Dev → Main release tracking

.github/workflows/client.yml

@@ -6,6 +6,7 @@ on:
   push:
     branches:
       - main
+      - dev
     paths-ignore:
       - "docs/**"
       - "infrastructure/**"
@@ -192,6 +193,21 @@ jobs:
           path: coverage/coverage.out
           if-no-files-found: warn
 
+      # Coverage gate: 14% minimum total. Baseline measured at PR #4256
+      # (2026-08-19); no automated baseline-update mechanism exists.
+      - name: Check coverage gate
+        run: |
+          docker run --rm \
+            -v "${{ github.workspace }}/coverage:/coverage" \
+            go-build-env \
+            go tool cover -func /coverage/coverage.out > /tmp/cover-func.txt
+          TOTAL=$(grep '^total:' /tmp/cover-func.txt | awk '{print $3}' | tr -d '%')
+          echo "Total coverage: ${TOTAL}%"
+          PASS=$(awk -v t="$TOTAL" 'BEGIN { print (t+0 >= 14) ? "yes" : "no" }')
+          if [ "$PASS" != "yes" ]; then
+            echo "::error::Coverage ${TOTAL}% is below the 14% minimum threshold"
+            exit 1
+          fi
 
       - name: Build Docker Runtime Image
         if: github.event_name != 'workflow_dispatch'
@@ -358,6 +374,93 @@ jobs:
           install-go: false
           checks: "-SA1019"
 
+  client-bench:
+    needs: [client-build-test-publish]
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.24"
+          cache: false
+
+      - name: Download Docker Build Image
+        uses: actions/download-artifact@v4
+        with:
+          name: go-build-env-image
+          path: /tmp
+
+      - name: Load Docker Build Image
+        run: |
+          docker load --input /tmp/go-build-env-image.tar
+
+      - name: Download previous benchmark results
+        id: download-prev
+        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
+        continue-on-error: true
+        with:
+          name: go-bench
+          path: bench-prev
+          workflow: client.yml
+          branch: main
+          if_no_artifact_found: warn
+
+      - name: Run benchmarks
+        run: |
+          docker run \
+            --workdir /go/src/github.com/keep-network/keep-core \
+            go-build-env \
+            go test -bench=. -benchmem -count=10 -run='^$' ./pkg/... \
+            > bench.txt
+          cat bench.txt
+
+      - name: Install benchstat
+        run: go install golang.org/x/perf/cmd/benchstat@v0.0.0-20260813145340-fd4a688df892
+
+      # Benchmark regression gate: >12% slower than main's last `go-bench`
+      # artifact. Baseline measured at PR #4256 (2026-08-19). This job only
+      # runs on manual `workflow_dispatch` - no automatic push/PR trigger.
+      # GAP: benchmarks added in this PR have no main-side baseline, so
+      # benchstat silently skips them on first run; they only become
+      # gated after shipping to main and someone manually dispatches this
+      # workflow again on main to record a baseline artifact.
+      # No automated baseline-record mechanism exists in this workflow.
+      - name: Compare benchmarks
+        if: steps.download-prev.outcome == 'success' && hashFiles('bench-prev/**') != ''
+        run: |
+          benchstat bench-prev/*.txt bench.txt | tee benchstat-results.txt
+          python3 - <<'EOF'
+          import sys, re
+          content = open('benchstat-results.txt').read()
+          regressions = []
+          for line in content.splitlines():
+              if '~' in line or not line.strip():
+                  continue
+              m = re.search(r'\+(\d+\.\d+)%', line)
+              if m and float(m.group(1)) > 12:
+                  regressions.append(line)
+          if regressions:
+              print('Performance regressions >12% detected:')
+              for r in regressions:
+                  print(' ', r)
+              sys.exit(1)
+          EOF
+
+      - name: Upload benchmark results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: go-bench
+          path: bench.txt
+          overwrite: true
+          if-no-files-found: warn
+
   client-integration-test:
     needs: [client-detect-changes, electrum-integration-detect-changes, client-build-test-publish]
     if: |
@@ -379,8 +482,11 @@ jobs:
           docker load --input /tmp/go-build-env-image.tar
 
       - name: Run Go Integration Tests
+        env:
+          ETHEREUM_MAINNET_RPC_URL: ${{ secrets.ETHEREUM_MAINNET_RPC_URL }}
         run: |
           docker run \
+            -e ETHEREUM_MAINNET_RPC_URL \
             --workdir /go/src/github.com/keep-network/keep-core \
             go-build-env \
             gotestsum -- -timeout 20m -tags=integration ./...

.gitignore

@@ -12,9 +12,6 @@
 *.swp
 *.swo
 
-# Infrastructure
-/infrastructure/gcp/service-accounts*
-
 # Secret directory used in Kubernetes configurations
 /infrastructure/kube/**/.secret/
 /infrastructure/kube/**/*.secret

Makefile

@@ -146,4 +146,7 @@ cmd-help: build
 	@echo '$$ $(app_name) start --help' > docs/resources/client-start-help
 	./$(app_name) start --help >> docs/resources/client-start-help
 
-.PHONY: all development sepolia download_artifacts generate gen_proto build cmd-help release build_multi
+bench:
+	go test -bench=. -benchmem -count=10 -run='^$$' ./pkg/...
+
+.PHONY: all development sepolia mainnet local get_artifacts generate gen_proto build cmd-help release build_multi bench

cmd/flags.go

@@ -310,6 +310,25 @@ func initTbtcFlags(cmd *cobra.Command, cfg *config.Config) {
 		tbtc.DefaultKeyGenerationConcurrency,
 		"tECDSA key generation concurrency.",
 	)
+
+	cmd.Flags().IntVar(
+		&cfg.Tbtc.WalletTxSatPerVByteFloor,
+		"tbtc.walletTxSatPerVByteFloor",
+		tbtc.DefaultWalletTxSatPerVByteFloor,
+		"Minimum fee rate (sat/vByte) applied to wallet Bitcoin transactions "+
+			"(deposit sweeps, redemptions, moving funds, moved funds sweeps). "+
+			"Applies to both the leader-side floor in tbtcpg and the "+
+			"follower-side soft check; 0 means use the default.",
+	)
+
+	cmd.Flags().IntVar(
+		&cfg.Tbtc.WalletTxFeeBufferPercent,
+		"tbtc.walletTxFeeBufferPercent",
+		tbtc.DefaultWalletTxFeeBufferPercent,
+		"Safety-buffer percentage applied over the per-vByte fee rate "+
+			"(bufferedRate = ceil(rawRate * (100+Percent) / 100)); "+
+			"0 means use the default.",
+	)
 }
 
 // Initialize flags for Maintainer configuration.
@@ -373,6 +392,15 @@ func initMaintainerFlags(command *cobra.Command, cfg *config.Config) {
 		"The wait time which should be applied when there are no more "+
 			"transaction proofs to submit.",
 	)
+	command.Flags().UintVar(
+		&cfg.Maintainer.Spv.MaxProofHeaders,
+		"spv.maxProofHeaders",
+		spv.DefaultMaxProofHeaders,
+		"The maximum number of block headers allowed when assembling an SPV "+
+			"proof. Bounds the forward walk over headers and so the number of "+
+			"consecutive leading minimum-difficulty (DIFF1) headers a proof "+
+			"can absorb before it becomes unprovable.",
+	)
 }
 
 // Initialize flags for Developer configuration.

cmd/flags_test.go

@@ -22,6 +22,7 @@ import (
 	ethereumEcdsa "github.com/keep-network/keep-core/pkg/chain/ethereum/ecdsa/gen"
 	ethereumTbtc "github.com/keep-network/keep-core/pkg/chain/ethereum/tbtc/gen"
 	ethereumThreshold "github.com/keep-network/keep-core/pkg/chain/ethereum/threshold/gen"
+	"github.com/keep-network/keep-core/pkg/tbtc"
 )
 
 var cmdFlagsTests = map[string]struct {
@@ -225,6 +226,20 @@ var cmdFlagsTests = map[string]struct {
 		expectedValueFromFlag: 101,
 		defaultValue:          runtime.GOMAXPROCS(0),
 	},
+	"tbtc.walletTxSatPerVByteFloor": {
+		readValueFunc:         func(c *config.Config) interface{} { return c.Tbtc.WalletTxSatPerVByteFloor },
+		flagName:              "--tbtc.walletTxSatPerVByteFloor",
+		flagValue:             "7",
+		expectedValueFromFlag: 7,
+		defaultValue:          tbtc.DefaultWalletTxSatPerVByteFloor,
+	},
+	"tbtc.walletTxFeeBufferPercent": {
+		readValueFunc:         func(c *config.Config) interface{} { return c.Tbtc.WalletTxFeeBufferPercent },
+		flagName:              "--tbtc.walletTxFeeBufferPercent",
+		flagValue:             "30",
+		expectedValueFromFlag: 30,
+		defaultValue:          tbtc.DefaultWalletTxFeeBufferPercent,
+	},
 	"maintainer.bitcoinDifficulty": {
 		readValueFunc:         func(c *config.Config) interface{} { return c.Maintainer.BitcoinDifficulty.Enabled },
 		flagName:              "--bitcoinDifficulty",

cmd/start.go

@@ -231,7 +231,7 @@ func initializeClientInfo(
 	signing chain.Signing,
 	blockCounter chain.BlockCounter,
 ) *clientinfo.Registry {
-	registry, isConfigured := clientinfo.Initialize(ctx, config.ClientInfo.Port)
+	registry, isConfigured := clientinfo.Initialize(ctx, config.ClientInfo)
 	if !isConfigured {
 		logger.Infof("client info endpoint not configured")
 		return nil

docs/dev-ops.adoc

@@ -7,7 +7,7 @@
 
 = Kubernetes
 
-At Keep we run on GCP + Kubernetes. To accommodate the aforementioned 
+At Keep we run on GCP and Kubernetes. To accommodate the
 xref:./run-keep-node.adoc#system-considerations[System Considerations]
 we use the following pattern for each of our environments:
 
@@ -16,4 +16,3 @@ we use the following pattern for each of our environments:
 - A LoadBalancer Service for each client.
 - A StatefulSet for each client.
 
-You can see our Testnet Kubernetes configurations link:https://github.com/threshold-network/keep-core/tree/main/infrastructure/kube/keep-test[here].

docs/index.adoc

@@ -4,5 +4,6 @@
 
 * xref:./registration.adoc[Registration]
 * xref:./run-keep-node.adoc[Run Keep Client Node]
+* xref:./profiling.md[Profiling & pprof runbook]
 * xref:./development/README.adoc[Developers]
 * xref:./dev-ops.adoc[DevOps]