Advance rc/0.6.0 to dev for 0.6.0-rc.3

.env.testing-artifacts

@@ -5,7 +5,7 @@
 # zcashd Git tag (https://github.com/zcash/zcash/releases)
 ZCASH_VERSION=6.20.0
 
-ZEBRA_VERSION=6.0.0-rc.0
+ZEBRA_VERSION=6.0.0
 
 # zcash-devtool git ref (https://github.com/zingolabs/zcash-devtool) —
 # the wallet client driven by wallet-tests via zcash_local_net, built

.github/workflows/publish-dry-run.yml

@@ -13,20 +13,11 @@ jobs:
   publish-dry-run:
     name: cargo publish --dry-run
     runs-on: ubuntu-latest
-    # Blocking context (pushes to rc/** or stable, and PRs targeting them):
-    # this job MUST pass. Advisory context (everything else): findings inform
-    # but the run stays green. Keep this predicate the exact inverse of the
-    # "Compute check mode" step below — job-level continue-on-error cannot
-    # read step outputs, so the two encode the same rule twice.
-    continue-on-error: >-
-      ${{
-        github.event_name == 'pull_request'
-          && !startsWith(github.base_ref, 'rc/')
-          && github.base_ref != 'stable'
-        || github.event_name != 'pull_request'
-          && !startsWith(github.ref_name, 'rc/')
-          && github.ref_name != 'stable'
-      }}
+    # Blocking context: direct pushes to rc/** or stable — the branch is in
+    # release-prep state and must publish cleanly.  Advisory context: everything
+    # else, including PRs that *target* rc/** or stable.  Those PRs carry
+    # unbumped dev code; version bumps happen on the RC branch after merge, so
+    # a publish failure at PR time is expected, not actionable.
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -37,11 +28,12 @@ jobs:
       - name: Compute check mode
         id: mode
         run: |
-          # Inverse of the job's continue-on-error predicate above.
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            target="${{ github.base_ref }}"
-          else
+          if [[ "${{ github.event_name }}" == "push" ]]; then
             target="${{ github.ref_name }}"
+          else
+            # PRs (including those targeting rc/** or stable) are always
+            # advisory — they carry pre-bump code by design.
+            target=""
           fi
           if [[ "$target" == rc/* || "$target" == stable ]]; then
             echo "mode=blocking" >> "$GITHUB_OUTPUT"
@@ -96,13 +88,18 @@ jobs:
             echo "============================================"
             echo ""
             echo "The workspace does not publish cleanly as a set. Common causes:"
-            echo "  - a [patch.crates-io] override pulling in unreleased upstream code"
+            echo "  - a [patch.crates-io] override pulling in unreleased upstream"
+            echo "    code (published crates cannot depend on unpublished revisions)"
             echo "  - a dependency on a git revision or path outside the workspace"
             echo "  - a crate that does not compile from its packaged form"
+            echo "  - new cross-crate API or features that exist in the workspace but"
+            echo "    not in the published dependency; resolved by the version bump +"
+            echo "    publish of that dependency at the next release"
+            echo ""
+            if [[ "${{ steps.mode.outputs.mode }}" == "advisory" ]]; then
+              echo "::warning::publish dry-run failed — the workspace would not release cleanly. Advisory on this branch, but it must be resolved before the next release."
+              exit 0
+            fi
+            echo "::error::publish dry-run failed — the workspace would not release cleanly."
             exit 1
           fi
-
-      - name: Annotate on failure (advisory context only)
-        if: failure() && steps.mode.outputs.mode == 'advisory'
-        run: |
-          echo "::warning::publish dry-run failed — the workspace would not release cleanly. This must be resolved before the next release."

CHANGELOG.md

@@ -8,6 +8,46 @@ and this library adheres to Rust's notion of
 ## Unreleased
 
 ### Changed
+- `zaino-state`: `FetchService` and `StateService` are merged into a single
+  generic `NodeBackedIndexerService<Source>` (module
+  `zaino_state::indexer::node_backed_indexer`; the former `backends` module is
+  gone). The validator connection is now selected at runtime rather than by type:
+  `NodeBackedIndexerServiceConfig { common, connection }` carries a
+  `ValidatorConnectionType` of either `Rpc` (JSON-RPC, formerly `Fetch`) or
+  `Direct(DirectConnectionConfig)` (Zebra `ReadStateService`, formerly `State`).
+  The per-backend `Fetch/StateServiceConfig`, `Fetch/StateServiceError`, and
+  `BackendConfig` types are replaced by `NodeBackedIndexerServiceConfig`,
+  `NodeBackedIndexerServiceError`, and `ValidatorConnectionType`.
+- **Breaking** — config: `zainod.toml`'s `backend` selector is renamed
+  `state` → `direct` and `fetch` → `rpc`. The legacy `"state"` / `"fetch"`
+  values are still accepted as aliases, so existing config files keep working.
+- `zaino-state`: the `ChainIndex` trait is split into `ChainIndex` (the
+  wallet-essential core: chain/tx/address/mempool access) and a
+  `ChainIndexRpcExt: ChainIndex` extension (compact-block serving, subtree
+  roots, and the block-explorer / mining / node-passthrough RPCs). The split is
+  a provisional first pass to be refined into finer capability traits later.
+- `zaino-state`: all remaining backend-split RPC functionality has moved out of
+  the `FetchService` (`JsonRpSeeConnector`) and `StateService`
+  (`ReadStateService`) backends and into `BlockchainSource` /
+  `ChainIndex`. Both backends now resolve every fetch through their `ChainIndex`
+  indexer — building responses from Zaino's own indexed state where possible and
+  delegating to the `ValidatorConnector` (`BlockchainSource`) only for
+  validator-only or passthrough data. Validator connection/syncer spawning also
+  moves into `ValidatorConnector::spawn_fetch` / `spawn_state`, so each
+  service/subscriber now holds only `{ indexer, data, config }`. This readies
+  the two backends for their eventual merge into a single
+  `ValidatorBackedIndexerService`. No behaviour change.
+- TLS: zaino now installs rustls's **aws-lc-rs** CryptoProvider as its
+  preferred process-level default (was ring) and enables rustls's
+  `prefer-post-quantum` feature, so the X25519MLKEM768 hybrid key exchange
+  leads zaino's outbound handshakes (ADR-0006). Installation remains
+  first-install-wins: an embedder that installs a provider before zaino
+  keeps its choice.
+
+### Deprecated
+- Classical TLS key exchange (X25519, SECP256R1, SECP384R1) is deprecated:
+  still offered and accepted for wallet compatibility, slated for refusal
+  once major wallet stacks negotiate hybrid key exchange (ADR-0006).
 - **Breaking** — config: `storage.database.sync_write_batch_bytes` (bytes) is
   renamed to `sync_write_batch_size` and given in **GiB** (default raised from
   4 GiB to 32 GiB); this budget now also bounds the txout-set accumulator

CONTEXT.md

@@ -29,3 +29,70 @@ its packaged content differs. The tree cannot be released until that crate's
 version is bumped. An unchanged crate keeping its published version is not a
 violation.
 _Avoid_: stale version, forgotten bump
+
+### Chains and networks
+
+**The Public Testnet**:
+The public Zcash test network, and only that. Its regimes are
+non-hermetic — state is shared with other participants, and an epoch
+the public chain has left (e.g. pre-NU6.3 once NU6.3 activates there)
+cannot be re-entered. Always this exact phrase in prose; identifiers
+use `the_pub_testnet` and types use `PubTestnet`.
+_Avoid_: bare "Testnet"/"testnet", and especially "testnet" for any
+locally-launched chain, even one launched under a testnet network kind
+
+**Regtest net**:
+A hermetic, locally-launched chain whose activation heights the
+launcher chooses. Every hermetic local net is a regtest net, whatever
+network-kind flag it runs under.
+_Avoid_: local testnet, custom testnet
+
+### Pools and upgrades
+
+**Ironwood / Orchard (era naming)**:
+Eras, fixtures, and predicates that speak of shielded pools are named by
+pool — Orchard, Ironwood — and a name that mentions one pool pairs with
+the other pool's name, never with the upgrade's. **NU6.3** names only the
+network upgrade itself: activation heights, consensus branch ID,
+consensus rules.
+_Avoid_: mixing vocabularies in one name or one sibling set (e.g. an
+`ORCHARD_ONLY_*` fixture whose sibling is `NU6_3_ACTIVE_*` — the sibling
+is `IRONWOOD_ONLY_*`)
+
+**Cross-address restriction**:
+The post-NU6.3 rule the Orchard Action circuit enforces: "(g_d, pk_d)
+of the output note must equal (g_d, pk_d) of the spent note" — the
+output note must carry the same expanded receiver (diversified base
+g_d, diversified transmission key pk_d) as its spent note, so each
+Orchard action is either change to the spent note's own address or a
+withdrawal (positive value balance). Orchard-to-Orchard transfers to
+any other address — including another address of the same wallet — are
+prohibited. A companion transaction-level rule forbids new value
+entering the pool. Source:
+<https://zcash.github.io/ironwood/design/action-circuit.html#the-cross-address-restriction>
+_Avoid_: "exit-only" (overclaims — same-receiver change still lands in
+the pool and its commitment tree still grows)
+
+### TLS and cryptography
+
+**Preferred CryptoProvider**:
+The TLS cryptography provider zaino installs as the process-wide default
+when no provider is installed yet. A preference, not a mandate: an
+embedder (e.g. zallet) that installs a provider before zaino keeps its
+choice, and zaino handshakes through it.
+_Avoid_: "enforced provider" (implies zaino overrides an embedder's
+already-installed provider; it never does)
+
+**Hybrid key exchange**:
+A TLS 1.3 key-exchange group combining a classical curve with a
+post-quantum KEM (key-encapsulation mechanism), e.g. X25519MLKEM768.
+Secure if either component holds. Hybrids are the post-quantum
+deployment vehicle, not a classical fallback.
+_Avoid_: calling hybrids "classical" because they contain a classical
+component
+
+**Classical key exchange**:
+A key-exchange group with no post-quantum component (X25519, SECP256R1,
+SECP384R1). Deprecated in zaino: still accepted for client
+compatibility, slated for refusal once major wallet stacks negotiate
+hybrids.