BREAKING CHANGE: CrossZonePeer.expected_block_signing_pubkey (single optional
key) is renamed to expected_block_signing_pubkeys (a list, empty = unchecked),
and cross-zone config now refuses unknown fields at startup.
Every guest moved, not only the ones whose source changed: adding real
dependencies (borsh to two cores, cross_zone_inbox_core to two targets) changes
the build graph, and with it the metadata hash of every crate in the guest build.
Piece A moved only three because it added a dev-dependency, which the guest build
never sees.
BREAKING CHANGE: InboxConfig is just self_zone; allowed_routes, InboxConfig::permits
and routes_permit are gone, and build_inbox_init_config_tx no longer takes the
cross-zone config. The operator's per-peer routes still configure the same thing,
fanned out at genesis into each target's own config instead. The watcher keeps
only a hygiene filter refusing a peer that names a sequencer-only program, kept
host-side so it cannot make the verifier disagree.
BREAKING CHANGE: ping_receiver gains a config PDA holding the deliverer and the
peer sources it accepts, ReceiverInstruction gains InitConfig, and Record takes
[source marker, config, record] instead of the record alone. Every emitter aimed
at ping_receiver must name its config account in target_accounts. The
ping_receiver and ping_sender image ids move, and a fresh genesis is required.
BREAKING CHANGE: the wrapped-token config PDA holds a borsh WrappedTokenConfig
(minter plus authorized source pairs) rather than a bare minter id, and
Instruction::InitConfig takes it as a single field. Mint now refuses a source the
token has not authorized, checked against the inbox's source marker. The
wrapped_token image id moves, and bridge_lock's with it, since it links
wrapped_token_core.
BREAKING CHANGE: an inbox dispatch now declares [config, seen shard, source
marker, ...target accounts], and a target's chained call receives the marker at
position 0, so wrapped_token::Mint and ping_receiver::Record each take one more
leading account. The inbox, wrapped_token and ping_receiver image ids move,
relocating their PDAs and requiring a fresh genesis.
BREAKING CHANGE: Instruction::Lock drops outbox_program_id and takes the
bridge-lock config PDA as its first account, changing both the instruction
encoding and the account list. bridge_lock's image id moves, relocating its
escrow and config PDAs and requiring a fresh genesis. Sequencer, indexer and
every peer zone must upgrade together: a stale decoder re-derives a different
dispatch and reports Forged.
BREAKING CHANGE: SenderInstruction::Send drops outbox_program_id and takes the
sender config PDA as its first account, changing both the instruction encoding
and the account list. ping_sender's image id moves, relocating its PDAs and
requiring a fresh genesis. Sequencer, indexer and every peer zone must upgrade
together: a stale decoder re-derives a different dispatch and reports Forged.
Closes#675.
BREAKING CHANGE: an outbox message PDA is now derived from the emitting program
as well as the destination zone and ordinal, and the seed domain moves to
/00001/, so every outbox record address changes. `OutboxRecord` gains `emitter`
and `ordinal`, changing its borsh layout, so records written by earlier code are
orphaned at their old addresses and no longer decode. A second `Emit` at the same
(emitter, target_zone, ordinal) now fails the transaction instead of silently
overwriting the record, so a caller must choose an ordinal the chain does not
already hold rather than counting from zero. A fresh genesis is required.
Closes#678.
BREAKING CHANGE: `wrapped_token` and `bridge_lock` image ids move, relocating the
wrapped-token config and every holding PDA. A lock above the cap is now refused
at the source rather than escrowing balance the destination will not mint.
Closes#676.
BREAKING CHANGE: the seen-shard PDA address and its data layout both change, so
every message delivered under the old layout becomes deliverable again at the new
address, and the old shards are orphaned. A fresh genesis is required.
BREAKING CHANGE: `CrossZoneMessage` gains `src_block_hash`, changing the risc0
encoding of `cross_zone_inbox::Instruction::Dispatch` and the inbox image id,
and with it the inbox config and seen-shard PDA addresses. A pending dispatch
record written by earlier code no longer names a registered program, so it fails
production and is dead-lettered rather than delivered. Drain the pending list
before upgrading, or accept that in-flight deliveries are lost.
BREAKING CHANGE: `CrossZonePeer.allowed_targets` is replaced by `allowed_routes`,
a list of `{src_program_id, target_program_id}` pairs. `InboxConfig.allowed_peers`
is removed.
Integrates origin/main (per-program-crate refactor) and re-homes the cross-zone messaging feature onto it.
BREAKING CHANGE: Genesis state root changes. This registers six builtin programs
(cross_zone_outbox, cross_zone_inbox, ping_sender, ping_receiver, bridge_lock,
wrapped_token) and seeds their genesis accounts (the wrapped_token authorized
minter config, the per-zone inbox config, and optional bridge-lock holdings).
Building the new cores alongside the existing builtins also enables serde/alloc
for the shared programs build, regenerating every builtin program image id. All
nodes must upgrade together.
moudyellaz