fix(vault)!: require RESOLVER_BASE_URL

[LKSNDRTMLKV]

The standalone dpp-vault binary signed https://id.odal-node.io — a host that does not resolve — into every carrier it published, whatever the environment said. #394 made RESOLVER_BASE_URL required in the node and the resolver; the vault was the third reader and was missed, because its value never came from its own config at all.

Where the guess lived. PassportService::new hard-defaulted resolver_base_url to that host, and only the node overrode it (with_resolver_base_url). dpp-vault/src/main.rs builds the service without the override, so every publish went through the default.

The change.

• PassportService::new takes the resolver base URL as an argument. No default, and with_resolver_base_url is removed — no caller can build a service that signs carriers without being told where they resolve.
• The standalone vault reads it through dpp_common::config::resolver_base_url, the reader the node and the resolver use, so the three apply one rule (required, absolute http/https, no credentials/query/fragment, trailing / trimmed).
• a_standalone_vault_refuses_to_start_without_a_resolver_base_url pins it. Seen failing: with a fallback restored in Config::from_env it fails; without, it passes.
• Test constructors pass https://resolver.example.com; every carrier assertion in the integration suites is host-agnostic, so none changes.
• Doc touch-ups where the text said "both binaries": dpp_common::config, .env.example, CLAUDE.md. The 0.14.0 Breaking entry gains a paragraph.

Breaking only for dpp-vault run as its own binary, which no image or compose file ships. The node's behaviour is unchanged — it now passes the same value through the constructor instead of the builder.

Verified locally: CARGO_BUILD_JOBS=4 just check green (1343 tests, one more than main — the new one); cargo nextest run -p dpp-vault -p dpp-node --features integration-tests 704/704.

The CHANGELOG hunk sits in the Breaking entry and does not overlap #409's, so the two merge in either order.

Summary by CodeRabbit

• Configuration
  • Standalone vaults now require RESOLVER_BASE_URL at startup. No default URL is provided, so configure the value explicitly. Nodes and resolvers also require this setting.
• Documentation
  • Setup guidance now clarifies which applications require RESOLVER_BASE_URL and that it has no default.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: odal-node/dpp-engine/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 3076ec6c-6d62-46d4-9647-8d94ee0d4a1d

📥 Commits

Reviewing files that changed from the base of the PR and between 0f0182b and 44bfee4.

📒 Files selected for processing (13)

• .env.example
• CHANGELOG.md
• CLAUDE.md
• crates/dpp-common/src/config.rs
• crates/dpp-node/src/main.rs
• crates/dpp-node/tests/seal_outbox.rs
• crates/dpp-node/tests/smoke.rs
• crates/dpp-vault/src/config.rs
• crates/dpp-vault/src/domain/service/mod.rs
• crates/dpp-vault/src/main.rs
• crates/dpp-vault/tests/continuity_snapshot.rs
• crates/dpp-vault/tests/evidence_dossier.rs
• crates/dpp-vault/tests/helpers/mod.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The standalone vault now requires RESOLVER_BASE_URL. Its configuration reads the value through the shared reader, and PassportService::new requires it as an argument instead of using a default. Call sites and tests pass the URL.

Changes

Resolver URL configuration

Layer / File(s)	Summary
Load and document the required resolver URL .env.example, CHANGELOG.md, CLAUDE.md, crates/dpp-common/src/config.rs, crates/dpp-vault/src/config.rs	Vault configuration reads RESOLVER_BASE_URL through the shared reader and fails when it is absent. Tests cover parsing, URL normalization, and the missing-variable error. Documentation identifies the standalone vault as a required consumer.
Require the URL at service construction crates/dpp-vault/src/domain/service/mod.rs, crates/dpp-vault/src/main.rs, crates/dpp-node/src/main.rs, crates/dpp-vault/tests/*, crates/dpp-node/tests/*	PassportService::new accepts the resolver URL and no longer uses a default. The resolver URL is passed at vault and node call sites, and affected test harnesses provide a test URL.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 44bfe

The standalone vault now requires RESOLVER_BASE_URL, as documented. The node and vault pass the validated value through to passport publication, and no actionable merge risk remains.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 81.82% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 10 files. (3 skipped: 3…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Publication Boundary	✅ Passed	The authoritative diff adds configuration documentation, code identifiers, and example resolver URLs only. It adds no ADR reference, non-public repository name or path, pricing or contract data, vendo…
New Dependency Is Justified	✅ Passed	PASS: The reviewed diff changes 13 files, and none is a Cargo.toml manifest. No direct Cargo dependency is added, so this check passes trivially.
Title check	✅ Passed	The title clearly and concisely identifies the main breaking change: requiring RESOLVER_BASE_URL for the vault.
Description check	✅ Passed	The description clearly explains the problem, implementation, breaking scope, tests, and documentation updates. It does not use the template headings, omit the Related issue section, or provide the ch…

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}