From f7b5eba67e0b18eb248cbf054fa41dfeb166f231 Mon Sep 17 00:00:00 2001 From: liorbond Date: Sun, 4 Oct 2026 22:34:54 +0300 Subject: [PATCH] [CHORE] mainnet: bake the CommitmentRegistry address Co-Authored-By: Claude Fable 5.1 --- src/env_policy.rs | 22 ++++++++++++++++++++++ src/envs/mainnet.toml | 19 ++++++++++--------- src/main.rs | 18 ++++++++++-------- 3 files changed, 42 insertions(+), 17 deletions(-) diff --git a/src/env_policy.rs b/src/env_policy.rs index 3fe810d..69bc725 100644 --- a/src/env_policy.rs +++ b/src/env_policy.rs @@ -475,6 +475,28 @@ mod tests { assert!(c.warning_instead_of_enforcement); } + #[test] + fn mainnet_policy_is_commitment_enforcing() { + let p = EnvPolicy::for_env("mainnet").expect("mainnet policy"); + assert!(p.require_permit); + assert!(p.enable_commitment_verification); + let c = p.commitment.expect("mainnet has a [commitment] block"); + assert_eq!( + c.version, + "0x0000000000000000000000000000000000000000000000000000000000000002" + ); + // The CommitmentRegistry on Arbitrum One (chain 42161), serving both host chains. + assert_eq!( + c.registry_address, + "0x4B82F827C03fad5739EFEcfcF743E65E732be695" + ); + // Fresh registry, version 2 only: nothing to grandfather, so enforce from day one. + assert!(!c.warning_instead_of_enforcement); + assert_eq!(p.acl.task_manager_id(1), Some(1)); + assert_eq!(p.acl.task_manager_id(42161), Some(1)); + assert_eq!(p.acl.task_manager_id(84532), None); + } + /// FAIL-CLOSED: an env with no baked policy is rejected — same posture as the /// key-source `lookup`, so the two never drift apart silently. #[test] diff --git a/src/envs/mainnet.toml b/src/envs/mainnet.toml index 904b277..4b6ea5e 100644 --- a/src/envs/mainnet.toml +++ b/src/envs/mainnet.toml @@ -1,19 +1,20 @@ # Baked security policy — "mainnet" environment (six key-share holders, threshold 3). # -# The permit gate is ON. The commitment gate is baked ON and ENFORCING (v1, -# warning_instead_of_enforcement = false), but the CommitmentRegistry contract for -# mainnet is not deployed yet — registry_address is a "TBD" placeholder. This is -# deliberately NOT bootable until the real address is filled in AND the (API-keyed) -# COMMITMENT_REGISTRY_RPC_URL is supplied: with the gate on, boot fail-closes when the -# RPC is unset, and "TBD" fails address parsing loudly when the RPC is set — so the -# placeholder can never be deployed by accident. See src/envs/staging.toml for why RPC -# endpoints stay env-supplied and are never baked into the (publicly-pullable) image. +# The permit gate is ON. The commitment gate is baked ON and ENFORCING +# (warning_instead_of_enforcement = false): a decrypt whose handle has no commitment +# in the registry is refused, so the commitment poster must be live before intake +# opens. The registry is the CommitmentRegistry on Arbitrum One (chain 42161), a +# single contract serving both host chains; its default admin is the mainnet Safe and +# version 2 is the only active version. The (API-keyed) COMMITMENT_REGISTRY_RPC_URL +# stays env-supplied: with the gate on, boot fail-closes when it is unset. See +# src/envs/staging.toml for why RPC endpoints are never baked into the +# (publicly-pullable) image. require_permit = true enable_commitment_verification = true [commitment] version = "0x0000000000000000000000000000000000000000000000000000000000000002" -registry_address = "TBD" +registry_address = "0x4B82F827C03fad5739EFEcfcF743E65E732be695" warning_instead_of_enforcement = false # ACL gate: the TaskManager is resolved at boot through the attested address book as diff --git a/src/main.rs b/src/main.rs index a8d5e28..d997fa7 100644 --- a/src/main.rs +++ b/src/main.rs @@ -1210,9 +1210,9 @@ mod tests { } /// COFHE_ENV=mainnet resolves the baked source — six key-share holders, threshold 3 - /// — AND the baked policy: permit ON, commitment baked ON and ENFORCING (v1) with a - /// TBD registry address. Mainnet fail-closes at boot until COMMITMENT_REGISTRY_RPC_URL - /// is set. + /// — AND the baked policy: permit ON, commitment baked ON and ENFORCING against the + /// CommitmentRegistry on Arbitrum One. Mainnet fail-closes at boot until + /// COMMITMENT_REGISTRY_RPC_URL is set. #[cfg(not(feature = "mock"))] #[test] fn config_env_mainnet_resolves_baked_source_and_policy() { @@ -1227,8 +1227,8 @@ mod tests { ); assert_eq!(src.shamir_threshold, 3); // must match the keygen var-file's split - // Policy resolves: permit on, commitment baked ON + ENFORCING (v1), with the - // registry address a TBD placeholder until the mainnet contract is deployed. + // Policy resolves: permit on, commitment baked ON + ENFORCING, pointing at the + // CommitmentRegistry deployed on Arbitrum One. let p = env_policy::EnvPolicy::for_env("mainnet").expect("baked mainnet policy"); assert!(p.require_permit); assert!(p.enable_commitment_verification); @@ -1237,12 +1237,14 @@ mod tests { c.version, "0x0000000000000000000000000000000000000000000000000000000000000002" ); - assert_eq!(c.registry_address, "TBD"); + assert_eq!( + c.registry_address, + "0x4B82F827C03fad5739EFEcfcF743E65E732be695" + ); assert!(!c.warning_instead_of_enforcement); // Because commitment is baked ON but the registry RPC is env-supplied, a mainnet - // boot FAIL-CLOSES until COMMITMENT_REGISTRY_RPC_URL is set — mainnet teecryptor - // is intentionally not deployable until the contract is live and the RPC lands. + // boot FAIL-CLOSES until COMMITMENT_REGISTRY_RPC_URL is set. let _g = EnvGuard::new(KEYS); std::env::set_var("COFHE_ENV", "mainnet"); std::env::set_var("CT_SOURCE_URL", "http://x");