serviceability: a permissionless flag on Feed, declared not enforced

CHANGELOG.md

@@ -8,6 +8,13 @@ All notable changes to this project will be documented in this file.
 
 ### Changes
 
+- CLI
+  - `doublezero feed create --permissionless` marks a feed as offered without an access grant, and `doublezero feed update --permissionless true|false` flips it afterwards. `feed list` gains a `permissionless` column, in the table and both JSON forms. The update flag takes a value rather than being a bare presence flag so that turning it off is distinguishable from leaving it alone: `FeedUpdateArgs` is compared against its default to reject a no-op update, and a bare `false` would be indistinguishable from one. (malbeclabs/infra#2390)
+- Serviceability
+  - `Feed` carries a trailing `permissionless: bool`, set by `CreateFeed` (112) and changed by `UpdateFeed` (113). It is declarative: no instruction reads it, no gate consults it, and the paid gate for a feed is still the EdgeSeat FeedSeat. It exists so the storefront can read whether a feed is offered without a grant from the ledger instead of from a hand-maintained file, which is what a serviceability flag can honestly answer — this program has no purchase path to gate. Old accounts decode as `false` through the existing per-field `unwrap_or_default()` in `TryFrom<&[u8]>`, and old create encodings without the trailing byte decode as `false` through borsh-incremental, so no migration and no backfill is required. Deploy ordering (RFC-1): the program must deploy to all clusters before any client that emits the flag — an old program ignores the trailing byte rather than failing, so a new CLI against an old program would silently create a feed with the flag dropped. Deploy note: an existing feed grows by one byte the first time any `UpdateFeed` writes it, including a `--name`-only update that never mentions the flag, and the rent delta is charged to the signer. (malbeclabs/infra#2390)
+- SDK
+  - The Go, Python and TypeScript `Feed` decoders read the new trailing `permissionless` byte, defaulting to `false` past end-of-input so an account written before the field decodes unchanged. `CreateFeedCommand` gains `permissionless: bool` and `UpdateFeedCommand` gains `permissionless: Option<bool>`. (malbeclabs/infra#2390)
+
 ## [v0.38.0](https://github.com/malbeclabs/doublezero/compare/client/v0.37.0...client/v0.38.0) - 2026-08-28
 
 ### Breaking

crates/doublezero-daemon-cli/src/connect.rs

@@ -2682,6 +2682,7 @@ mod tests {
             name: code.to_string(),
             exchange,
             groups: vec![Pubkey::new_unique()],
+            permissionless: false,
         }
     }
 
@@ -3504,6 +3505,7 @@ mod tests {
                 name: code.to_string(),
                 exchange,
                 groups,
+                permissionless: false,
             };
             self.feeds.lock().unwrap().insert(pk, feed);
             pk

crates/doublezero-serviceability-instruction/src/feed.rs

@@ -106,6 +106,7 @@ mod tests {
             name: "Feed".to_string(),
             exchange,
             groups: vec![Pubkey::new_unique()],
+            permissionless: false,
         };
         let ix = create_feed(&pid, &payer, args);
         assert_eq!(ix.data[0], 112);
@@ -143,6 +144,7 @@ mod tests {
             FeedUpdateArgs {
                 name: Some("Feed".to_string()),
                 groups: None,
+                permissionless: None,
             },
         );
         assert_eq!(update.data[0], 113);

sdk/serviceability/python/serviceability/state.py

@@ -1039,7 +1039,7 @@ def from_bytes(cls, data: bytes) -> Tenant:
 
 @dataclass
 class FeedSeat:
-    """One purchased SKU seat on an EdgeSeat access pass, carrying a feed's whole billing state.
+    """One purchased feed's seat on an EdgeSeat access pass, carrying a feed's whole billing state.
 
     The cap is ``max_users`` before ``window_end`` and ``max_future_users`` from ``window_end``
     until ``terminates_at``, when the feed is removed from the pass. ``current_users`` is the live
@@ -1242,7 +1242,7 @@ def from_bytes(cls, data: bytes) -> TopologyInfo:
 
 @dataclass
 class Feed:
-    """Serviceability catalog entry: one SKU scoped to a single metro (exchange), holding the
+    """Serviceability catalog entry: one feed scoped to a single metro (exchange), holding the
     multicast groups joinable there. One feed_key is one feed in one metro.
     """
 
@@ -1253,6 +1253,8 @@ class Feed:
     name: str = ""
     exchange: Pubkey = Pubkey.default()
     groups: list[Pubkey] = field(default_factory=list)
+    # Declarative catalog label; false on an account written before the field existed.
+    permissionless: bool = False
     pub_key: Pubkey = Pubkey.default()  # set from account address after deserialization
 
     @classmethod
@@ -1267,4 +1269,5 @@ def from_bytes(cls, data: bytes) -> Feed:
         # A feed serves one metro: an exchange pubkey followed by a Vec<Pubkey> of joinable groups.
         f.exchange = _read_pubkey(r)
         f.groups = _read_pubkey_vec(r)
+        f.permissionless = r.read_bool()
         return f

sdk/serviceability/python/serviceability/tests/test_fixtures.py

@@ -582,13 +582,24 @@ def test_deserialize(self):
                 "GroupsLen": len(feed.groups),
                 "Group0": feed.groups[0],
                 "Group1": feed.groups[1],
+                "Permissionless": feed.permissionless,
             },
         )
         assert feed.account_type == 18
         assert feed.bump_seed == 239
         assert feed.code == "shreds"
         assert feed.name == "Shreds"
         assert len(feed.groups) == 2
+        assert feed.permissionless is True
+
+    def test_permissionless_defaults_false_on_a_pre_flag_account(self):
+        # An account written before the flag existed lacks the trailing byte; it reads false,
+        # matching the Rust program's TryFrom unwrap_or_default.
+        data, _ = _load_fixture("feed")
+        feed = Feed.from_bytes(data[:-1])
+        assert feed.permissionless is False
+        assert feed.code == "shreds"
+        assert len(feed.groups) == 2
 
 
 class TestFixtureAccessPassLegacyCapDefaults:

sdk/serviceability/testdata/fixtures/feed.json

@@ -46,6 +46,11 @@
       "name": "Group1",
       "value": "GH7YkRi9soP4j2JAUYTMEMBtkDFyGf7oYu1aGGRucd5H",
       "typ": "pubkey"
+    },
+    {
+      "name": "Permissionless",
+      "value": "true",
+      "typ": "bool"
     }
   ]
 }

sdk/serviceability/testdata/fixtures/generate-fixtures/src/main.rs

@@ -1491,7 +1491,8 @@ fn generate_access_pass_edge_seat(dir: &Path) {
 }
 
 /// Borsh-encoded `Feed` account. Field order: account_type, owner, bump_seed, code, name,
-/// exchange (Pubkey), groups (Vec<Pubkey>). Two groups, so the vec decoding is exercised.
+/// exchange (Pubkey), groups (Vec<Pubkey>), permissionless (bool). Two groups, so the vec
+/// decoding is exercised; permissionless is true so a decoder that skips the byte is caught.
 fn generate_feed(dir: &Path) {
     let owner = pubkey_from_byte(0xE0);
     let exchange = pubkey_from_byte(0xE1);
@@ -1506,6 +1507,7 @@ fn generate_feed(dir: &Path) {
         name: "Shreds".into(),
         exchange,
         groups: vec![group0, group1],
+        permissionless: true,
     };
 
     let data = borsh::to_vec(&val).unwrap();
@@ -1523,6 +1525,7 @@ fn generate_feed(dir: &Path) {
             FieldValue { name: "GroupsLen".into(), value: "2".into(), typ: "u32".into() },
             FieldValue { name: "Group0".into(), value: pubkey_bs58(&group0), typ: "pubkey".into() },
             FieldValue { name: "Group1".into(), value: pubkey_bs58(&group1), typ: "pubkey".into() },
+            FieldValue { name: "Permissionless".into(), value: "true".into(), typ: "bool".into() },
         ],
     };
 

sdk/serviceability/typescript/serviceability/state.ts

@@ -1053,7 +1053,7 @@ export const ACCESS_PASS_TYPE_SOLANA_RPC = 2;
 export const ACCESS_PASS_TYPE_OTHERS = 3;
 export const ACCESS_PASS_TYPE_EDGE_SEAT = 4;
 
-// One purchased SKU seat on an EdgeSeat access pass, carrying a feed's whole billing state. The cap
+// One purchased feed's seat on an EdgeSeat access pass, carrying a feed's whole billing state. The cap
 // is maxUsers before windowEnd and maxFutureUsers from windowEnd until terminatesAt, when the feed
 // is removed from the pass. currentUsers is the live count. anniversaryDay is the original start
 // day-of-month (1..=31) for drift-free renewals. windowEnd and terminatesAt are unix seconds.
@@ -1236,7 +1236,7 @@ export function deserializePermission(data: Uint8Array): Permission {
 // Feed
 // ---------------------------------------------------------------------------
 
-// Serviceability catalog entry: one SKU scoped to a single metro (exchange), holding the
+// Serviceability catalog entry: one feed scoped to a single metro (exchange), holding the
 // multicast groups joinable there. One feed_key is one feed in one metro.
 export interface Feed {
   accountType: number;
@@ -1246,6 +1246,8 @@ export interface Feed {
   name: string;
   exchange: PublicKey;
   groups: PublicKey[];
+  /** Declarative catalog label; false on an account written before the field existed. */
+  permissionless: boolean;
 }
 
 export function deserializeFeed(data: Uint8Array): Feed {
@@ -1258,6 +1260,7 @@ export function deserializeFeed(data: Uint8Array): Feed {
   // A feed serves one metro: an exchange pubkey followed by a Vec<Pubkey> of joinable groups.
   const exchange = readPubkey(r);
   const groups = readPubkeyVec(r);
+  const permissionless = r.readBool();
   return {
     accountType,
     owner,
@@ -1266,5 +1269,6 @@ export function deserializeFeed(data: Uint8Array): Feed {
     name,
     exchange,
     groups,
+    permissionless,
   };
 }

sdk/serviceability/typescript/serviceability/tests/fixtures.test.ts

@@ -597,13 +597,25 @@ describe("Feed fixture", () => {
       GroupsLen: feed.groups.length,
       Group0: feed.groups[0],
       Group1: feed.groups[1],
+      Permissionless: feed.permissionless,
     });
 
     expect(feed.accountType).toBe(18);
     expect(feed.bumpSeed).toBe(239);
     expect(feed.code).toBe("shreds");
     expect(feed.name).toBe("Shreds");
     expect(feed.groups).toHaveLength(2);
+    expect(feed.permissionless).toBe(true);
+  });
+
+  test("permissionless defaults false on a pre-flag account", () => {
+    // An account written before the flag existed lacks the trailing byte; it reads false,
+    // matching the Rust program's TryFrom unwrap_or_default.
+    const [data] = loadFixture("feed");
+    const feed = deserializeFeed(data.slice(0, -1));
+    expect(feed.permissionless).toBe(false);
+    expect(feed.code).toBe("shreds");
+    expect(feed.groups).toHaveLength(2);
   });
 });
 

smartcontract/cli/src/accesspass/get.rs

@@ -457,6 +457,7 @@ mod tests {
             name: "QA Payments".to_string(),
             exchange: exchange_key,
             groups: vec![group_key],
+            permissionless: false,
         };
 
         let mgroup = MulticastGroup {
@@ -744,6 +745,7 @@ mod tests {
                 name: "Lashay 1".to_string(),
                 exchange: *exchange,
                 groups: vec![],
+                permissionless: false,
             })
             .collect();
 
@@ -848,6 +850,7 @@ mod tests {
             name: "QA Payments".to_string(),
             exchange: exchange_key,
             groups: vec![],
+            permissionless: false,
         };
 
         client

smartcontract/cli/src/accesspass/list.rs

@@ -976,6 +976,7 @@ mod tests {
             name: "QA Payments".to_string(),
             exchange: Pubkey::new_unique(),
             groups: vec![feed_group_pubkey],
+            permissionless: false,
         };
 
         let accesspass = AccessPass {

smartcontract/cli/src/exchange/resolve.rs

@@ -108,6 +108,7 @@ mod tests {
             name: "QA Payments".to_string(),
             exchange: Pubkey::new_unique(),
             groups: vec![],
+            permissionless: false,
         };
 
         client

smartcontract/cli/src/feed/create.rs

@@ -23,6 +23,9 @@ pub struct CreateFeedCliCommand {
     /// Multicast group pubkey or code joinable in this metro (repeatable)
     #[arg(long = "group", value_parser = validate_pubkey_or_code, num_args = 1..)]
     pub groups: Vec<String>,
+    /// Offer this feed without an access grant. Off unless given.
+    #[arg(long, default_value_t = false)]
+    pub permissionless: bool,
 }
 
 impl CreateFeedCliCommand {
@@ -50,6 +53,7 @@ impl CreateFeedCliCommand {
             name: self.name,
             exchange,
             groups,
+            permissionless: self.permissionless,
         })?;
 
         print_signature(out, &signature)
@@ -142,6 +146,7 @@ mod tests {
                 name: "Feed".to_string(),
                 exchange: exchange_pk,
                 groups: vec![group_pk],
+                permissionless: false,
             }))
             .times(1)
             .returning(move |_| Ok((signature, feed_pk)));
@@ -154,6 +159,7 @@ mod tests {
                 name: "Feed".to_string(),
                 exchange: exchange_pk.to_string(),
                 groups: vec![group_pk.to_string()],
+                permissionless: false,
             }
             .execute(&ctx, &client, &mut output),
         );
@@ -199,6 +205,7 @@ mod tests {
                 name: "Feed".to_string(),
                 exchange: exchange_pk,
                 groups: vec![group_pk],
+                permissionless: false,
             }))
             .times(1)
             .returning(move |_| Ok((signature, feed_pk)));
@@ -211,6 +218,7 @@ mod tests {
                 name: "Feed".to_string(),
                 exchange: "xchi".to_string(),
                 groups: vec!["mg01".to_string()],
+                permissionless: false,
             }
             .execute(&ctx, &client, &mut output),
         );
@@ -243,6 +251,7 @@ mod tests {
                 name: "Feed".to_string(),
                 exchange: exchange_pk.to_string(),
                 groups: vec!["nope".to_string()],
+                permissionless: false,
             }
             .execute(&ctx, &client, &mut output),
         );
@@ -270,6 +279,7 @@ mod tests {
                 name: "Feed".to_string(),
                 exchange: "nope".to_string(),
                 groups: vec![],
+                permissionless: false,
             }
             .execute(&ctx, &client, &mut output),
         );

smartcontract/cli/src/feed/delete.rs

@@ -206,6 +206,7 @@ mod tests {
             name: "Feed".to_string(),
             exchange: exchange_pk,
             groups: vec![],
+            permissionless: false,
         };
         let feed_for_get = feed.clone();
         client

smartcontract/cli/src/feed/guard.rs

@@ -394,6 +394,7 @@ pub(crate) mod fixtures {
             name: "Feed".to_string(),
             exchange,
             groups,
+            permissionless: false,
         }
     }
 

smartcontract/cli/src/feed/list.rs

@@ -40,6 +40,7 @@ pub struct FeedDisplay {
     pub exchange: String,
     pub groups: usize,
     pub group_codes: String,
+    pub permissionless: bool,
     #[serde(serialize_with = "serializer::serialize_pubkey_as_string")]
     pub owner: Pubkey,
 }
@@ -85,6 +86,7 @@ impl ListFeedCliCommand {
                     })
                     .collect::<Vec<_>>()
                     .join(", "),
+                permissionless: feed.permissionless,
                 owner: feed.owner,
             })
             .collect::<Vec<FeedDisplay>>();
@@ -130,6 +132,7 @@ mod tests {
             name: "QA Payments".to_string(),
             exchange: exchange_pk,
             groups: vec![mgroup_pk, unknown_mgroup_pk],
+            permissionless: false,
         };
         client.expect_list_feed().returning(move |_| {
             let mut feeds = HashMap::new();
@@ -194,7 +197,7 @@ mod tests {
         let output_str = String::from_utf8(output).unwrap();
         assert_eq!(
             output_str,
-            " account                                   | code        | name        | exchange | groups | group_codes                                     | owner                                     \n 1111111FVAiSujNZVgYSc27t6zUTWoKfAGxbRzzPR | qa-payments | QA Payments | xams     | 2      | mg01, 11111115q4EpJaTXAZWpCg3J2zppWGSZ46KXozzo4 | 11111115q4EpJaTXAZWpCg3J2zppWGSZ46KXozzo9 \n"
+            " account                                   | code        | name        | exchange | groups | group_codes                                     | permissionless | owner                                     \n 1111111FVAiSujNZVgYSc27t6zUTWoKfAGxbRzzPR | qa-payments | QA Payments | xams     | 2      | mg01, 11111115q4EpJaTXAZWpCg3J2zppWGSZ46KXozzo4 | false          | 11111115q4EpJaTXAZWpCg3J2zppWGSZ46KXozzo9 \n"
         );
     }
 
@@ -214,6 +217,7 @@ mod tests {
             name: code.to_string(),
             exchange,
             groups: vec![],
+            permissionless: false,
         };
 
         client.expect_list_feed().returning(move |_| {

smartcontract/cli/src/feed/resolve.rs

@@ -126,6 +126,7 @@ mod tests {
             name: code.to_string(),
             exchange,
             groups: vec![],
+            permissionless: false,
         }
     }