Summary

• Closes SwapConfirm allows reservation hijacking by a different user #107
• require SwapConfirm source addresses to match the active reservation owner before continuing
• preserve the upstream reservation-pin behavior while resolving the current test branch conflicts
• add regression coverage for owner mismatch, queue safety, and the existing queued-confirm path

What changed

• handle_swap_confirm now reads the full reservation record and compares reservation.from_addr to synapse.from_address
• mismatched confirms return before reservation-pin resolution, proof verification, source transaction lookup, pending queue insertion, or contract voting
• tests cover missing full reservation data, mismatched source owners, no side effects on mismatch, and preservation of an existing SQLite pending row

Why

A reservation is owned by the source address recorded on-chain. Confirming with a different source address should not be allowed to consume or modify that reservation, even if the caller controls the alternate address.

Validation

• uv run pre-commit run --all-files
• uv run pytest tests/test_axon_handlers.py -q
• uv run pytest tests/test_axon_handlers.py tests/test_swap_poller.py tests/test_swap_tracker.py -q
• uv run ruff check allways/validator/axon_handlers.py tests/test_axon_handlers.py
• uv run pytest -q
• GitHub Actions: pre-commit-fork passed
• GitHub Actions: pytest passed
• CodeRabbit review against the uncommitted formatting fix: 0 issues
• CodeRabbit review against upstream/test: 0 issues
• Codex Security diff scan: no reportable findings

Notes

• Rebased onto current upstream test to resolve conflicts from the merged reservation-pin and miner poller changes.
• Checked active upstream PRs before opening. Nearby validator PRs touch this area, but none appear to close SwapConfirm allows reservation hijacking by a different user #107 or add this owner-binding check.