feat(state): carry and store the per-block ZIP-244 auth-data root#356
Merged
Conversation
Propagate each block's ZIP-244 `auth_data_root` alongside its note-commitment roots, without changing how the committer authenticates blocks. This is the data-model / wire / storage half of the verified-commitment-trees successor-header authentication; a follow-up consumes it in the committer. - Add `auth_data_root` to `BlockCommitmentRoots` (the `tree_aux` header-sync payload) and to the `commitment_roots_by_height` serving-index value (64 -> 96 bytes). `FromDisk` stays backward compatible: pre-release 64-byte rows decode with a zero auth-data root. Consolidated under state DB format version 27.3.0 (no version bump). - Compute and store the auth-data root at commit, thread it through the provisional Zakura header-roots store/read, the `BlockRoots` serve paths, and the `CommitHeaderRange` plumbing. - Bump the Zakura header-sync stream format to version 5. This is a breaking wire change: a v4 and a v5 node cannot exchange header ranges. The auth-data root is carried and stored but not yet consumed by the committer, so consensus behavior is unchanged.
|
Note Complete: Audit complete. V12 did not find any issues that need review. Open the full results here. Analyzed 16 files, diff |
p0mvn
marked this pull request as draft
July 1, 2026 02:55
…-data root The serving-index value grew 64->96 bytes with the per-height auth-data root, so the raw-column-family snapshots gain the 32-byte auth-data root (the all-0xFF ZIP-244 placeholder for these pre-NU5 blocks).
CI's stable clippy advanced to 1.96 since #336/#337 merged, newly flagging two pre-existing issues that block this PR: - admission.rs: an `admission_decision` doc comment was orphaned above `request_deadline` (empty_line_after_doc_comments); moved it to its function. - blocksync_fuzz: allow too_many_arguments on the test-harness `spawn_action_driver`.
…ixture #337 (BBR-lite congestion control) added block-sync config fields (bbr_*, floor_bypass_slots, floor_rescue_timeout, no_progress_peer_cooldown) without updating the stored config fixture, so `last_config_is_stored` fails: the generated config matches no stored config. Regenerate the newest fixture to include them. Unrelated to this PR's auth-data-root change (which adds no config fields).
p0mvn
marked this pull request as ready for review
July 1, 2026 04:26
ValarDragon
reviewed
Jul 1, 2026
Comment on lines
31
to
36
| /// The block height these roots are for. | ||
| pub height: block::Height, | ||
| /// The Sapling note-commitment tree root as of the end of this block. | ||
| pub sapling_root: sapling::tree::Root, | ||
| /// The Orchard note-commitment tree root as of the end of this block (empty below NU5). | ||
| pub orchard_root: orchard::tree::Root, |
There was a problem hiding this comment.
I think we need all the data to reconstruct the hashLightClientRoot
Author
|
Discussed with Dev on Slack an agreed merging: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
First, mergeable-on-its-own step toward authenticating verified-commitment-trees (VCT) fast blocks against their successor's header instead of the successor body (which couples the committer to the body-download pipeline and can deadlock at a checkpoint/VCT boundary).
At NU5+ the successor's
hashBlockCommitmentsbinds the chain-history (MMR) root together with the successor's own ZIP-244auth_data_root, so that root is a required co-input for the authentication. This PR carries and stores it everywhere it's needed, without changing how the committer authenticates blocks — so it can land safely first, ahead of the consensus-bearing change.What changed
auth_data_rootadded toBlockCommitmentRoots(thetree_auxheader-sync payload) and to thecommitment_roots_by_heightserving-index value (64→96 bytes).FromDiskstays backward compatible — pre-release 64-byte rows decode with a zero auth-data root. Consolidated under state DB format27.3.0(no version bump).BlockRootsserve paths, and theCommitHeaderRangeplumbing.Consensus behavior is unchanged: the auth-data root is carried and stored but not yet consumed by the committer (that lands in the follow-up, #355).
Test evidence
cargo check --workspace --testsclean; fmt clean.vct_db_produced_payload_round_trips_to_byte_identical_state(96-byte serving-index value round-trips byte-identically) and the original committer deferral/fast-path tests (unchanged behavior).header_syncwire tests +zebra-chainserialization round-trip pass.Relationship to the feature
This is the network-breaking propagation slice of #355 (the full feature). Merge this first; #355 then rebases down to just the consensus consumption (the header-driven committer/verifier changes).
AI disclosure
Implemented with Claude Code (Opus); the contributor is the responsible author.