Conversation
vfusco
requested review from
mpolitzer and
renatomaia
and
a balanced review from Copilot
September 22, 2026 20:49
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
A critical PRT transaction-liveness defect and two moderate correctness/configuration issues remain unresolved.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Updates the node for Rollups Contracts 3.0.0-alpha.10 and Dave 3.0.0-alpha.4, including InputBox-based applications, passive PRT dispute observation, and JSON-RPC exposure.
Changes:
- Replaces legacy data-availability metadata with application InputBox addresses.
- Adds PRT tournament observation, state proofs, bond events, and recovery handling.
- Updates deployment, CLI, persistence, compose, and integration infrastructure.
Blocking findings:
- Critical (2 votes):
internal/prt/pending.gopermanently retains dropped or replaced transactions, blocking future PRT actions until restart. - Moderate (1 vote):
compose.individual-services.yamllacks a PRT service and required authentication settings. - Moderate (1 vote):
cmd/cartesi-rollups-cli/root/contract/commitment.goundercounts inclusive clock blocks by one.
| File | Description |
|---|---|
test/validator/validator_test.go |
Removes legacy data-availability fixtures. |
test/integration/testdata/InputRelay.sol |
Adds an input relay test contract. |
test/integration/testdata/input_relay_bytecode.hex |
Adds relay deployment bytecode. |
test/integration/testdata/input_relay_abi.json |
Adds the relay ABI. |
test/integration/snapshot_policy_test.go |
Uses relayed inputs and updated PRT finalization. |
test/integration/reject_exception_prt_test.go |
Updates PRT epoch finalization. |
test/integration/reader_node_helpers_test.go |
Adds reader-node lifecycle helpers. |
test/integration/node_subprocess_test.go |
Adds subprocess lifecycle handling. |
test/integration/multinode_helpers_test.go |
Reuses subprocess lifecycle handling. |
test/integration/multi_app_test.go |
Verifies per-application InputBox behavior. |
test/integration/lifecycle_test.go |
Tests relayed inputs and voucher routing. |
test/integration/foreclose_test.go |
Sends foreclosure inputs through relays. |
test/integration/foreclose_replay_test.go |
Updates replay and reader-mode setup. |
test/integration/foreclose_prt_test.go |
Adapts the PRT foreclosure lifecycle. |
test/integration/echo_prt_test.go |
Updates PRT deployment and finalization. |
test/dapps/erc20-withdrawal/install.sh |
Encodes uint96 account balances. |
test/compose/compose.test.yaml |
Updates test addresses and PRT signer. |
test/compose/compose.integration.yaml |
Updates integration addresses and signer. |
scripts/withdrawal-lifecycle |
Updates portal and token defaults. |
scripts/load-test.sh |
Uses non-blocking transaction submission. |
pkg/ethutil/withdrawal_account_test.go |
Tests uint96 withdrawal accounts. |
pkg/ethutil/rpcerror.go |
Formats application revert data safely. |
pkg/ethutil/rpcerror_test.go |
Refactors revert test fixtures. |
pkg/ethutil/return_data_test.go |
Tests application return-data formatting. |
pkg/ethutil/quorum.go |
Adds configurable deployment transactions. |
pkg/ethutil/legacy_fees.go |
Adds legacy fee handling. |
pkg/ethutil/ethutil.go |
Replaces data-availability lookup with InputBox lookup. |
pkg/ethutil/ethutil_test.go |
Updates deployment and concurrency tests. |
pkg/ethutil/deployment_transaction.go |
Centralizes deployment transaction execution. |
pkg/ethutil/data-availability.go |
Removes obsolete data-availability utilities. |
pkg/ethutil/authority.go |
Adds configurable authority deployment. |
pkg/ethutil/anvil.go |
Deploys applications with InputBox addresses. |
pkg/contracts/iusdwithdrawaloutputbuilder/iusdwithdrawaloutputbuilder.go |
Updates the withdrawal-builder ABI. |
pkg/contracts/generate/main.go |
Updates binding generation and permissions. |
pkg/contracts/generate/main_test.go |
Tests generated artifact permissions. |
internal/repository/repotest/tournament_test_cases.go |
Tests immutable tournament descriptors. |
internal/repository/repotest/state_proof.go |
Builds state-proof fixtures. |
internal/repository/repotest/state_proof_test.go |
Verifies generated Merkle proofs. |
internal/repository/repotest/node_config_test_cases.go |
Tests atomic configuration initialization. |
internal/repository/repotest/match_test_cases.go |
Removes obsolete match updates. |
internal/repository/repotest/match_advanced_test_cases.go |
Uses event identities for advances. |
internal/repository/postgres/schema/migrations/000001_create_initial_schema.down.sql |
Updates schema rollback. |
internal/repository/postgres/postgres_repo_test.go |
Expands schema contract checks. |
internal/repository/postgres/pagination_range_test.go |
Tests pagination bounds. |
internal/repository/postgres/output.go |
Makes output cursors monotonic. |
internal/repository/postgres/node_config.go |
Adds insert-only configuration initialization. |
internal/repository/postgres/event_column_test.go |
Tests event cursor mapping. |
internal/repository/postgres/db/rollupsdb/public/table/table_use_schema.go |
Adds bond-event schema switching. |
internal/repository/postgres/db/rollupsdb/public/table/commitments.go |
Adds commitment snapshot columns. |
internal/repository/postgres/db/rollupsdb/public/enum/tournamentstandingstate.go |
Adds tournament-standing bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/tournamentkind.go |
Adds tournament-kind bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/matchtimeoutoutcome.go |
Adds timeout-outcome bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/matchphase.go |
Adds match-phase bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/innertournamentdisposition.go |
Adds disposition bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/commitmentside.go |
Adds commitment-side bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/bondeventtype.go |
Adds bond-event type bindings. |
internal/repository/postgres/db/rollupsdb/public/enum/bonddisposition.go |
Adds bond-disposition bindings. |
internal/repository/node_config_test.go |
Tests saved configuration decoding. |
internal/prt/warnings.go |
Adds PRT operational warnings. |
internal/prt/supervisor_readiness_test.go |
Tests observation readiness reporting. |
internal/prt/state_proof_test.go |
Tests Dave proof encoding. |
internal/prt/result_observation_lag_test.go |
Tests progress under observer lag. |
internal/prt/pending.go |
Tracks pending PRT transactions. |
internal/prt/observation_health.go |
Adds tournament observation health. |
internal/prt/observation_counts.go |
Validates observed event counts. |
internal/prt/call_opts.go |
Adds block-pinned contract calls. |
internal/prt/call_opts_test.go |
Tests pinned call options. |
internal/prt/bond_foreclosure_test.go |
Tests foreclosure bond recovery. |
internal/model/uint256.go |
Adds SQL and JSON uint256 support. |
internal/model/epoch_status_test.go |
Tests epoch-status partitioning. |
internal/model/enum.go |
Centralizes enum scanning. |
internal/merkle/proof_test.go |
Simplifies hash fixtures. |
internal/merkle/builder_test.go |
Checks root-child errors. |
internal/jsonrpc/util_test.go |
Updates PRT response fixtures. |
internal/jsonrpc/match_projection_test.go |
Tests nullable deletion hashes. |
internal/jsonrpc/config_test.go |
Tests persisted configuration validation. |
internal/jsonrpc/batchbudget_test.go |
Adds bond-event batch budgeting. |
internal/jsonrpc/application_contract_test.go |
Tests the InputBox application schema. |
internal/jsonrpc/api/params.go |
Adds event identities and bond parameters. |
internal/jsonrpc/api/params_test.go |
Tests positional parameter ordering. |
internal/evmreader/util.go |
Removes obsolete address mapping. |
internal/evmreader/service.go |
Simplifies persistent configuration. |
internal/evmreader/readiness_test.go |
Updates InputBox readiness checks. |
internal/evmreader/input_deployment_test.go |
Tests predeployment input observation. |
internal/evmreader/foreclosure.go |
Adds blocked-foreclosure warnings. |
internal/evmreader/foreclosure_test.go |
Tests foreclosure diagnostics. |
internal/evmreader/fixtures_test.go |
Updates shared InputBox fixtures. |
internal/evmreader/evmreader_test.go |
Updates scan expectations. |
internal/evmreader/edge_cases_test.go |
Removes legacy input-reader assumptions. |
internal/evmreader/daveconsensus_adapter.go |
Introduces sealed-epoch DTOs. |
internal/evmreader/block_scan_plan.go |
Routes all consensus InputBoxes. |
internal/evmreader/block_scan_plan_test.go |
Updates scan-plan tests. |
internal/evmreader/adapter_resolver.go |
Removes data-availability cache state. |
internal/evmreader/adapter_resolver_test.go |
Updates adapter invalidation tests. |
internal/cli/types.go |
Unifies transaction result output. |
internal/cli/prompt.go |
Separates prompt output streams. |
internal/cli/ethereum.go |
Applies CLI fee policy. |
internal/claimer/submit.go |
Requires complete claim state proofs. |
internal/claimer/state_proof.go |
Converts model proofs to contract proofs. |
internal/claimer/state_proof_test.go |
Tests claim proof submission. |
internal/claimer/repository.go |
Adds configuration initialization APIs. |
internal/claimer/mocks_test.go |
Updates claimer mocks. |
internal/claimer/inflight_test.go |
Updates proof-aware expectations. |
internal/claimer/foreclosure.go |
Clarifies failed-app drain behavior. |
internal/claimer/claimer.go |
Updates PRT and shutdown handling. |
internal/claimer/claimer_test.go |
Tests cancellation error preservation. |
internal/appstatus/appstatus.go |
Warns about blocked foreclosure drains. |
internal/appstatus/appstatus_test.go |
Tests failed-foreclosure diagnostics. |
internal/advancer/publication_test.go |
Tests obsolete proof publication. |
internal/advancer/advancer.go |
Handles foreclosure publication races. |
go.mod |
Promotes uint256 to a direct dependency. |
Dockerfile |
Upgrades golangci-lint. |
compose.yaml |
Updates contracts and PRT signer configuration. |
compose.individual-services.yaml |
Updates deployed contract addresses. |
cmd/cartesi-rollups-node/root/root.go |
Removes the input-reader flag. |
cmd/cartesi-rollups-machine-tool/accountdrive/accountdrive.go |
Supports uint96 account balances. |
cmd/cartesi-rollups-evm-reader/root/root.go |
Removes the input-reader flag. |
cmd/cartesi-rollups-cli/root/root.go |
Adds refund and transaction options. |
cmd/cartesi-rollups-cli/root/read/service/repository.go |
Reads advances by event identity. |
cmd/cartesi-rollups-cli/root/read/service/jsonrpc.go |
Validates advance event identities. |
cmd/cartesi-rollups-cli/root/deposit/receipt.go |
Verifies portal-generated inputs. |
cmd/cartesi-rollups-cli/root/deploy/sentries.go |
Adds PRT sentry configuration. |
cmd/cartesi-rollups-cli/root/deploy/quorum.go |
Adds transaction-aware quorum deployment. |
cmd/cartesi-rollups-cli/root/deploy/quorum_test.go |
Refactors quorum fixtures. |
cmd/cartesi-rollups-cli/root/deploy/deploy.go |
Clarifies staging-period semantics. |
cmd/cartesi-rollups-cli/root/deploy/broadcast.go |
Reports unconfirmed deployment addresses. |
cmd/cartesi-rollups-cli/root/deploy/authority.go |
Adds transaction-aware authority deployment. |
cmd/cartesi-rollups-cli/root/deploy/application_test.go |
Tests deployment validation and removed flags. |
cmd/cartesi-rollups-cli/root/contract/match_test.go |
Tests updated match projections. |
cmd/cartesi-rollups-cli/root/contract/inputbox.go |
Resolves InputBox from applications. |
cmd/cartesi-rollups-cli/root/contract/inputbox_test.go |
Tests application InputBox resolution. |
cmd/cartesi-rollups-cli/root/contract/format.go |
Formats new tournament enums. |
cmd/cartesi-rollups-cli/root/contract/format_test.go |
Tests enum formatting. |
cmd/cartesi-rollups-cli/root/contract/contract.go |
Removes global InputBox override documentation. |
cmd/cartesi-rollups-cli/root/contract/consensus.go |
Displays sentries and staged results. |
cmd/cartesi-rollups-cli/root/contract/commitment.go |
Displays updated commitment standing. |
cmd/cartesi-rollups-cli/root/contract/app.go |
Displays application InputBox details. |
cmd/cartesi-rollups-cli/root/app/status/status.go |
Documents failed-app recovery risks. |
cmd/cartesi-rollups-cli/root/app/register/register_test.go |
Tests removal of legacy InputBox flags. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
vfusco
force-pushed
the
feature/contracts-bump
branch
from
September 24, 2026 14:09
e6d5f1a to
d62119f
Compare
mpolitzer
reviewed
Sep 24, 2026
mpolitzer
reviewed
Sep 24, 2026
mpolitzer
reviewed
Sep 24, 2026
vfusco
force-pushed
the
feature/contracts-bump
branch
2 times, most recently
from
September 24, 2026 20:19
830e649 to
0baf78f
Compare
mpolitzer
reviewed
Sep 28, 2026
mpolitzer
reviewed
Sep 28, 2026
Use rollups-contracts v3.0.0-alpha.10 and Dave v3.0.0-alpha.4. Pin the official artifact names and SHA-256 checksums. Key extraction stamps by version and checksum so a previous extraction cannot silently satisfy the new dependency. This commit changes artifact selection only; devnet and generated bindings follow separately.
vfusco
force-pushed
the
feature/contracts-bump
branch
from
September 29, 2026 04:37
0baf78f to
76b046b
Compare
vfusco
changed the title
Use the official Dave deployment bundle and its Anvil version. The bundle includes the USD withdrawal output builder, so the devnet image does not deploy another copy. Update the development addresses in Makefile, Compose, and the withdrawal script together. Keep deployments.json generated at devnet startup; do not add a tracked deployment manifest or an address-generation layer.
Generated source must be usable by the human and agent accounts in the same staff group. Give binding directories and files explicit shared access after creation, including under a restrictive caller umask. Normalize only the generated database tree after Jet runs. Add a subprocess test for binding permissions. Do not change permissions of unrelated checkout files.
Generate bindings from rollups-contracts v3.0.0-alpha.10 and Dave v3.0.0-alpha.4. Use the upstream public ERC interfaces, the renamed IErc20Portal, and IMultiLevelTournamentFactory. Remove DataAvailability from the generation list and generated packages. The node targets the new contracts; no legacy compatibility path is added.
Use direct InputBox references and the new application and consensus factory arguments. Read complete return data and expose the new staging and tournament configuration through the shared Ethereum helpers. Use the final USD withdrawal account layout and update revert decoding. Keep helper tests and the RPC test synchronization correction with the implementation they verify. Allow callers to control deployment broadcast and receipt waiting while keeping factory construction, result parsing, and verification here. Retain existing Deploy entry points and signed hashes on send failures. Provide an explicit legacy-fee factory with a fresh suggested price for each transaction. Keep network-based automatic selection for callers that do not opt in.
Use one checked conversion for PostgreSQL enum scans. Preserve rejection of unsupported input types and unknown values. Convert the existing enum Scan methods before adding the new PRT enum types. Tests cover accepted strings and byte slices, invalid values, and the requirement to leave the destination unchanged after failure.
Remove the obsolete application data-availability selector. Define the final tournament, commitment, match, clock, and bond observation types, including their block anchors and exact uint256 values. Expose owned copies of persisted machine proofs and one shared set of non-terminal epoch statuses. Add JSON, enum, numeric-boundary, proof ownership, and status-set tests, plus the shared proof test builder. BREAKING CHANGE: application and dispute model fields now describe the new v3 contracts; the legacy data-availability field is removed.
Require explicit saved chain, observation policy, and submission mode values. Reject changes instead of silently replacing requested or stored settings. Keep submission transitions outside this release.
Use the shared transaction path for foreclosure, drive-root proof, and withdrawal. Keep manual gas limits, check mined receipts by default, and expose --no-wait. Preserve signed hashes and put results on stdout. Require the Application drive-root event with the exact submitted root. Check its full event data, including the zero-root case. Test missing, malformed, unrelated, and matching events through the actual binding. Explain when FAILED blocks foreclosure work and require repair before operators clear it. Show the blocked state in application status output.
Add a refund command for deposits left unfinalized after foreclosure. Submit issueRefund with the application-wide input index and complete original input bytes. The contract checks eligibility and constructs the refund output; the CLI does not duplicate those checks. Use the shared signing, confirmation, broadcast, and receipt policy. Require an Application RefundIssued event with the exact index and input before reporting a mined result. Preserve manual gas and strict no-wait. Test argument parsing, signed calldata, output, and receipt evidence. Authority, Quorum, and PRT lifecycle tests follow in the integration section of this series.
Exercise all ten transaction command forms through the actual root in isolated processes. Check shared help, explicit help, and failed broadcast and receipt errors. Preserve the signed hash without usage or a success result. Place these cross-command tests after all CLI implementations.
Configure PRT transactions through CARTESI_PRT_AUTH_* settings. Keep Claimer and CLI authentication independent. Use account 6 for the development PRT mnemonic and account 0 for claims. Allow operators to select the same address in both configurations. Tests verify separate credential selection and explicit account zero. BREAKING CHANGE: PRT submission requires its own authentication settings.
Explain the FAILED health gate when failure or foreclosure is recorded. Keep observation and health policy unchanged. Recovery requires repair before the operator clears FAILED.
Resolve and scan the InputBox assigned to each application. Remove the legacy data-availability selector gate. Keep adapter resolution and distinct-InputBox tests with this change. Sealed-epoch completeness and restart behavior are handled separately in the next commit. Remove the obsolete input-reader switch. Validate saved chain and observation settings at startup, and explain blocked foreclosure work without weakening health gates. Complete each application input scan before advancing its cursor. Return operation errors to one logging boundary instead of replacing them with a generic incomplete-scan marker. Keep real failures visible during shutdown, preserve progress for healthy applications, and stop dispatching work after context cancellation. Store no-input epoch closures and their cursors atomically. Cover cancellation, compound errors, failed reads and writes, partial progress, and readiness in unit tests.
Wait until Dave deployment is visible at the configured observation block before scanning its sealed epochs and inputs. Do not persist a bootstrap cursor that claims an unscanned range is complete. Validate each sealed-epoch window against the on-chain count and epoch identity. Retry interrupted scans from the completed cursor, preserve already-computed epoch data, and checkpoint only complete input blocks. Report conflicting input identities instead of retrying the same failed insert forever. Include deployment, replay, checkpoint, identity, and logging regression tests with the final scanner implementation.
Treat ErrEpochForeclosed as a publication superseded by the foreclosure drain. Do not turn this expected race into a processing failure. Keep shutdown cancellation separate from dependency failures. Preserve all causes through Step and Tick, stop dispatch after cancellation, and keep mixed database failures on the fatal unconfirmed-write path. Always close the advanced machine when its result was not confirmed saved. Remove the old shutdown exception for missing machines. Both entry points close the machine manager after the supervised services have stopped. Keep publication, shutdown, service-log, and write-failure regression tests with this component. Include small lint cleanups in the affected test file.
Handle a claim publication that loses to foreclosure without restoring non-terminal claim state or reporting local corruption. Include the focused publication test, remove obsolete data-availability fixture fields, and keep the nearby Validator cleanup in this component. Treat failure to prove the freshly built commitment tree as an internal FAILED condition. Keep invalid stored dimensions, repetitions, and final hashes classified as CORRUPTED.
Check the Merkle test setup error and simplify the empty expected hash slice. Keep these small pre-existing test cleanups out of service and repository commits.
Submit the machine root and the complete three-leaf validity proof to IConsensus. Build the ABI proof from owned persisted proof data and reject incomplete state before submission. Introduce the final shared revert recognizer and direct ABI status decoding. Keep known proof failures distinct from race, staging, and application-call failures. The following commit supplies Authority owner evidence for otherwise-unclassified submission errors. Include submission, proof, revert, and in-flight regression tests. Validate saved chain, observation policy, and submission mode before constructing the signer. Use insert-only startup configuration and honor the explicit legacy-fee override. # Conflicts: # internal/claimer/reverts.go # internal/claimer/reverts_test.go # internal/claimer/service.go # internal/claimer/service_test.go
For an otherwise-unclassified Authority submission revert, read the owner at the configured block and at latest. Preserve the original submission error with the owner evidence. If owner views differ, wait for confirmation. If both views agree and exclude the configured signer, report a recoverable configuration failure. Known contract and proof errors keep their more specific diagnosis. Add real RPC-path ownership-transfer and mismatch tests.
Read the final DaveConsensus and tournament API through typed adapters. Use shared model enums from the start, preserve exact uint256 values, and reject invalid contract return values. Reads that form a current observation must use one explicit block. Expose descriptors, standing, match phases, clocks, structural event counts, staging conditions, child results, and bond disposition. Keep ABI decoding tests on the real RPC-to-binding-to-adapter path so argument order and field wiring are covered. The next PRT commits introduce final helpers before the service cycle connects them. Shared service fields and test adapters are declared once; no temporary protocol implementation or legacy adapter is added.
Build complete root and child tournament observations without writing the database or sending transactions. Read event history and current contract views at the same block, then construct the repository batches. Validate descriptors, standing, structural event counts, and financial events. Preserve deletion evidence for matches whose contract storage was removed. Stop repeated reads of a clone only after a complete committed observation proves its views are immutable. Continue checking its children; a finished parent does not make its descendants immutable. Replace the old gathering and partial-save helpers with this final path. Tests cover projections, deleted matches, event completeness, retirement, and warning behavior. Publication and local claim decisions are separate responsibilities in the next commits.
Observe tournaments for every enabled PRT application, independently of local claim readiness or local machine health. Bound root discovery by the completed sealed-epoch scan and the configured observation block. After foreclosure, continue observing the already-discovered tournaments. Gather all root and child batches before calling the atomic repository publisher. Advance the in-memory cursor only after that call succeeds. A failed window must not expose partial dispute data or a new cursor. Report repeated observation failures through readiness as configured heads advance. Do not turn observation failure into local claim corruption. Include checkpoint, passive-observation, and health tests. This operation does not reconcile claims or submit transactions.
Compare local claims with chain state only after the relevant dispute window has been published. Validate the pinned consensus snapshot and record the on-chain staging block for matching local epochs. Compare the local commitment with the published root-tournament winner. For acceptance, verify the observed transaction and its EpochSealed log against the local machine root and outputs root. An acceptance newer than the published window must wait. Publish the full dispute evidence before a losing local claim marks the app DIVERGED. Keep the final root-bond queue calls in their claim-reconciliation callers; the recovery implementation follows separately. Boundary, lag, and result-projection tests cover the confirmed-state rules. This code does not choose or broadcast a new tournament action.
Provide the final root join, tournament-result stage, and acceptance operations. Encode the full machine proof and classify contract reverts without treating latest-only evidence as confirmed application state. Use an in-memory exclusion slot for pending join, stage, and accept transactions. Even a mined receipt makes the current tick yield, so the next action uses a fresh chain view. Receipts alone do not set claim status. Include proof, pending-transaction, and revert tests. Remove the obsolete settle path. Keep the final bond-queue call in the acceptance operation. Action selection is connected in the service-cycle commit; active dispute moves and persistent transaction delivery remain outside this contract bump.
vfusco
force-pushed
the
feature/contracts-bump
branch
from
September 29, 2026 14:26
76b046b to
4107e17
Compare
mpolitzer
reviewed
Sep 29, 2026
Track node-owned root-bond recovery candidates in memory. Before a recovery broadcast, read the on-chain bond disposition, eligible epoch, and payment owner. Retire completed, impossible, or foreign candidates. Reconcile an existing recovery transaction before starting another and respect other pending PRT mutations. Include ownership, disposition, receipt, and foreclosure recovery-operation tests. This is bounded payment maintenance, not a persistent delivery queue. The next commit supplies the final selection rule that gives join, stage, and accept priority over a new recovery broadcast.
Connect the final PRT helpers through one service cycle. For each enabled application, observe first, then reconcile healthy local claims against published chain state. Read publishable results at the minimum of the configured block and the published tournament cursor. Use latest separately to select live actions, not to confirm database staging or terminal application status. Keep progressTournamentResult whole: pending transactions, published result reads, latest-state checks, and action priority are one decision path. A required join, stage, or accept takes priority over a new bond recovery. If the local claim is not ready for an open join window, do not fill that gap with a new recovery transaction. During foreclosure, continue observation and eligible queued recovery, but send no new join, stage, or accept. Wait for both ingestion cursors and local processing, reconcile accepted claims, then terminalize the remaining claims. Include service-cycle, block-policy, foreclosure, recovery-selection, shutdown, and cancellation tests. This completes the PRT wiring without an intermediate service-loop design. The node still observes disputes but does not submit dispute moves. Persistent transaction delivery remains a separate change. Validate saved chain, observation policy, and submission mode before constructing the signer. Honor the explicit legacy-fee override and retain observe-first application selection.
Adapt end-to-end workflows to v3 deployment, direct InputBox access, machine proofs, and staging. Update the withdrawal application fixture for the USD account layout. Cover Authority, Quorum, and PRT lifecycles, staging and sentry timing, foreclosure and replay, same-block inputs, restarts, and snapshot policy. Keep the shared Anvil and input-relay fixtures here. Verify address-only send and file-based execute without database access. Reject a mined no-op at a code-free address with manual gas, then prove valid execution and node indexing. Keep decimal text and hex JSON. Passive dispute observation and deposit refunds have separate following integration commits so reviewers can inspect those scenarios separately.
Drive dispute lifecycles with external test participants while the node observes passively. Verify the tournament drill-down API, child and match state, immutable event identities, and financial events. Cover both a matching external winner and a losing local commitment. Include sparse commitment fixtures, observer configuration and cleanup checks, and the PRT shard registration. These transaction-driving helpers are test fixtures, not active dispute support in the node.
Exercise the refund CLI against foreclosed Authority, Quorum, and PRT applications. Verify the unfinalized deposit lifecycle and the resulting refund transaction through the deployed contracts. Include the refund suite in the withdrawal shard. This completes the command introduced earlier without mixing CLI implementation into the end-to-end test commit.
Keep validator root-value checks separate from stored-state corruption. Preserve malformed accepted-yield results with their final proof and PRT hash collection in the existing atomic terminal-input path. Expose INVALID_OUTPUTS_ROOT in the model, database, CLI and JSON-RPC schema. Keep the diagnosis immutable while enabled observation continues. Add regression and native guest-fixture coverage; live integration verification remains pending.
vfusco
force-pushed
the
feature/contracts-bump
branch
from
September 29, 2026 19:31
e7d2d43 to
e99e85a
Compare
vfusco
marked this pull request as ready for review
September 29, 2026 19:32
renatomaia
approved these changes
Sep 29, 2026
mpolitzer
approved these changes
Sep 29, 2026
vfusco
added this pull request to stack #802
October 2, 2026 00:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adapts the node to new claim, deployment, and tournament interfaces. It also makes externally conducted disputes visible through JSON-RPC. It does not add active dispute responses.
The basic node workflow stays the same. EVM Reader stores inputs. Advancer executes them in the Cartesi Machine. Validator computes claims and output proofs. Claimer or PRT submits the result to the appropriate consensus contract. These services share PostgreSQL. JSON-RPC reads the stored results.