feat(evm-rpc): typed JSON-RPC client with per-chain resilience

Cargo.toml

@@ -9,6 +9,8 @@ members = [
     "crates/ingest",
     "crates/api",
     "crates/resilience",
+    "crates/evm-core",
+    "crates/evm-rpc",
     "bin/server",
     "bin/migrate-keys",
     "bin/backfill-operation-index",
@@ -39,8 +41,28 @@ sha2 = "0.10.9"
 hex = "0.4.3"
 base64 = "0.22"
 argon2 = "0.5"
+# --- EVM / secp256k1 ---
+# k256 gives us constant-time scalar/point arithmetic and ECDSA (incl. recoverable signing +
+# low-s normalisation) for BIP-32 derivation and transaction signing. sha3 gives Keccak-256 for
+# EIP-55 addressing. subtle gives explicit constant-time comparisons for secret scalars. See the
+# ADR in docs/architecture.md for why this is preferred over alloy-primitives / coins-bip32.
+k256 = { version = "0.13", default-features = false, features = ["arithmetic", "ecdsa", "std"] }
+sha3 = "0.10"
+subtle = "2.6"
+# Test-only: decodes the official BIP-32 spec's base58check xprv test vectors in
+# crates/evm-core/src/derive.rs so the expected bytes come from the spec text, not transcription.
+bs58 = { version = "0.5", features = ["check"] }
 # Note: the MSRV-aware resolver (.cargo/config.toml: incompatible-rust-versions = "fallback")
 # keeps the whole tree on Rust-1.84-compatible versions, so no manual transitive pins are needed.
+# --- EVM / JSON-RPC ---
+# ethnum::U256 is the quantity type for crates/evm-rpc's JSON-RPC hex fields (block numbers,
+# balances, gas, nonces, ...) — never u64/f64, which silently truncate/lose-precision on-chain
+# values above 2^64. It was already present transitively (a proptest dependency) and is a single
+# small, permissively-licensed crate, in keeping with "don't pull in a full EVM SDK for this".
+ethnum = "1.5"
+# Lets crates/evm-rpc enforce a hard response-body size cap while streaming a JSON-RPC reply, so a
+# malicious/compromised RPC endpoint returning a multi-GB body can't OOM the worker.
+futures-util = "0.3"
 
 # --- async runtime / web ---
 tokio = { version = "1", features = ["full"] }
@@ -73,6 +95,8 @@ octo-email = { path = "crates/email" }
 octo-ingest = { path = "crates/ingest" }
 octo-api = { path = "crates/api" }
 octo-resilience = { path = "crates/resilience" }
+octo-evm-core = { path = "crates/evm-core" }
+octo-evm-rpc = { path = "crates/evm-rpc" }
 
 [profile.release]
 lto = "thin"

crates/evm-core/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "octo-evm-core"
+description = "secp256k1 BIP-44 derivation, EIP-55 addresses, and low-s normalised signing for EVM chains."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+authors.workspace = true
+
+[features]
+# chain_conformance_suite is a test helper (asserts invariants with unwrap/assert!, which this
+# crate's lint wall denies outside test code) meant to be reusable by other ChainAdapter impls'
+# own test suites, not just this crate's. Mirrors octo-wallet-core's test-fixtures pattern.
+test-fixtures = []
+
+[dependencies]
+octo-crypto.workspace = true
+tiny-bip39.workspace = true
+k256.workspace = true
+sha3.workspace = true
+hmac.workspace = true
+sha2.workspace = true
+zeroize.workspace = true
+subtle.workspace = true
+thiserror.workspace = true
+hex.workspace = true
+
+[dev-dependencies]
+proptest.workspace = true
+bs58.workspace = true