Marvin Jones af96b8feb7 feat(lee): add private execution of permanently-immutable programs ...

Once a program becomes permanently immutable (update_auth: None
forever, from birth or renouncement), it becomes referenceable inside
privacy-preserving transactions without disclosing which program is
being called. RotateUpdateAuth's renouncement branch now requires the
program to be finalized first, closing a footgun where renouncing
mid-upgrade would permanently strand it.

The native transaction that makes a program permanently immutable
also emits a commitment mirroring its finalized ProgramData directly
into private state - no proof, no nullifier, no ciphertext needed,
since ProgramData isn't confidential and every validating node can
independently recompute the same deterministic commitment. The
private account id reuses the existing PDA address formula with fixed
sentinel key material, documented as such, since this account is
never referenced through the normal nullifier-witness lifecycle -
only ever proven present, never spent.

ProgramImageClaim becomes Public/Private: Public keeps today's public
lookup, Private is anchored against the emitted commitment instead.
The sequencer independently reconstructs either claim before accepting
a proof, exactly as before.

2026-08-23 13:10:43 -04:00

..

lee/privacy_preserving_circuit

feat(lee): add private execution of permanently-immutable programs

2026-08-23 13:10:43 -04:00

lez/programs

feat(lee): add private execution of permanently-immutable programs

2026-08-23 13:10:43 -04:00