BREAKING CHANGE: CrossZonePeer.expected_block_signing_pubkey (single optional
key) is renamed to expected_block_signing_pubkeys (a list, empty = unchecked),
and cross-zone config now refuses unknown fields at startup.
* feat(lee): store deployed programs as Account-shaped state, keyed by AccountId
Program-as-Account migration, first slice: V03State.programs becomes
HashMap<AccountId, Account> instead of HashMap<ProgramId, Program>,
with the elf held directly in Account.data. The map key is derived
from ProgramId via a new 1:1 From<ProgramId> for AccountId conversion
(both types are exactly 32 bytes) rather than a hash, since ProgramId
is already content-derived from the elf.
Account.program_owner stays ProgramId-typed everywhere - this only
changes how deployed programs are stored and looked up host-side, not
the dispatch/authorization model any guest program logic depends on.
Dispatch resolves a ChainedCall's program_id by converting to
AccountId, fetching the Account, and reconstructing a Program via
new_unchecked for execution.
DATA_MAX_LENGTH is raised from 100 KiB to 700 KiB to fit real program
elfs (observed 375 KB-631 KB) directly in Account.data; noted in its
docstring as a rough placeholder pending real transaction/block-size
budget analysis.
* fix(lee): store deployed programs as Account-shaped state, correct SeenShard cap
Corrects lee/state_machine internals for the Program-as-Account migration
and fixes SeenShard::MAX_DELIVERIES, which was still calibrated for the
old 100 KiB DATA_MAX_LENGTH instead of the current 700 KiB cap. Rebuilds
program artifacts and the sequencer test fixture to match.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* address PR #720 review nits
- Use FIXME instead of TODO for the temporary ProgramId->AccountId
conversion, per review convention for patches guaranteed to be
fixed later.
- Derive cross_zone_inbox's MAX_DELIVERIES from DATA_MAX_LENGTH
instead of a hand-recomputed literal, so it stays in sync
automatically the next time the cap changes.
* chore: regenerate artifacts after rebasing onto dev
Binary program artifacts and the prebuilt sequencer DB dump were left
as rebase-conflict placeholders; regenerated via `just build-artifacts`
against the fully rebased source.
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
BREAKING CHANGE: WrappedTokenConfig and ReceiverConfig gain a governance field and CrossZoneConfig gains source_governance, so the config layouts change and every program image id moves.
BREAKING CHANGE: WrappedTokenConfig and ReceiverConfig gain an authority field and CrossZoneConfig gains source_authority, so the config layouts change and every program image id moves.
Every guest moved, not only the ones whose source changed: adding real
dependencies (borsh to two cores, cross_zone_inbox_core to two targets) changes
the build graph, and with it the metadata hash of every crate in the guest build.
Piece A moved only three because it added a dev-dependency, which the guest build
never sees.
BREAKING CHANGE: InboxConfig is just self_zone; allowed_routes, InboxConfig::permits
and routes_permit are gone, and build_inbox_init_config_tx no longer takes the
cross-zone config. The operator's per-peer routes still configure the same thing,
fanned out at genesis into each target's own config instead. The watcher keeps
only a hygiene filter refusing a peer that names a sequencer-only program, kept
host-side so it cannot make the verifier disagree.
BREAKING CHANGE: an inbox dispatch now declares [config, seen shard, source
marker, ...target accounts], and a target's chained call receives the marker at
position 0, so wrapped_token::Mint and ping_receiver::Record each take one more
leading account. The inbox, wrapped_token and ping_receiver image ids move,
relocating their PDAs and requiring a fresh genesis.
Closes#676.
BREAKING CHANGE: the seen-shard PDA address and its data layout both change, so
every message delivered under the old layout becomes deliverable again at the new
address, and the old shards are orphaned. A fresh genesis is required.
BREAKING CHANGE: `CrossZoneMessage` gains `src_block_hash`, changing the risc0
encoding of `cross_zone_inbox::Instruction::Dispatch` and the inbox image id,
and with it the inbox config and seen-shard PDA addresses. A pending dispatch
record written by earlier code no longer names a registered program, so it fails
production and is dead-lettered rather than delivered. Drain the pending list
before upgrading, or accept that in-flight deliveries are lost.
BREAKING CHANGE: `CrossZonePeer.allowed_targets` is replaced by `allowed_routes`,
a list of `{src_program_id, target_program_id}` pairs. `InboxConfig.allowed_peers`
is removed.
Integrates origin/main (per-program-crate refactor) and re-homes the cross-zone messaging feature onto it.
BREAKING CHANGE: Genesis state root changes. This registers six builtin programs
(cross_zone_outbox, cross_zone_inbox, ping_sender, ping_receiver, bridge_lock,
wrapped_token) and seeds their genesis accounts (the wrapped_token authorized
minter config, the per-zone inbox config, and optional bridge-lock holdings).
Building the new cores alongside the existing builtins also enables serde/alloc
for the shared programs build, regenerating every builtin program image id. All
nodes must upgrade together.
Artem Gureev