BREAKING CHANGE: CrossZonePeer.expected_block_signing_pubkey (single optional
key) is renamed to expected_block_signing_pubkeys (a list, empty = unchecked),
and cross-zone config now refuses unknown fields at startup.
* feat(lee): store deployed programs as Account-shaped state, keyed by AccountId
Program-as-Account migration, first slice: V03State.programs becomes
HashMap<AccountId, Account> instead of HashMap<ProgramId, Program>,
with the elf held directly in Account.data. The map key is derived
from ProgramId via a new 1:1 From<ProgramId> for AccountId conversion
(both types are exactly 32 bytes) rather than a hash, since ProgramId
is already content-derived from the elf.
Account.program_owner stays ProgramId-typed everywhere - this only
changes how deployed programs are stored and looked up host-side, not
the dispatch/authorization model any guest program logic depends on.
Dispatch resolves a ChainedCall's program_id by converting to
AccountId, fetching the Account, and reconstructing a Program via
new_unchecked for execution.
DATA_MAX_LENGTH is raised from 100 KiB to 700 KiB to fit real program
elfs (observed 375 KB-631 KB) directly in Account.data; noted in its
docstring as a rough placeholder pending real transaction/block-size
budget analysis.
* fix(lee): store deployed programs as Account-shaped state, correct SeenShard cap
Corrects lee/state_machine internals for the Program-as-Account migration
and fixes SeenShard::MAX_DELIVERIES, which was still calibrated for the
old 100 KiB DATA_MAX_LENGTH instead of the current 700 KiB cap. Rebuilds
program artifacts and the sequencer test fixture to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* address PR #720 review nits
- Use FIXME instead of TODO for the temporary ProgramId->AccountId
conversion, per review convention for patches guaranteed to be
fixed later.
- Derive cross_zone_inbox's MAX_DELIVERIES from DATA_MAX_LENGTH
instead of a hand-recomputed literal, so it stays in sync
automatically the next time the cap changes.
* feat(lee): migrate Account.program_owner from ProgramId to AccountId
Account.program_owner is now AccountId-typed instead of ProgramId,
via a new bijective From<ProgramId> for AccountId / From<AccountId>
for ProgramId conversion pair (pure byte reinterpretation, not a
hash - both types are exactly 32 bytes). Adds DEFAULT_PROGRAM_OWNER
as the AccountId-typed counterpart to DEFAULT_PROGRAM_ID, used at
every program_owner comparison/claim site instead of an inline
AccountId::default().
Touches every call site across lee_core, lee (including the
guest-side privacy-preserving circuit), all 16 deployed guest
programs, wallet/wallet-ffi, indexer_ffi/indexer_service/
indexer_service_protocol, sequencer_core, testnet_initial_state,
system_accounts, cross_zone, storage, cycle_bench, and
integration_tests - mostly mechanical .into() conversions, plus two
simplifications: wallet's manual base58 encode/decode of
program_owner was dead code once it's AccountId (which already has
Display/FromStr), and the FFI crates' program_owner field now reuses
the existing generic FfiBytes32 wrapper instead of the now-unused
FfiProgramId one.
Rebuilds every guest ELF artifact and the prebuilt sequencer test
fixture via just build-artifacts, since execute_and_prove runs
against the checked-in precompiled privacy_preserving_circuit.bin,
which isn't rebuilt automatically by cargo test/check.
* chore(lee): rebuild artifacts after rebase, drop unused base58 dep
Rebases marvin/program-as-account-2 onto the updated
marvin/program-as-account (SeenShard cap fix), regenerating program
and circuit artifacts plus the sequencer test fixture to match.
Also removes lez/wallet's now-unused base58 dependency, dead since
AccountId gained its own Display/FromStr base58 encoding.
* docs(lee): trim DEFAULT_PROGRAM_OWNER and From<AccountId> for ProgramId docs
* test(lee): add known-answer tests for ProgramId/AccountId conversion, rebuild artifacts
* fix(lee): apply program_owner AccountId migration to code added after rebase
dev grew new program_owner call sites (sequencer_stake genesis/config
handling, committee_discovery, a new selective_pda_delegator test
program, and related tests) after this branch's ProgramId->AccountId
migration commit was originally written, so they predated the .into()
sweep and didn't conflict during the rebase - they just still assumed
the old ProgramId-typed field. Converts all of them, fixes a stray
unseparated hex literal clippy caught along the way, and rebuilds
artifacts against the fixed source.
* chore(lee): regenerate test fixture after rebasing onto dev
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
BREAKING CHANGE: IndexerSyncState gains Halted, so a pre-existing typed client fails to decode getStatus while an indexer is halted; the protocol enum now carries an Unknown fallback so this class of break ends here.
BREAKING CHANGE: WrappedTokenConfig and ReceiverConfig gain a governance field and CrossZoneConfig gains source_governance, so the config layouts change and every program image id moves.
BREAKING CHANGE: WrappedTokenConfig and ReceiverConfig gain an authority field and CrossZoneConfig gains source_authority, so the config layouts change and every program image id moves.
BREAKING CHANGE: InboxConfig is just self_zone; allowed_routes, InboxConfig::permits
and routes_permit are gone, and build_inbox_init_config_tx no longer takes the
cross-zone config. The operator's per-peer routes still configure the same thing,
fanned out at genesis into each target's own config instead. The watcher keeps
only a hygiene filter refusing a peer that names a sequencer-only program, kept
host-side so it cannot make the verifier disagree.
BREAKING CHANGE: ping_receiver gains a config PDA holding the deliverer and the
peer sources it accepts, ReceiverInstruction gains InitConfig, and Record takes
[source marker, config, record] instead of the record alone. Every emitter aimed
at ping_receiver must name its config account in target_accounts. The
ping_receiver and ping_sender image ids move, and a fresh genesis is required.
BREAKING CHANGE: the wrapped-token config PDA holds a borsh WrappedTokenConfig
(minter plus authorized source pairs) rather than a bare minter id, and
Instruction::InitConfig takes it as a single field. Mint now refuses a source the
token has not authorized, checked against the inbox's source marker. The
wrapped_token image id moves, and bridge_lock's with it, since it links
wrapped_token_core.
BREAKING CHANGE: an inbox dispatch now declares [config, seen shard, source
marker, ...target accounts], and a target's chained call receives the marker at
position 0, so wrapped_token::Mint and ping_receiver::Record each take one more
leading account. The inbox, wrapped_token and ping_receiver image ids move,
relocating their PDAs and requiring a fresh genesis.
BREAKING CHANGE: Instruction::Lock drops outbox_program_id and takes the
bridge-lock config PDA as its first account, changing both the instruction
encoding and the account list. bridge_lock's image id moves, relocating its
escrow and config PDAs and requiring a fresh genesis. Sequencer, indexer and
every peer zone must upgrade together: a stale decoder re-derives a different
dispatch and reports Forged.
BREAKING CHANGE: SenderInstruction::Send drops outbox_program_id and takes the
sender config PDA as its first account, changing both the instruction encoding
and the account list. ping_sender's image id moves, relocating its PDAs and
requiring a fresh genesis. Sequencer, indexer and every peer zone must upgrade
together: a stale decoder re-derives a different dispatch and reports Forged.
BREAKING CHANGE: `CrossZoneMessage` gains `src_block_hash`, changing the risc0
encoding of `cross_zone_inbox::Instruction::Dispatch` and the inbox image id,
and with it the inbox config and seen-shard PDA addresses. A pending dispatch
record written by earlier code no longer names a registered program, so it fails
production and is dead-lettered rather than delivered. Drain the pending list
before upgrading, or accept that in-flight deliveries are lost.
BREAKING CHANGE: `CrossZonePeer.allowed_targets` is replaced by `allowed_routes`,
a list of `{src_program_id, target_program_id}` pairs. `InboxConfig.allowed_peers`
is removed.
BREAKING CHANGE: GenesisAction::DeployProgram and IndexerConfig.deploy_programs are removed. The cross-zone programs (inbox, outbox, ping_sender, ping_receiver, bridge_lock, wrapped_token) are now base builtins in testnet_initial_state, because program bytecode exceeds the genesis block inscription limit, so they cannot be shipped through genesis transactions.
Cross-zone builtin programs are no longer registered in the production
genesis. A zone that participates declares the ones it uses via a new
GenesisAction::DeployProgram (sequencer) and a matching deploy_programs
list (indexer), both resolved through CrossZoneProgram and registered
with with_programs. Cross-zone genesis accounts (inbox config,
wrapped-token config) are seeded through the state constructor for a
receiving zone, and bridge-lock holdings are seeded from their actions
regardless of receiving config, dropping V03State::insert_genesis_account.
GenesisAction amounts now use the Balance alias. Documents cross_zone as
the reference LEZ adapter and the bridge demo as not production-safe.
The sequencer's DeployProgram set and the indexer's deploy_programs are
configured separately, so both nodes now log a deterministic genesis
fingerprint (V03State::genesis_fingerprint) at startup: equal values
confirm the two genesis states agree, a mismatch flags a divergent
deploy set.
BREAKING CHANGE: the genesis state root changes (cross-zone builtins are
out of production genesis) and the sequencer/indexer configs gain the
DeployProgram / deploy_programs list that cross-zone-participating zones
must set.
Integrates origin/main (per-program-crate refactor) and re-homes the cross-zone messaging feature onto it.
BREAKING CHANGE: Genesis state root changes. This registers six builtin programs
(cross_zone_outbox, cross_zone_inbox, ping_sender, ping_receiver, bridge_lock,
wrapped_token) and seeds their genesis accounts (the wrapped_token authorized
minter config, the per-zone inbox config, and optional bridge-lock holdings).
Building the new cores alongside the existing builtins also enables serde/alloc
for the shared programs build, regenerating every builtin program image id. All
nodes must upgrade together.
Artem Gureev