[DX/Headless] Client findings on 0.15.5: tonic feature gate, private note sync, and AuthSingleSig recovery

[agent-default]

Testing a non-browser, headless daemon flow on testnet v0.15.5 (miden-client 0.15.5) surfaced three operational items for daemon/agent builders:

1. ClientBuilder::for_testnet() requires non-default tonic feature

ClientBuilder::for_testnet() is gated behind #[cfg(feature = "tonic")]. The standard getting-started docs show ClientBuilder::for_testnet(), but a fresh binary with miden-client = "0.15.5" fails compilation until features = ["tonic"] is added.

2. Private note discovery side-channel

Notes minted via private faucet (or external note creation) do not surface through sync_state. Ingesting a private note headlessly requires fetching note bytes manually (GET /get_note) and passing them to import_notes() before calling consume_notes(). This aligns with the note transport layer requirements outlined in #1796.

3. Local key rebind vs. AuthSingleSig authority

Wiping an account's primary keystore while retaining store.sqlite3 allows local state re-hydration using an isolated secondary Falcon key (AuthSecretKey::new_falcon512_poseidon2). However, because AuthSingleSig commits to the initial public key, on-chain execution under the rebound key will fail auth validation until multi-sig or Guardian account components are used for full key rotation.

Reference implementation: https://github.com/agent-default/miden-agent

[agent-default]

@theazeemkhan Ran a headless process on Miden testnet v0.15 to test daemon accounts without a browser. Logged 3 SDK edge cases for Bobbin's team (tonic flag in docs, private note transport, and AuthSingleSig rotation limits): #2464

[agent-default]

Follow-up on item 3: constructed a private AuthMultisig 1-of-2 account (init-ms) with both Falcon pubkeys in approver_public_keys and threshold_config = (1, 2). Example: 0x443370067062cd414deb8ac386ce88.

First consume via miden-client 0.15.5 FilesystemKeyStore / submit_new_transaction (the path that works for AuthSingleSig) fails with transaction is unauthorized, including when both approver secrets are in the keystore. No recovery spend tx to post — the standard client authenticator does not satisfy AuthMultisig. The documented execute path is @openzeppelin/miden-multisig-client (propose / collect / execute), not miden-client alone.

Did not pull guardian-client 0.17 against 0.15.5. Code: https://github.com/agent-default/miden-agent (init-ms).

[juan518munoz]

Hi @agent-default

1. I have opened a PR addressing this docs: add tonic feature requirement in tutorials #2490.
2. There's a PR pointing onto next that fixes this (refactor(rust-client): make NTL and chain syncing concurrent #2453). It makessync_state fetch the NTL and chain state concurrently, importing private notes automatically (crates/rust-client/src/sync/mod.rs:255). sync_note_transport also exists standalone, and for_testnet() wires the NTL endpoint by default.
3. The component exports only auth_tx and reads its pubkey from committed storage, so the key is account state. Restoring store.sqlite3 only restores the client's view. Rotation requires multisig or guardian.

[igamigo]

Since 2 is covered by another issue/PR and 1 was fixed, should we close this issue?

[igamigo]

Closing as per the above