- Add make_ping_key_revocation.py: onion revocations are signed by the
identity key, DNS TXT revocations are self-signed by the revoked key
- Document the revocation format, endpoint, helper usage, lifetime and
no-revocation-of-identity-key limits
- Update the security audit, references and env docs for the new flow and
the v2/onion-only scope
- Load WELIST_PING_DELEGATION_FILE into a typed OnionDelegation
- Send the certificate only with v2 pings for onion hosts
- Validate the onion host, expiry and delegated key against
BAL_SERVER_URL and SSL_KEY_PATH at startup; disable delegation
with a warning on any mismatch
- Stop sending unsigned info/base_fee/version with v1 pings so
v1 remains liveness-only
- Document v1/v2 metadata handling and onion delegation implications
- Add contrib/make_onion_delegation.py to issue certificates offline,
with Ed25519 key validation and clean CLI error handling
- Add docs/INDEX.md with navigable index and quick reference guides
- Add 9 knowledge base files covering project overview, Bitcoin domain,
architecture, modules, API reference, database schema, deployment/security
- Update AGENTS.md with knowledge base reference and update policy
- Add tests/sql_injection_tests.rs with regression tests for SQL injection
- Fix SQL injection vulnerabilities in bal-pusher.rs:
* Replace string-formatted UPDATE IN with loop + parameterized queries
* Replace string-formatted UPDATE push_err with parameterized query
* Add chain name validation in calculate_stats to prevent env var tampering
- Update .gitignore to exclude bal-pusher.env and bal-pusher.sh
