[joshglogau]

Operators need a supported custody API for Hub registration → collateralization → rewards. This adds native collateral methods to verified outpost clients through the existing OutpostClient.create facade. Wire registration, AuthEx, operator standing, withdrawal queues, and reward claims keep their existing owners.

Behavior

• Ethereum: native deposit and withdrawal request, live native-token-code check, SEC1 public key matched to the connected signer, and static preflight.
• Solana: native deposit instruction/submission with producer-owned Anchor bindings and canonical custody accounts. HTTP confirmation works without WebSockets and stops after two minutes, including stalled RPC calls. Timers are cleared, failures retain the submitted signature, and custody writes are never retried automatically.
• Exact custody units: generated operator roles and bigint amounts, with the depot’s aggregate 2^62 - 1 ceiling. Amounts remain raw wei/lamports.
• Recoverable receipts: onSubmitted delivers the source hash/signature before confirmation. Neither submission nor confirmation certifies depot acceptance, withdrawal queue allocation, or final payout.

Public SOL operator withdrawal and generic ERC20/SPL collateral ingress remain unavailable. These clients do not substitute liquid-staking exits or handle Wire reward claims.

Scope

Producer ABIs/IDLs/runtime artifacts remain in the chain repositories. This PR changes no dependency pins, lockfile, generated bindings, publication scripts, workflows, or SDK Core code. AGENTS.md remains a symlink to CLAUDE.md.

The existing Solana reserve clients share configuration/message-buffer PDA derivation and signature-status/error/expiry checks with collateral. These small extractions avoid duplicate helpers; reserve custody instructions, transaction-log lookup, and polling cadence are preserved. Shared chain-error messages now identify a Solana transaction/signature. Public request, receipt, and capability fields are documented.

Validation

SDK revision: d8c38592944198cdee9927a208f71e72b0cc4d11, rebased onto master at f1b70079b294eb200d1bb7c0b3b64e777eda578a.

• Fresh SDK CI passed: dependency install, full build, SDK Core strict-null check, and repository tests.
• Local full gate: 91 suites / 976 tests; sdk-outpost: 15 suites / 86 tests. Repository-wide ESLint, changed-code formatting, whitespace checks, and CommonJS export loading passed.
• Tests cover exact units/accounts, aggregate overflow, signer/token mismatch, preflight failure, wallet rejection, receipt retention, processed → confirmed status, finalized status, instruction failure, expiry, RPC rejection, stalled RPC deadline, and timer cleanup without duplicate sends.
• Full platform build passed: run 36041851435 used this SDK SHA and manifest b7978529eedd4e41b858e089557cb834e03958d1. Recorded SYSIO/Ethereum/Solana/Tools revisions: a8a13405 / 8408cc7b / e6ea6adf / 6269a2dc. Build validation included 976 SDK tests and 2,104 Wire Tools tests. The run’s resolved manifest records all eleven revisions.
• Platform flow acceptance is deferred and is not a requirement for this review. The currently broken flow suite is excluded from the readiness criteria; the run was stopped during its flow phase. No successful end-to-end flow result is claimed.

Known baseline limitation: native Node ESM import fails in unchanged SDK Core crypto/Curves.ts at the elliptic named import. Direct Core import reproduces it, and master already loads that entrypoint through its node-owner client. It is outside this collateral change; compiling ESM output is not a claim that native ESM loading passed.

Integration and remaining work

Companion Hub: Wire-Network/wire-hub-webapp#181. Producer-artifact/SDK publication and a locked consumer install remain release gates. SDK verification must use artifacts for the binaries actually deployed.

Wire-Network/wire-ethereum#205 and Wire-Network/wire-solana#544 are merged. September 22 Nextbox evidence in the Hub PR records registration for all three roles, ETH/SOL deposits, producer/batch claimpay transfers, and an underwriter ETH withdrawal/cancel/remit cycle. That sandbox used an earlier SDK overlay and unpublished matching artifacts; it does not certify this final SDK revision or current heads.

Remaining backend/consumer acceptance: public SOL collateral exit; generic-token exit before generic ingress; end-to-end acceptance of oversized direct calls and concurrent deposits; actual underwriter fee accrual/claimuwfee; SDK Core authority decoding and Solana-only account discovery. Source custody receipts remain separate from depot settlement and rewards.

[joshglogau]

Closing this PR because the launch architecture has superseded the external operator-collateral APIs it adds.

The coordinated changes in Wire-Network/wire-sysio#662, Wire-Network/wire-ethereum#217 and Wire-Network/wire-solana#562 move operator collateral to token-qualified depot-native accounting and retire the external collateral paths targeted here. Underwriting also moves to generic syndication bonds, rather than the former registered-underwriter/claimuwfee lifecycle.

We should not publish these methods or restore retired contracts to support them. The launch Hub should consume the matching generated depot APIs once the coordinated SDK/bootstrap work is aligned; see #92 and Wire-Network/wire-tools-ts#112. The operator console in Wire-Network/wire-hub-webapp#181 needs to be updated to that model.

The recorded September validation remains historical evidence for the versions tested; it does not establish compatibility with the new launch architecture. Closing this proposal does not remove the existing, separate BAR-backed node-owner client. Any reusable helper changes can be considered independently only if a current consumer needs them.

No replacement collateral API or deployment is introduced by this closure.