feat: Fast upgrades: upgrade permit protocol types

[frankdavid]

First step of the Phase-2 rolling-reboot consensus protocol: the wire format, Rust types, and interfaces for upgrade permits.

• Add UpgradePermitAction (Request / Authorize / Return). UpgradePermitAuthorizationRequest is the signed content, UpgradePermitAuthorizationShare is the gossiped artifact.
• Extend the Crypto trait and MockCrypto with signing/verification of UpgradePermitAuthorizationRequest.
• Register the new proto file with the generator and add UpgradePermitAuthorizationRequest (signing) and UpgradePermitAuthorizationShare (pool-ID hashing) domain separators.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 9ade04f.

Security Overview

• 🔎 Scanned files: 16 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=e2233a1d-a90e-42fd-8f2a-0fdcbb8cdc32&codeScanTypes=PrScan&tab=issues&detectionTypes=traditional,businessLogic,customRule,IAC,SECRETS,CICD,EOL,uncategorized

Detected Code Changes

Change Type	Relevant files
Enhancement	► rs/consensus/utils/src/crypto.rs     UpgradePermitAuthorizationRequest + SignVerify additions ► rs/interfaces/mocks/src/crypto.rs     Mock methods for UpgradePermitAuthorizationRequest signing and verification ► rs/interfaces/src/crypto.rs     Include UpgradePermitAuthorizationRequest in Crypto trait and related signer/verifier capabilities ► rs/interfaces/src/p2p/consensus.rs     Minor wording tweak in comment (polling_immediately)
Enhancement	► rs/protobuf/def/types/v1/upgrade.proto     Add UpgradePermitAuthorizationShareId, UpgradePayload, UpgradePermitAction, UpgradePermitAuthorizationRequest, RequestUpgradePermit, AuthorizeUpgradePermit, ReturnUpgradePermit, UpgradePermitAuthorizationShare
Enhancement	► rs/protobuf/generator/src/lib.rs     Include upgrade.proto in type generation
Enhancement	► rs/protobuf/src/gen/types/types.v1.rs     Add protobuf-generated structs for UpgradePermitAuthorizationShareId, UpgradePayload, UpgradePermitAction, UpgradePermitAuthorizationRequest, RequestUpgradePermit, AuthorizeUpgradePermit, ReturnUpgradePermit, UpgradePermitAuthorizationShare, plus related nested types and conversions
Enhancement	► rs/types/types/src/batch.rs     Expose UpgradePayload from batch upgrade module ► rs/types/types/src/batch/upgrade.rs     New module implementing UpgradePayload with serialization/deserialization and helpers; includes conversions to/from protobuf equivalents and tests
Enhancement	► rs/types/types/src/consensus.rs     Add upgrade module export and UpgradePermitAuthorizationRequest/UpgradePermitAuthorizationShare re-exports
Enhancement	► rs/types/types/src/consensus/upgrade.rs     New module defining UpgradePermitAction and UpgradePermitAuthorizationRequest types, their serde/serialization, hashing, and protobuf interop
Enhancement	► rs/types/types/src/crypto/hash.rs     Register UpgradePermitAuthorizationShare in CryptoHashDomain and related domains
Enhancement	► rs/types/types/src/crypto/hash/domain_separator.rs     Add domain separators for UpgradePermitAuthorizationRequest and UpgradePermitAuthorizationShare; update stability checks
Enhancement	► rs/types/types/src/crypto/hash/tests.rs     Add tests for UpgradePermitAuthorizationRequest and UpgradePermitAuthorizationShare hashing/signing stability
Enhancement	► rs/types/types/src/crypto/sign.rs     Include UpgradePermitAuthorizationRequest in Notarization/RandBeac/other domain seal context

[Copilot]

🟡 Changes recommended

Consensus hash incompatibility, incomplete payload validation and production wiring, and incorrect retry and share-validation behavior are blocking issues.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Introduces Phase-2 upgrade-permit types, protobuf encoding, cryptographic domains, artifact pooling, and authorization-share management.

Changes:

• Adds upgrade request, authorization, return, and signature-share types.
• Adds payload serialization, artifact IDs, pool interfaces, and an in-memory pool.
• Adds a pool manager for signing, validating, gossiping, and expiring shares.

File summaries

File	Description
rs/types/types/src/crypto/sign.rs	Adds request signing domain.
rs/types/types/src/crypto/hash/tests.rs	Updates consensus hash vectors.
rs/types/types/src/crypto/hash/domain_separator.rs	Adds upgrade domains.
rs/types/types/src/crypto/hash.rs	Adds request/share hash domains.
rs/types/types/src/consensus/upgrade.rs	Defines permit actions.
rs/types/types/src/consensus.rs	Adds request/share types and protobuf conversion.
rs/types/types/src/batch/upgrade.rs	Encodes and decodes upgrade payloads.
rs/types/types/src/batch.rs	Extends batch payloads and messages.
rs/types/types/src/artifact.rs	Defines authorization-share IDs.
rs/test_utilities/types/src/batch/payload.rs	Initializes test payload field.
rs/state_machine_tests/src/lib.rs	Initializes delivered upgrade actions.
rs/protobuf/src/gen/types/types.v1.rs	Regenerates protobuf bindings.
rs/protobuf/generator/src/lib.rs	Registers upgrade protobuf generation.
rs/protobuf/def/types/v1/upgrade.proto	Defines upgrade wire messages.
rs/protobuf/def/types/v1/consensus.proto	Adds block upgrade bytes.
rs/protobuf/def/types/v1/artifact.proto	Adds upgrade artifact IDs.
rs/interfaces/src/upgrade.rs	Adds pool and validation interfaces.
rs/interfaces/src/p2p/consensus.rs	Corrects documentation spelling.
rs/interfaces/src/lib.rs	Exports upgrade interfaces.
rs/interfaces/src/crypto.rs	Extends the crypto interface.
rs/interfaces/src/consensus.rs	Adds upgrade validation errors.
rs/interfaces/mocks/src/crypto.rs	Adds upgrade crypto mocks.
rs/consensus/utils/src/crypto.rs	Extends consensus crypto bounds.
rs/consensus/upgrade/src/pool_manager.rs	Implements share lifecycle management.
rs/consensus/upgrade/src/lib.rs	Implements membership and share validation.
rs/consensus/upgrade/Cargo.toml	Defines the new crate.
rs/consensus/upgrade/BUILD.bazel	Adds Bazel targets.
rs/consensus/src/consensus/payload_builder.rs	Initializes upgrade test payloads.
rs/consensus/mocks/src/lib.rs	Adds the pool to test dependencies.
rs/artifact_pool/src/upgrade_permit_auth_pool.rs	Implements the in-memory pool.
rs/artifact_pool/src/lib.rs	Exports the pool module.
Cargo.toml	Registers the workspace crate.
Cargo.lock	Locks the new crate dependencies.

Review details

Suppressed comments (2)

rs/consensus/upgrade/src/pool_manager.rs:77

• Advancing last_scanned to the tip before processing makes every skipped or failed request permanent. In particular, a transient signing failure logged below is never retried on later polls, so this node may never contribute its required authorization share. Advance the cursor only past successfully processed work, or retain failed requests for retry.

        *last = tip;

rs/consensus/upgrade/src/lib.rs:77

• This maps every signature-verification failure to AuthorizeInvalidShare, including transient crypto errors. The manager then permanently removes the share; established consensus code instead defers non-reproducible errors (for example rs/consensus/idkg/src/pre_signer.rs:834-845). Preserve the crypto error classification so only reproducible failures invalidate the artifact and transient failures are retried.

        .map_err(|_| InvalidUpgradePayloadReason::AuthorizeInvalidShare { signer })?;

• Files reviewed: 32/33 changed files
• Comments generated: 9
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[frankdavid]

The first version of this PR was way too big, I simplified it. I'll send out the block changes and the pool manager separately.