feat(state): verify VCT roots during header sync (move verification off the committer)#366
Draft
p0mvn wants to merge 4 commits into
Draft
feat(state): verify VCT roots during header sync (move verification off the committer)#366p0mvn wants to merge 4 commits into
p0mvn wants to merge 4 commits into
Conversation
Analyzed two files, diff |
p0mvn
changed the base branch from
roman/vct-hs-network-api
to
feat/pre-release-main
July 1, 2026 07:05
p0mvn
force-pushed
the
roman/vct-hs-verify-core
branch
from
July 1, 2026 07:05
31204ef to
1c6305b
Compare
…ody) Refactor `Version::block_to_history_node` into a default that delegates to a new required `parts_to_history_node(header, height, roots, tx-counts)`, so the block-based and parts-based leaves are built by identical code. Add the parts-based constructors up the stack: `Entry::new_leaf_parts`, `Tree::new_from_parts` / `append_leaf_parts`, and `NonEmptyHistoryTree` / `HistoryTree` `from_block_parts` / `push_from_parts`. This lets a node rebuild each block's MMR leaf and fold it into the chain-history tree from header-sync data alone — the header plus the per-pool roots and shielded tx-counts carried on the wire — without downloading the block body, which is what the upcoming header-sync verification needs (design §6). A new test proves the parts-built history root is byte-identical to the block-built one on real blocks (Heartwood + Canopy, mainnet + testnet). First commit of the core-logic PR; the verification move, frontier tree, committer simplification, and peer scoring follow.
…R) [wip] Task #11: authoritative header-sync verification. Extract a header-driven header_commitment_is_valid_for_chain_history core; add parts-based verify_supplied_roots_from_parts + the sub-Heartwood/sub-NU5/sub-Nu7 direct checks; persist a running header-frontier ZIP-221 MMR (new ZAKURA_HEADER_FRONTIER_TREE CF) that each committed range's roots are folded into and verified against the header commitments; reject a bad range with CommitHeaderRangeError::InvalidCommitmentRoots. Committer simplification (#13) and peer scoring (#12) still pending.
…re-verified roots [wip] Tasks #12/#13 (production): header-sync commit is now the authoritative verify+fold (#11), so map InvalidCommitmentRoots -> InvalidRange peer scoring, and drop the committer's successor look-ahead + the write-worker await-successor park. The committer re-checks its own header commitment and folds the (already header-sync- verified) roots, without waiting for a buffered successor — removing the deadlock. Removed next_checkpoint threading from commit_finalized/_direct. VCT prop-test suite rework still in progress (tests reference the removed successor machinery).
…ad successor machinery Complete #12/#13: adapt the VCT test suite to the moved verification and drop the now-dead successor/dedup machinery. - Remove the successor-look-ahead + dedup machinery: header_only, vct_root_needs_successor, vct_fast_needs_successor, record_prevalidated, vct_prevalidated_count, and the requires_verified_successor / prevalidated_count state; simplify VctState + its test constructor. - Remove three obsolete prop tests (deferral + two dedup tests) and the poisoned-root-refill test that exercised the removed immediate-rejection path. - Update the wrong-root test: a wrong Sapling MMR root is now rejected at its successor's commit (one-block lag); the tip case is header-sync's job. - Header-range reorg tests: synthetic headers now commit the running MMR root of their (zero) roots so they pass header-sync verification; the frontier positioner rebuilds from empty on a re-anchor below the frontier. - Drop next_checkpoint from the replay-bench apply path; regenerate CF snapshots (new zakura_header_frontier_tree CF).
p0mvn
force-pushed
the
roman/vct-hs-verify-core
branch
from
July 1, 2026 08:06
1c6305b to
78295b4
Compare
This was referenced Jul 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Goal
Make header-sync commit the single authoritative verify+fold for peer-supplied commitment roots, so a lying peer is caught early and attributably at the network boundary (scored + disconnected), and the finalized committer no longer needs the successor at all (no successor-park, no deadlock). Consumes the fields carried by #365.
Landed so far
zebra-chain):block_to_history_nodenow delegates to a newparts_to_history_node; parts-based constructors added up toHistoryTree::push_from_parts. Proven byte-identical to the block-based path on real blocks (test). This is the mechanism for rebuilding leaves from header-sync data with no body.Remaining (in-progress commits)
verify_commitment_rootsto fold viapush_from_partscarrying the counts; run verification insidecommit_header_range; addCommitHeaderRangeError::InvalidCommitmentRoots.HeaderSyncMisbehavior::InvalidRangein the header-sync reactor (reject + refetch; the scoring path already exists).Test evidence (so far)
cargo check --workspace --testsclean on top of feat(network): carry Ironwood root + shielded tx-counts in the header-sync record #365; parts-vs-block identity test passes.AI disclosure
Implemented with Claude Code (Opus); the contributor is the responsible author.