feat(tee)!: shell out to the admission CLI; exact registry genesis gate - #78
Merged
Conversation
promote_measurements now shells out to `seismic-measurement-admission promote` — normalization is schema knowledge and lives in the shared crate — and the drifted `_validate_policy_records` is deleted: "the compiler accepts it" is the whole document validation. Bytes stream both ways over stdin/stdout so the hash-committed policy is never re-rendered. The deliberately-vacuous registry-storage warning becomes an exact gate: the registry genesis account must hold the canonical MeasurementRegistry runtime (keccak256 pinned in the compile report) and precisely the compiled storage — every expected slot present, no unexplained slots, words compared in normalized form. The compile report's policy_hash is cross-checked against the artifact bytes. BREAKING: assemble/validate now fail for a genesis whose registry account is empty or non-canonical; seed it from `seismic-measurement-admission compile` output. New --admission-bin flag on assemble/validate. Tests inject compile_fn (mirroring genesis_hash_fn); subprocess-boundary tests skip without the binary on PATH; an online drift test checks the crate's runtime-code pin against the published contract artifact. eth-utils becomes a declared dependency (keccak in the gate).
samlaf
added a commit
that referenced
this pull request
Jul 30, 2026
…semble (#80) Committed genesis files stay policy-free — the accepted admission IDs are a per-network fact. assemble now compiles the network's policy document and writes the report's registry_genesis_storage into its copy of the genesis: wholesale replacement of the registry account's storage, so re-assembly is idempotent and a policy change never leaves stale slots behind. eth.genesis_hash is computed over the injected copy, and write_artifact_set ships it — the manifest commits to the reviewed policy's storage, not to whatever the input happened to carry. This lifts #78's requirement to pre-seed the input genesis from compile output; a policy-free input (like reth's committed dev.json) now assembles directly. The exact registry gate is unchanged, but its mismatch arms now defend the validate path: assemble satisfies the gate by construction, so a storage mismatch means the shipped artifact set was edited after assembly. Injection fails closed: a compile report without registry storage (stale admission CLI), a genesis alloc missing the registry account, or the account listed twice under different hex spellings are GateErrors; the alloc key's original spelling is preserved. The same-name reth-genesis.json write in a network dir is deliberate and stable under re-assembly. Tests cover injection into a policy-free input, wholesale replacement, the manifest committing to the injected copy's hash, stable re-assembly over a shipped artifact set, and the gate arms via post-assembly tampering; write_artifact_set drops its GateContext parameter and ships assemble's bytes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
promote_measurements now shells out to
seismic-measurement-admission promote— normalization is schema knowledge and lives in the shared crate — and the drifted_validate_policy_recordsis deleted: "the compiler accepts it" is the whole document validation. Bytes stream both ways over stdin/stdout so the hash-committed policy is never re-rendered.The deliberately-vacuous registry-storage warning becomes an exact gate: the registry genesis account must hold the canonical MeasurementRegistry runtime (keccak256 pinned in the compile report) and precisely the compiled storage — every expected slot present, no unexplained slots, words compared in normalized form. The compile report's policy_hash is cross-checked against the artifact bytes.
BREAKING: assemble/validate now fail for a genesis whose registry account is empty or non-canonical; seed it from
seismic-measurement-admission compileoutput.New --admission-bin flag on assemble/validate. Tests inject compile_fn (mirroring genesis_hash_fn); subprocess-boundary tests skip without the binary on PATH; an online drift test checks the crate's runtime-code pin against the published contract artifact. eth-utils becomes a declared dependency (keccak in the gate).