Document how we review mempool behaviour changes after audit

[teor2345]

Motivation

We have implemented a mempool in Zebra, but we don't know if it is complete, because Zcash mempools are only partly documented. After we get the mempool audited, we will need to make sure Zebra keeps implementing compatible mempool behaviour.

Mempool behaviour changes can happen due to:

• ZIP changes
• spec changes which apply to the mempool (this is usually not documented)
• Zebra mempool behaviour bugs
• refactors
• dependency updates

Scheduling

We should spend an hour or two creating a draft document, then update it later as needed.

This should be part of the consensus rule documentation in #3186.

Process Changes

In general:

• it's ok if we accept more transactions than zcashd, because they will get filtered out eventually
• we need to carefully justify rejecting transactions that zcashd accepts, because transaction rejections can be really confusing for Zebra users

So we should document the requirements for new mempool validation, and mempool behaviour updates:

• quote the mempool rule from a ZIP, Bitcoin docs, or zcashd codebase
• link to the relevant section in the ZIP, docs, or code
• explain how Zebra is compatible with the mempool rule
• test success and failure cases for the mempool rule
• validate test vectors from zcashd, if available

We should also document how we identify the code that can change mempool behaviour:

• the function that implements the mempool behaviour
• all code that it calls, including other Zebra crates, and external dependencies
• any code that changes the data that's given to the function (for example, any changes to the transaction verifier)

Related Work

• Document how we review dependency changes #3183
• Document how we review consensus rule changes after audits #3186
• Document how we review network protocol changes after audits #3187

[mpguerra]

Hey team! Please add your planning poker estimate with ZenHub @conradoplg @dconnolly @jvff @oxarbitrage @teor2345 @upbqdn

[teor2345]

This isn't needed as a separate task.