fix(ci): build the wrapper BPF with --features devnet — main red since 15eb8b0c

[dcccrypto]

main has failed CI for three days — from 15eb8b0c (2026-08-31 13:31) through be8c8dd2 — on nine tag87_* tests. Fourteen commits have landed on a red trunk, and contributor PR #458 inherited the red and appears to have caused it.

It did not. Neither did any of the fourteen.

Root cause

devnet is not a default feature (default = ["anchor-v2"]). Without it, tag 87 (WithdrawInsuranceReserveToStake) compiles to an unconditional early return:

#[cfg(not(feature = "devnet"))]
{ return Err(PercolatorError::StakeProgramNotPinned.into()); }   // Custom(60)

A non-devnet build has no pinned percolator-stake id to send tokens to, and v17 stake has no mainnet deployment. That is the program correctly failing closed — not a bug in it.

CI built the wrapper --no-default-features, so every tag87_* test hit Custom(60) before reaching anything it asserts about, regardless of the stake pin.

#441 removed those nine from tests/KNOWN_FAILING.txt as "they now pass". That was true where it was measured — a local cargo build-sbf takes the default features, and anyone testing tag 87 builds devnet. It could never be true in CI, where those nine had never once passed.

Worth flagging: this is not the failure ci/deployed-refs.env predicts for a wrapper/stake pin skew ("Custom(9) at tag 87"). It is Custom(60), and it is independent of the pins — 78c20050 advanced them correctly and main stayed red.

Why --features devnet, rather than restoring the allowlist entries

Both turn CI green. Only one is honest.

The suite's sibling pins are all deployed-devnet refs, and the deployed devnet wrapper is itself built --features devnet — that is what reproduces DhSkE7u byte-for-byte. A non-default build tests a configuration deployed nowhere.

It also meant the entire tag-87 security surface was never exercised, including tag87_blocks_the_creator_forged_stake_pool_exploit and tag87_owner_pin_fires_before_any_pool_byte_is_read — a test written specifically to prove the owner pin fires before any pool byte is read. Restoring the allowlist entries would have gone green while keeping that blind.

Measured

On be8c8dd2, siblings at the pinned refs (stake d0c6ecb, nft 215842e, matcher d4d4f1c):

build	result	vs allowlist
--no-default-features	passed=596 failed=30	9 NEW failures
--features devnet	passed=603 failed=21	exact match — 0 new, 0 stale

./scripts/ci-test.sh exits 0, with its own verdict: OK: failing set matches the allowlist exactly.

Scope

One line of scripts/ci-test.sh plus its reasoning. No program source changes. No test edited, skipped or re-scoped. No allowlist entry added.

Upstream aeyakovenko/percolator-prog carries neither scripts/ci-test.sh nor tests/KNOWN_FAILING.txt — both are ours, so there is nothing to coordinate upstream.

Once this lands, #458 should be re-run — it is expected to go green on its own merits.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgoNgagkvw7i5SSRC3FJ8D

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 7f272b59-280f-453f-b7d3-7b316d9f1131

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}