[CHORE] mainnet: bake the CommitmentRegistry address

src/env_policy.rs

@@ -475,6 +475,28 @@ mod tests {
         assert!(c.warning_instead_of_enforcement);
     }
 
+    #[test]
+    fn mainnet_policy_is_commitment_enforcing() {
+        let p = EnvPolicy::for_env("mainnet").expect("mainnet policy");
+        assert!(p.require_permit);
+        assert!(p.enable_commitment_verification);
+        let c = p.commitment.expect("mainnet has a [commitment] block");
+        assert_eq!(
+            c.version,
+            "0x0000000000000000000000000000000000000000000000000000000000000002"
+        );
+        // The CommitmentRegistry on Arbitrum One (chain 42161), serving both host chains.
+        assert_eq!(
+            c.registry_address,
+            "0x4B82F827C03fad5739EFEcfcF743E65E732be695"
+        );
+        // Fresh registry, version 2 only: nothing to grandfather, so enforce from day one.
+        assert!(!c.warning_instead_of_enforcement);
+        assert_eq!(p.acl.task_manager_id(1), Some(1));
+        assert_eq!(p.acl.task_manager_id(42161), Some(1));
+        assert_eq!(p.acl.task_manager_id(84532), None);
+    }
+
     /// FAIL-CLOSED: an env with no baked policy is rejected — same posture as the
     /// key-source `lookup`, so the two never drift apart silently.
     #[test]

src/envs/mainnet.toml

@@ -1,19 +1,20 @@
 # Baked security policy — "mainnet" environment (six key-share holders, threshold 3).
 #
-# The permit gate is ON. The commitment gate is baked ON and ENFORCING (v1,
-# warning_instead_of_enforcement = false), but the CommitmentRegistry contract for
-# mainnet is not deployed yet — registry_address is a "TBD" placeholder. This is
-# deliberately NOT bootable until the real address is filled in AND the (API-keyed)
-# COMMITMENT_REGISTRY_RPC_URL is supplied: with the gate on, boot fail-closes when the
-# RPC is unset, and "TBD" fails address parsing loudly when the RPC is set — so the
-# placeholder can never be deployed by accident. See src/envs/staging.toml for why RPC
-# endpoints stay env-supplied and are never baked into the (publicly-pullable) image.
+# The permit gate is ON. The commitment gate is baked ON and ENFORCING
+# (warning_instead_of_enforcement = false): a decrypt whose handle has no commitment
+# in the registry is refused, so the commitment poster must be live before intake
+# opens. The registry is the CommitmentRegistry on Arbitrum One (chain 42161), a
+# single contract serving both host chains; its default admin is the mainnet Safe and
+# version 2 is the only active version. The (API-keyed) COMMITMENT_REGISTRY_RPC_URL
+# stays env-supplied: with the gate on, boot fail-closes when it is unset. See
+# src/envs/staging.toml for why RPC endpoints are never baked into the
+# (publicly-pullable) image.
 require_permit                 = true
 enable_commitment_verification = true
 
 [commitment]
 version                        = "0x0000000000000000000000000000000000000000000000000000000000000002"
-registry_address               = "TBD"
+registry_address               = "0x4B82F827C03fad5739EFEcfcF743E65E732be695"
 warning_instead_of_enforcement = false
 
 # ACL gate: the TaskManager is resolved at boot through the attested address book as

src/main.rs

@@ -1210,9 +1210,9 @@ mod tests {
     }
 
     /// COFHE_ENV=mainnet resolves the baked source — six key-share holders, threshold 3
-    /// — AND the baked policy: permit ON, commitment baked ON and ENFORCING (v1) with a
-    /// TBD registry address. Mainnet fail-closes at boot until COMMITMENT_REGISTRY_RPC_URL
-    /// is set.
+    /// — AND the baked policy: permit ON, commitment baked ON and ENFORCING against the
+    /// CommitmentRegistry on Arbitrum One. Mainnet fail-closes at boot until
+    /// COMMITMENT_REGISTRY_RPC_URL is set.
     #[cfg(not(feature = "mock"))]
     #[test]
     fn config_env_mainnet_resolves_baked_source_and_policy() {
@@ -1227,8 +1227,8 @@ mod tests {
         );
         assert_eq!(src.shamir_threshold, 3); // must match the keygen var-file's split
 
-        // Policy resolves: permit on, commitment baked ON + ENFORCING (v1), with the
-        // registry address a TBD placeholder until the mainnet contract is deployed.
+        // Policy resolves: permit on, commitment baked ON + ENFORCING, pointing at the
+        // CommitmentRegistry deployed on Arbitrum One.
         let p = env_policy::EnvPolicy::for_env("mainnet").expect("baked mainnet policy");
         assert!(p.require_permit);
         assert!(p.enable_commitment_verification);
@@ -1237,12 +1237,14 @@ mod tests {
             c.version,
             "0x0000000000000000000000000000000000000000000000000000000000000002"
         );
-        assert_eq!(c.registry_address, "TBD");
+        assert_eq!(
+            c.registry_address,
+            "0x4B82F827C03fad5739EFEcfcF743E65E732be695"
+        );
         assert!(!c.warning_instead_of_enforcement);
 
         // Because commitment is baked ON but the registry RPC is env-supplied, a mainnet
-        // boot FAIL-CLOSES until COMMITMENT_REGISTRY_RPC_URL is set — mainnet teecryptor
-        // is intentionally not deployable until the contract is live and the RPC lands.
+        // boot FAIL-CLOSES until COMMITMENT_REGISTRY_RPC_URL is set.
         let _g = EnvGuard::new(KEYS);
         std::env::set_var("COFHE_ENV", "mainnet");
         std::env::set_var("CT_SOURCE_URL", "http://x");