feat: migrate to the new playground-registry + identity-spine contracts - #484
Open
ReinhardHatko wants to merge 1 commit into
Open
ReinhardHatko wants to merge 1 commit into
ReinhardHatko wants to merge 1 commit into
Conversation
The registry was ported onto pvm-contract-sdk with identity split out into a global @w3s/playground-identity spine, changing the ABI shapes and the publish authorization model: - publish/publishDev are separate methods again: publishDev (6 args) is authorized by env::caller() matching a compiled-in dev signer and is exempt from the reveal gate; publish is gated FAIL-CLOSED by require_revealed() and ignores its trailing is_dev_signer flag. Routing keys on the signer's H160 (isKnownDevPublishSigner), not on --suri provenance, in BOTH publish pipelines (deploy + decentralize), so arbitrary suri keys (e.g. the e2e deployer) publish as reveal-gated users. - The owner arg is a plain Address (zero = none; shared ZERO_H160 constant) — Option is not a SolType. The override is honored only on publishDev; publishToPlayground rejects claimedOwnerH160 without isDevSigner before any on-chain work. String reads return "" as the none sentinel, decoded in one place (queryMetadataUri, with an ABI-drift guard). - The builder-identity gate reads spine.isVerified(productH160) via a dedicated identity-only resolution (registry-only reads stay decoupled from spine availability); deterministic ABI drift fails fast instead of burning the retry budget. - NotRevealed/Unauthorized reverts surface actionable remedies keyed on the decoded revert reason. cdm.json carries the new ABIs (spliced from the contract build artifacts); refresh with `cdm i` once the migrated contracts are deployed and published to CDM — this must ship in lockstep with that deploy. The e2e deployer must be seeded in the spine (admin_set_identity) before the publish e2e legs can pass; documented in docs/e2e-bootstrap.md.
Contributor
|
Dev build ready — try this branch: |
Contributor
E2E Test Pass · ❌ FAILTag:
Sentry traces: view spans for this run |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migrates the CLI onto the migrated playground-registry and the new global
@w3s/playground-identityspine (the pvm-contract-sdk port, playground-apprh/cdm-migration-contracts). Companion to the contract migration handoff doc; must ship in lockstep with the contract deploy + CDM publish (see rollout notes below).Contract model changes
publish/publishDevare separate methods again.publishDev(6 args) is authorized on-chain byenv::caller()matching one of the registry's compiled-in dev signers and is exempt from the reveal gate.publish(7 args) is gated fail-closed byrequire_revealed()— the caller must be verified in the identity spine — and its trailingis_dev_signerboolean is ignored (kept for ABI compatibility, always passedfalse).--suriprovenance (signerMode.ts::isKnownDevPublishSigner, applied in BOTH publish pipelines — deploy and decentralize). An arbitrary--surikey (e.g. the dedicated e2e deployer) publishes as a reveal-gated user; routing it throughpublishDevwould revertUnauthorized.owneris a plainAddress(noOptionSolType); the zero address is the "none" sentinel (sharedZERO_H160constant). The override is honored only onpublishDev—publishToPlaygroundnow rejectsclaimedOwnerH160withoutisDevSignerbefore the metadata upload instead of letting the chain revertOwnerOverrideForbiddenafter it.""as the none/tombstone sentinel (no more{ isSome, value }). Decoded in one place —registry.ts::queryMetadataUri— with a runtime ABI-drift guard, consumed bymod,SetupScreen, the e2e fixture, and the fixture tool.Identity gate
spine.isVerified(productH160)— the exact predicate the on-chain publish gate delegates to (the migrated registry no longer exposesget_root_account).getReadOnlyRegistryContract/getReadOnlyIdentityContract/getReadOnlyPlaygroundContracts), so pure registry reads (mod browse, e2e fixtures, operator tools) are not coupled to spine availability in the meta-registry.isVerifiedresponse) fails fast to the softunverifiableoutcome instead of burning the retry budget.--surimode the gate checks the session's H160 while the chain checks the suri key's H160 — a product-behavior decision tracked separately.UX
NotRevealedandUnauthorizedreverts surface actionable remedies keyed on the decoded revert reason (with a substring fallback forTxDispatchError-shaped reverts), instead of an opaque failure at the last step of a deploy.Rollout — read before merging
cdm.json. The committedcdm.jsonwas spliced from the contract build artifacts ahead of the deploy; once the migrated contracts are published to CDM, refresh it withcdm i(fixes the placeholder version/address metadata on the identity entry).latestflips to the new registry, older CLI releases break (old ABI against new contract) — release this the same day.admin_set_identity) or every publish e2e leg revertsNotRevealed— documented indocs/e2e-bootstrap.md, including re-seeding after a spine redeploy.set_verifier(spine)→ import state → publish to CDM → smoke test (publishDevwithout reveal succeeds; scoredpublishfrom a seeded account succeeds; unrevealed account revertsNotRevealed).Verification
pnpm format:check,pnpm lint:license,pnpm typecheck(both with and without the local.cdmaugmentation — the CI condition),pnpm test(1006/1006).--surigate mismatch above is the one deferred decision).