@ TYPED_SFIELD(sfRemainingOwnerCount,      UINT32,    73)
 TYPED_SFIELD(sfSponsorFlags,             UINT32,    74)
 TYPED_SFIELD(sfSubscriptionDate,         UINT32,    75)
 TYPED_SFIELD(sfRedemptionDate,           UINT32,    76)
+TYPED_SFIELD(sfIssuerKeyEpoch,           UINT32,    77)
+TYPED_SFIELD(sfAuditorKeyEpoch,          UINT32,    78)
+TYPED_SFIELD(sfIssuerKeyMirrorEpoch,     UINT32,    79)
+TYPED_SFIELD(sfAuditorKeyMirrorEpoch,    UINT32,    80)
 
 // 64-bit integers (common)
 TYPED_SFIELD(sfIndexNext,                UINT64,     1)

include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h

@@ -351,6 +351,54 @@ public:
         return this->sle_->isFieldPresent(sfAuditorEncryptionKey);
     }
 
+    /**
+     * @brief Get sfIssuerKeyEpoch (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getIssuerKeyEpoch() const
+    {
+        if (hasIssuerKeyEpoch())
+            return this->sle_->at(sfIssuerKeyEpoch);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfIssuerKeyEpoch is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasIssuerKeyEpoch() const
+    {
+        return this->sle_->isFieldPresent(sfIssuerKeyEpoch);
+    }
+
+    /**
+     * @brief Get sfAuditorKeyEpoch (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_UINT32::type::value_type>
+    getAuditorKeyEpoch() const
+    {
+        if (hasAuditorKeyEpoch())
+            return this->sle_->at(sfAuditorKeyEpoch);
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfAuditorKeyEpoch is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasAuditorKeyEpoch() const
+    {
+        return this->sle_->isFieldPresent(sfAuditorKeyEpoch);
+    }
+
     /**
      * @brief Get sfConfidentialOutstandingAmount (SoeDefault)
      * @return The field value, or std::nullopt if not present.
@@ -600,6 +648,28 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfIssuerKeyEpoch (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setIssuerKeyEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfIssuerKeyEpoch] = value;
+        return *this;
+    }
+
+    /**
+     * @brief Set sfAuditorKeyEpoch (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    MPTokenIssuanceBuilder&
+    setAuditorKeyEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
+    {
+        object_[sfAuditorKeyEpoch] = value;
+        return *this;
+    }
+
     /**
      * @brief Set sfConfidentialOutstandingAmount (SoeDefault)
      * @return Reference to this builder for method chaining.

include/xrpl/protocol_autogen/transactions/AMMBid.h

@@ -21,7 +21,7 @@ class AMMBidBuilder;
  * Type: ttAMM_BID (39)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMBidBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMClawback.h

@@ -21,7 +21,7 @@ class AMMClawbackBuilder;
  * Type: ttAMM_CLAWBACK (31)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMMClawback
- * Privileges: MayDeleteAcct | OverrideFreeze | MayAuthorizeMpt
+ * Privileges: Privilege::MayDeleteAcct | Privilege::OverrideFreeze | Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMCreate.h

@@ -21,7 +21,7 @@ class AMMCreateBuilder;
  * Type: ttAMM_CREATE (35)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: CreatePseudoAcct | MayCreateMpt
+ * Privileges: Privilege::CreatePseudoAcct | Privilege::MayCreateMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMDelete.h

@@ -21,7 +21,7 @@ class AMMDeleteBuilder;
  * Type: ttAMM_DELETE (40)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: MustDeleteAcct | MayDeleteMpt
+ * Privileges: Privilege::MustDeleteAcct | Privilege::MayDeleteMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMDeposit.h

@@ -21,7 +21,7 @@ class AMMDepositBuilder;
  * Type: ttAMM_DEPOSIT (36)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMDepositBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMVote.h

@@ -21,7 +21,7 @@ class AMMVoteBuilder;
  * Type: ttAMM_VOTE (38)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMVoteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AMMWithdraw.h

@@ -21,7 +21,7 @@ class AMMWithdrawBuilder;
  * Type: ttAMM_WITHDRAW (37)
  * Delegable: Delegation::Delegable
  * Amendment: featureAMM
- * Privileges: MayDeleteAcct | MayAuthorizeMpt
+ * Privileges: Privilege::MayDeleteAcct | Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AMMWithdrawBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AccountDelete.h

@@ -21,7 +21,7 @@ class AccountDeleteBuilder;
  * Type: ttACCOUNT_DELETE (21)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: MustDeleteAcct
+ * Privileges: Privilege::MustDeleteAcct
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AccountDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/AccountSet.h

@@ -21,7 +21,7 @@ class AccountSetBuilder;
  * Type: ttACCOUNT_SET (3)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use AccountSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/Batch.h

@@ -21,7 +21,7 @@ class BatchBuilder;
  * Type: ttBATCH (71)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureBatchV1_1
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use BatchBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CheckCancel.h

@@ -21,7 +21,7 @@ class CheckCancelBuilder;
  * Type: ttCHECK_CANCEL (18)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CheckCancelBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CheckCash.h

@@ -21,7 +21,7 @@ class CheckCashBuilder;
  * Type: ttCHECK_CASH (17)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: MayCreateMpt
+ * Privileges: Privilege::MayCreateMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CheckCashBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CheckCreate.h

@@ -21,7 +21,7 @@ class CheckCreateBuilder;
  * Type: ttCHECK_CREATE (16)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CheckCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/Clawback.h

@@ -21,7 +21,7 @@ class ClawbackBuilder;
  * Type: ttCLAWBACK (30)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTClawback.h

@@ -21,7 +21,7 @@ class ConfidentialMPTClawbackBuilder;
  * Type: ttCONFIDENTIAL_MPT_CLAWBACK (89)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvert.h

@@ -21,7 +21,7 @@ class ConfidentialMPTConvertBuilder;
  * Type: ttCONFIDENTIAL_MPT_CONVERT (85)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTConvertBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTConvertBack.h

@@ -21,7 +21,7 @@ class ConfidentialMPTConvertBackBuilder;
  * Type: ttCONFIDENTIAL_MPT_CONVERT_BACK (87)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTConvertBackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTMergeInbox.h

@@ -21,7 +21,7 @@ class ConfidentialMPTMergeInboxBuilder;
  * Type: ttCONFIDENTIAL_MPT_MERGE_INBOX (86)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTMergeInboxBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/ConfidentialMPTSend.h

@@ -21,7 +21,7 @@ class ConfidentialMPTSendBuilder;
  * Type: ttCONFIDENTIAL_MPT_SEND (88)
  * Delegable: Delegation::Delegable
  * Amendment: featureConfidentialTransfer
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use ConfidentialMPTSendBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CredentialAccept.h

@@ -21,7 +21,7 @@ class CredentialAcceptBuilder;
  * Type: ttCREDENTIAL_ACCEPT (59)
  * Delegable: Delegation::Delegable
  * Amendment: featureCredentials
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CredentialAcceptBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CredentialCreate.h

@@ -21,7 +21,7 @@ class CredentialCreateBuilder;
  * Type: ttCREDENTIAL_CREATE (58)
  * Delegable: Delegation::Delegable
  * Amendment: featureCredentials
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CredentialCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/CredentialDelete.h

@@ -21,7 +21,7 @@ class CredentialDeleteBuilder;
  * Type: ttCREDENTIAL_DELETE (60)
  * Delegable: Delegation::Delegable
  * Amendment: featureCredentials
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use CredentialDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DIDDelete.h

@@ -21,7 +21,7 @@ class DIDDeleteBuilder;
  * Type: ttDID_DELETE (50)
  * Delegable: Delegation::Delegable
  * Amendment: featureDID
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DIDDeleteBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DIDSet.h

@@ -21,7 +21,7 @@ class DIDSetBuilder;
  * Type: ttDID_SET (49)
  * Delegable: Delegation::Delegable
  * Amendment: featureDID
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DIDSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DelegateSet.h

@@ -21,7 +21,7 @@ class DelegateSetBuilder;
  * Type: ttDELEGATE_SET (64)
  * Delegable: Delegation::NotDelegable
  * Amendment: featurePermissionDelegationV1_1
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DelegateSetBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/DepositPreauth.h

@@ -21,7 +21,7 @@ class DepositPreauthBuilder;
  * Type: ttDEPOSIT_PREAUTH (19)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use DepositPreauthBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EnableAmendment.h

@@ -21,7 +21,7 @@ class EnableAmendmentBuilder;
  * Type: ttAMENDMENT (100)
  * Delegable: Delegation::NotDelegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EnableAmendmentBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EscrowCancel.h

@@ -21,7 +21,7 @@ class EscrowCancelBuilder;
  * Type: ttESCROW_CANCEL (4)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EscrowCancelBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EscrowCreate.h

@@ -21,7 +21,7 @@ class EscrowCreateBuilder;
  * Type: ttESCROW_CREATE (1)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EscrowCreateBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/EscrowFinish.h

@@ -21,7 +21,7 @@ class EscrowFinishBuilder;
  * Type: ttESCROW_FINISH (2)
  * Delegable: Delegation::Delegable
  * Amendment: uint256{}
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use EscrowFinishBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LedgerStateFix.h

@@ -21,7 +21,7 @@ class LedgerStateFixBuilder;
  * Type: ttLEDGER_STATE_FIX (53)
  * Delegable: Delegation::Delegable
  * Amendment: fixNFTokenPageLinks
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LedgerStateFixBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerCoverClawback.h

@@ -21,7 +21,7 @@ class LoanBrokerCoverClawbackBuilder;
  * Type: ttLOAN_BROKER_COVER_CLAWBACK (78)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerCoverClawbackBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerCoverDeposit.h

@@ -21,7 +21,7 @@ class LoanBrokerCoverDepositBuilder;
  * Type: ttLOAN_BROKER_COVER_DEPOSIT (76)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: NoPriv
+ * Privileges: Privilege::NoPriv
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerCoverDepositBuilder to construct new transactions.

include/xrpl/protocol_autogen/transactions/LoanBrokerCoverWithdraw.h

@@ -21,7 +21,7 @@ class LoanBrokerCoverWithdrawBuilder;
  * Type: ttLOAN_BROKER_COVER_WITHDRAW (77)
  * Delegable: Delegation::NotDelegable
  * Amendment: featureLendingProtocol
- * Privileges: MayAuthorizeMpt
+ * Privileges: Privilege::MayAuthorizeMpt
  *
  * Immutable wrapper around STTx providing type-safe field access.
  * Use LoanBrokerCoverWithdrawBuilder to construct new transactions.
@@ -121,6 +121,32 @@ public:
     {
         return this->tx_->isFieldPresent(sfDestinationTag);
     }
+
+    /**
+     * @brief Get sfCredentialIDs (SoeOptional)
+     * @return The field value, or std::nullopt if not present.
+     */
+    [[nodiscard]]
+    protocol_autogen::Optional<SF_VECTOR256::type::value_type>
+    getCredentialIDs() const
+    {
+        if (hasCredentialIDs())
+        {
+            return this->tx_->at(sfCredentialIDs);
+        }
+        return std::nullopt;
+    }
+
+    /**
+     * @brief Check if sfCredentialIDs is present.
+     * @return True if the field is present, false otherwise.
+     */
+    [[nodiscard]]
+    bool
+    hasCredentialIDs() const
+    {
+        return this->tx_->isFieldPresent(sfCredentialIDs);
+    }
 };
 
 /**
@@ -214,6 +240,17 @@ public:
         return *this;
     }
 
+    /**
+     * @brief Set sfCredentialIDs (SoeOptional)
+     * @return Reference to this builder for method chaining.
+     */
+    LoanBrokerCoverWithdrawBuilder&
+    setCredentialIDs(std::decay_t<typename SF_VECTOR256::type::value_type> const& value)
+    {
+        object_[sfCredentialIDs] = value;
+        return *this;
+    }
+
     /**
      * @brief Build and return the LoanBrokerCoverWithdraw wrapper.
      * @param publicKey The public key for signing.