POC: only vet the configured version

apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/BootstrapPackageConfigIntegrationTest.scala

@@ -459,12 +459,20 @@ class BootstrapPackageConfigIntegrationTest
         )
         .filter(_.metadata.version <= bootstrapPackage.metadata.version)
       expectedToBeVettedVersions.foreach { expectedVettedVersion =>
-        val newVettedPackage = vettingState.packages
-          .find(_.packageId == expectedVettedVersion.packageId)
-          .value
-        newVettedPackage.validFromInclusive should (
-          equal(scheduledTimeO) or equal(scheduledTime1) or equal(scheduledTime2)
-        )
+        // Only apply this test if the expected vetted version is the largest one.
+        if (
+          !expectedToBeVettedVersions.exists(pkg =>
+            pkg.metadata.name == expectedVettedVersion.metadata.name &&
+              pkg.metadata.version > expectedVettedVersion.metadata.version
+          )
+        ) {
+          val newVettedPackage = vettingState.packages
+            .find(_.packageId == expectedVettedVersion.packageId)
+            .value
+          newVettedPackage.validFromInclusive should (
+            equal(scheduledTimeO) or equal(scheduledTime1) or equal(scheduledTime2)
+          )
+        }
       }
     }
     packagesAreVetted(DarResources.amulet.bootstrap, PackageIdResolver.Package.SpliceAmulet)

apps/app/src/test/scala/org/lfdecentralizedtrust/splice/integration/tests/WalletIntegrationTest.scala

@@ -43,6 +43,8 @@ import scala.concurrent.Future
 import scala.util.Try
 import cats.syntax.parallel.*
 import com.digitalasset.canton.util.FutureInstances.parallelFuture
+import org.lfdecentralizedtrust.splice.config.ConfigTransforms
+
 import scala.jdk.OptionConverters.*
 
 class WalletIntegrationTest
@@ -71,6 +73,26 @@ class WalletIntegrationTest
           )
         )
       )
+      // Need to load the latest intead of the initial package version, as otherwise we don't vet the right
+      // splice amulet version -- need to validate that though!
+      .addConfigTransform((_, config) =>
+        ConfigTransforms.updateAllValidatorAppConfigs_(c =>
+          c.copy(
+            appInstances = c.appInstances.transform {
+              case ("splitwell", instance) =>
+                instance.copy(dars =
+                  Seq(
+                    java.nio.file.Paths.get(
+                      // FIXME: don't hardcode -- and generally find a better solution once I understand more about the problem.
+                      s"daml/dars/splitwell-0.1.9.dar"
+                    )
+                  )
+                )
+              case (_, instance) => instance
+            }
+          )
+        )(config)
+      )
       // TODO(#979) Consider removing this once domain config updates are less disruptive to carefully-timed batching tests.
       .withSequencerConnectionsFromScanDisabled()
   }
@@ -434,6 +456,7 @@ class WalletIntegrationTest
       aliceWalletClient.tap(50)
       val (_, requestId) = actAndCheck(
         "Create payment request on private domain",
+        // FIXME: this fails if we only vet the most recent version -- however I don't know how this works with per-synchronizer vetting, as I'd expect
         createSelfPaymentRequest(
           aliceValidatorBackend.participantClientWithAdminToken,
           aliceWalletClient.config.ledgerApiUser,

apps/common/src/main/scala/org/lfdecentralizedtrust/splice/util/PackageVetting.scala

@@ -207,7 +207,7 @@ class PackageVetting(
             DarResources.lookupAllPackageVersions(pkg.packageName).map(_.metadata.version)
           val configPackageVersion = PackageIdResolver.readPackageVersion(config.packageConfig, pkg)
           allPackageVersions
-            .filter(_ <= configPackageVersion)
+            .filter(_ == configPackageVersion)
             .map(version => time -> (pkg -> version))
         }
       }