feat: Bark

.github/workflows/bark-images.yml

@@ -0,0 +1,66 @@
+name: Bark native candidate images
+
+on:
+  workflow_call:
+    inputs:
+      architecture:
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      architecture:
+        description: Native builder architecture (no emulation)
+        type: choice
+        required: true
+        default: amd64
+        options: [amd64, arm64]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: bark-images-${{ github.ref }}-${{ inputs.architecture }}
+  cancel-in-progress: false
+
+jobs:
+  build:
+    name: ${{ matrix.selection }} (${{ inputs.architecture }})
+    runs-on: ${{ inputs.architecture == 'arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        selection:
+          - cdk-bark-processor@0.1.0-fe468ca
+          - bark-server@0.7.0-6188e2d
+          - cln-hold@26.06.7-hold.0.3.3
+    env:
+      CARGO_BUILD_JOBS: '2'
+      CARGO_INCREMENTAL: '0'
+      PLATFORM: linux/${{ inputs.architecture }}
+      SELECTION: ${{ matrix.selection }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Build the exact recipe on its native platform
+        run: bash scripts/bark-image-build.sh "$SELECTION" "$PLATFORM" "$RUNNER_TEMP/bark-image"
+      - name: Retain image, frozen source and native build evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: bark-image-${{ matrix.selection }}-${{ inputs.architecture }}-${{ github.sha }}-${{ github.run_attempt }}
+          # Exact allowlist; no Docker config, credentials, build cache or runtime state.
+          # SHA256SUMS exists only when the complete image handoff succeeded.
+          path: |
+            ${{ runner.temp }}/bark-image/artifacts/build.log
+            ${{ runner.temp }}/bark-image/artifacts/native.json
+            ${{ runner.temp }}/bark-image/artifacts/image.json
+            ${{ runner.temp }}/bark-image/artifacts/inspect.json
+            ${{ runner.temp }}/bark-image/artifacts/probe.stdout
+            ${{ runner.temp }}/bark-image/artifacts/image.tar
+            ${{ runner.temp }}/bark-image/artifacts/work.tar.gz
+            ${{ runner.temp }}/bark-image/artifacts/SHA256SUMS
+          if-no-files-found: warn
+          compression-level: 0
+          retention-days: 14

.github/workflows/component-images.yml

@@ -2,6 +2,19 @@ name: Candidate component packaging
 
 on:
   workflow_dispatch:
+    inputs:
+      family:
+        description: Standard compatibility builds or the Bark candidate handoff
+        type: choice
+        required: true
+        default: standard
+        options: [standard, bark]
+      architecture:
+        description: Architecture for the Bark handoff (standard keeps its full matrix)
+        type: choice
+        required: true
+        default: amd64
+        options: [amd64, arm64]
   pull_request:
     branches: [main]
     # Candidate packaging evidence is separate from shipped-image qualification.
@@ -22,8 +35,16 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  native-bark-images:
+    name: Bark candidate handoff
+    if: github.event_name == 'workflow_dispatch' && inputs.family == 'bark'
+    uses: ./.github/workflows/bark-images.yml
+    with:
+      architecture: ${{ inputs.architecture }}
+
   native-payment-components:
     name: Payment component (${{ matrix.selection }}, ${{ matrix.arch }})
+    if: github.event_name != 'workflow_dispatch' || inputs.family == 'standard'
     strategy:
       fail-fast: false
       matrix:
@@ -79,6 +100,7 @@ jobs:
 
   native-components:
     name: Candidate builds and compatibility (${{ matrix.arch }})
+    if: github.event_name != 'workflow_dispatch' || inputs.family == 'standard'
     strategy:
       fail-fast: false
       matrix:

README.md

@@ -83,6 +83,9 @@ compatibility details.
 | LDK Server | `ldk-server` | Experimental standalone Lightning node and native CLI |
 | CDK mint | `cdk` | Linked LND / CLN / gRPC processor or embedded LDK Node (BOLT11 / BOLT12), optional embedded BDK on-chain; SQLite / PostgreSQL; optional NUT-21 / NUT-22 auth |
 | CDK LDK Server processor | `cdk-ldk-server-processor` | Experimental gRPC BOLT11 / BOLT12 backend for CDK |
+| CDK Bark processor | `cdk-bark-processor` | ARM64 local preview: persistent Bark wallet and BOLT11/sat gRPC backend for CDK |
+| Bark server | `bark-server` | ARM64 local preview: Ark server backed by PostgreSQL and CLN/hold |
+| CLN with hold | `cln-hold` | ARM64 local preview: Core Lightning with the hold-invoice plugin |
 | Nutshell mint | `nutshell` | LND / CLN; Redis cache; 0.21.0 supports NUT-21 / NUT-22 auth |
 | Nutshell wallet | `nutshell-wallet` | Persistent Cashu wallet |
 | CDK CLI wallet | `cdk-cli-wallet` | Cashu wallet CLI |

charts/proofstorm/crds/proofstorm.dev_proofstormcells.yaml

@@ -52,6 +52,7 @@ spec:
                           enum:
                           - bitcoin
                           - lightning
+                          - ark_server
                           - payment_processor
                           - mint
                           - database
@@ -78,7 +79,7 @@ spec:
                     items:
                       properties:
                         binding:
-                          description: Typed dependency qualifier. Chain bindings require network; payment bindings require method and unit; database bindings require a role and may name the database to create; authentication bindings require a protocol. Proofstorm validates the discriminator-specific fields before publication.
+                          description: Typed dependency qualifier. Chain and Ark bindings require network; payment bindings require method and unit; database bindings require a role and may name the database to create; authentication bindings require a protocol. Proofstorm validates the discriminator-specific fields before publication.
                           nullable: true
                           properties:
                             database:
@@ -109,6 +110,7 @@ spec:
                             type:
                               enum:
                               - chain
+                              - ark
                               - payment
                               - database
                               - authentication
@@ -122,8 +124,8 @@ spec:
                           - type
                           type: object
                           x-kubernetes-validations:
-                          - message: chain bindings require only network; payment bindings require only method and unit; database bindings require a role and may name a database; authentication bindings require only protocol
-                            rule: 'self.type == ''chain'' ? has(self.network) && !has(self.method) && !has(self.unit) && !has(self.role) && !has(self.protocol) && !has(self.database) : (self.type == ''payment'' ? has(self.method) && has(self.unit) && !has(self.network) && !has(self.role) && !has(self.protocol) && !has(self.database) : (self.type == ''database'' ? has(self.role) && !has(self.network) && !has(self.method) && !has(self.unit) && !has(self.protocol) : has(self.protocol) && !has(self.network) && !has(self.method) && !has(self.unit) && !has(self.role) && !has(self.database)))'
+                          - message: chain and Ark bindings require only network; payment bindings require only method and unit; database bindings require a role and may name a database; authentication bindings require only protocol
+                            rule: 'self.type in [''chain'', ''ark''] ? has(self.network) && !has(self.method) && !has(self.unit) && !has(self.role) && !has(self.protocol) && !has(self.database) : (self.type == ''payment'' ? has(self.method) && has(self.unit) && !has(self.network) && !has(self.role) && !has(self.protocol) && !has(self.database) : (self.type == ''database'' ? has(self.role) && !has(self.network) && !has(self.method) && !has(self.unit) && !has(self.protocol) : has(self.protocol) && !has(self.network) && !has(self.method) && !has(self.unit) && !has(self.role) && !has(self.database)))'
                         from:
                           type: string
                         id:
@@ -134,6 +136,7 @@ spec:
                           - bitcoin_peer
                           - lightning_peer
                           - chain_backend
+                          - ark_backend
                           - payment_backend
                           - database_backend
                           - authentication_backend
@@ -149,7 +152,9 @@ spec:
                       type: object
                       x-kubernetes-validations:
                       - message: backend links require a binding; peer and network-path links forbid one
-                        rule: '(self.kind == ''chain_backend'' || self.kind == ''payment_backend'' || self.kind == ''database_backend'' || self.kind == ''authentication_backend'') ? has(self.binding) : !has(self.binding)'
+                        rule: 'self.kind in [''chain_backend'', ''ark_backend'', ''payment_backend'', ''database_backend'', ''authentication_backend''] ? has(self.binding) : !has(self.binding)'
+                      - message: backend link kind must match its binding type
+                        rule: '!has(self.binding) || (self.kind == ''chain_backend'' && self.binding.type == ''chain'') || (self.kind == ''ark_backend'' && self.binding.type == ''ark'') || (self.kind == ''payment_backend'' && self.binding.type == ''payment'') || (self.kind == ''database_backend'' && self.binding.type == ''database'') || (self.kind == ''authentication_backend'' && self.binding.type == ''authentication'')'
                     type: array
                   name:
                     type: string
@@ -313,6 +318,7 @@ spec:
                                 - bitcoin_peer
                                 - lightning_peer
                                 - chain_backend
+                                - ark_backend
                                 - payment_backend
                                 - database_backend
                                 - authentication_backend
@@ -622,6 +628,7 @@ spec:
                       enum:
                       - bitcoin
                       - lightning
+                      - ark_server
                       - payment_processor
                       - mint
                       - database