feat(contract): async TEE attestation verification, drop `dcap-qvl` by pbeza · Pull Request #3714 · near/mpc

pbeza · 2026-06-30T17:15:22Z

Closes #3642.

Splits the first half of #3664 out for focused review: the contract-side async TEE attestation flow and the removal of dcap-qvl from mpc-contract. The stub verifier, sandbox tests, and design doc land in a stacked PR on top of this branch.

Today the MPC contract verifies a node's Intel TDX attestation synchronously, inside its own WASM, by linking the dcap-qvl library. This PR moves that crypto verification out to a separate tee-verifier contract and makes submit_participant_info asynchronous (yield/resume via a cross-contract call, with refund/revert on failure or the ~200-block timeout). The MPC contract stops linking dcap-qvl entirely.

WASM size impact

Dropping dcap-qvl shrinks the contract WASM by ~310 KB (-20.5%). Both binaries built identically (cargo near build non-reproducible-wasm --features abi --profile=release-contract --locked, same wasm-opt -O post-step):

	Raw bytes	Gzipped
`main`	1,513,344	576,992
this PR	1,202,840	450,631
delta	-310,504 (-20.5%)	-126,361 (-21.9%)

cargo tree -p mpc-contract -i dcap-qvl returns no match on this branch (it resolves on main), confirming dcap-qvl is no longer in the contract's build graph.

Dstack attestations are no longer verified in-WASM. submit_participant_info now branches: Mock is verified synchronously, Dstack yields and offloads DCAP quote verification to a separate tee-verifier contract via a cross-contract call, resuming through resolve_verification / on_attestation_verified. This lets the contract drop the mpc-attestation local-verify feature (and with it dcap-qvl). Adds the pending-attestation state, the yield/resume + refund/revert machinery, the verifier-call gas config, and the related error variants. This is the contract-side wiring only; the verifier interface (tee-verifier-interface, DstackAttestation::verify) already exists. Sandbox coverage (stub verifier + tests) and the design doc follow in a separate PR.

Copilot

Pull request overview

This PR wires the MPC contract to verify Attestation::Dstack asynchronously by offloading DCAP quote verification to an external tee-verifier contract (via a cross-contract verify_quote call), while keeping Attestation::Mock synchronous. It also removes the dcap-qvl dependency from mpc-contract by dropping the mpc-attestation/local-verify feature and updates the interface/config/snapshots to reflect the new async flow.

Changes:

Implement async Dstack attestation submission using yield/resume (resolve_verification → on_attestation_verified) with refund + cleanup on rejection/timeout.
Add pending-attestation state and new config gas fields + interface constants for verifier/callback/failure calls.
Remove contract-side local DCAP verification dependency path and regenerate ABI/Borsh schema snapshots and affected tests.

Reviewed changes

Copilot reviewed 19 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
crates/test-utils/src/contract_types.rs	Updates dummy config builder to populate newly added gas config fields.
crates/near-mpc-contract-interface/src/types/config.rs	Extends `InitConfig`/`Config` with verifier + callback + failure gas parameters and updates related tests.
crates/near-mpc-contract-interface/src/method_names.rs	Adds method-name constants for new callbacks and the verifier’s `verify_quote` entrypoint.
crates/mpc-attestation/src/attestation.rs	Updates docs around local verification usage after moving contract-side DCAP verification out-of-WASM.
crates/contract/tests/snapshots/abi__abi_has_not_changed.snap	Regenerates ABI snapshot to include new private callbacks, types, and config fields.
crates/contract/tests/sandbox/upgrade_from_current_contract.rs	Updates sandbox upgrade test config values to include new fields.
crates/contract/tests/sandbox/contract_configuration.rs	Updates initialization/configuration sandbox test to include new config fields.
crates/contract/tests/inprocess/attestation_submission.rs	Adjusts in-process tests to match new attestation-submission error plumbing.
crates/contract/src/v3_12_0_state.rs	Adds `pending_attestations` initialization to the v3.12.0 → current state migration.
crates/contract/src/tee/tee_state.rs	Splits mock vs Dstack verification paths, adds revert support for async storage-charge failures, and exposes attestation submission errors.
crates/contract/src/tee/pending_attestation.rs	Introduces new on-chain state/type for in-flight Dstack attestation verification and yield resume result.
crates/contract/src/tee.rs	Exposes the new `pending_attestation` module.
crates/contract/src/storage_keys.rs	Adds a storage key variant for the pending-attestations map.
crates/contract/src/snapshots/mpc_contract__tests__mpc_contract_borsh_schema_has_not_changed.snap	Regenerates Borsh schema snapshot for new config fields and added contract state.
crates/contract/src/lib.rs	Implements async Dstack submission flow, pending state management, refund/fail machinery, and storage charging refactor.
crates/contract/src/errors.rs	Adds new tee error variants and plumbs `AttestationSubmissionError` into the top-level `Error`.
crates/contract/src/dto_mapping.rs	Maps new config fields between DTOs and internal config.
crates/contract/src/config.rs	Adds default values for new gas config fields.
crates/contract/Cargo.toml	Drops `mpc-attestation/local-verify` (removing `dcap-qvl` from contract), adds `tee-verifier-interface`, and adjusts ABI features.
Cargo.lock	Updates dependency graph for the contract changes (new deps, removed feature linkage).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

claude · 2026-06-30T17:30:07Z

test

claude · 2026-06-30T17:30:51Z

Pull request overview

Splits the contract-side async TEE attestation flow out of #3664. submit_participant_info now branches by attestation type: Mock keeps the synchronous in-WASM path, while Dstack registers a yield, offloads DCAP verification to a separate tee-verifier contract via a cross-contract call, and resumes through resolve_verification / on_attestation_verified (refunding deposit on rejection / yield-timeout). The contract drops mpc-attestation/local-verify (and with it dcap-qvl). Adds the pending-attestation map, four new gas knobs, and VerificationAlreadyPending / VerifierNotConfigured errors.

Findings

Blocking (must fix before merge):

crates/contract/src/config.rs:71 -- fail_attestation_submission_tera_gas is inserted between existing fields (fail_on_timeout_tera_gas and clean_tee_status_tera_gas) rather than appended. Combined with the new pending_attestations field appended to MpcContract, this changes the borsh layout of both Config and MpcContract. The migration in lib.rs:2161 only handles v3_12_0_state; the fallback try_state_read::<Self>() cannot deserialize state written by the current 3.13.0 release (CHANGELOG 2026-06-24), which has remove_non_participant_tee_verifier_votes_tera_gas, tee_verifier_account_id, and tee_verifier_votes but neither pending_attestations nor the inserted fail_attestation_submission_tera_gas. If 3.13.0 has been deployed anywhere (mainnet/testnet/devnet), this PR's migrate() will fail on first invocation. Either (a) append fail_attestation_submission_tera_gas at the end of Config and add a v3_13_0_state.rs snapshot describing the released 3.13.0 layout, or (b) confirm in the PR description that 3.13.0 has not been deployed anywhere.
crates/contract/src/lib.rs:842-911 -- engineering-standards.md "Add tests": the PR removes the only unit tests covering Dstack submission (test_submit_participant_info_succeeds_with_valid_dstack_attestation, test_submit_participant_info_fails_without_approved_mpc_hash, test_tee_attestation_fails_with_invalid_tls_key) and ships no unit-level coverage for the new async machinery. The following invariants are unit-testable here and would fail if reverted:
- submit_participant_info returns VerifierNotConfigured when tee_verifier_account_id.is_none().
- submit_participant_info returns VerificationAlreadyPending when a PendingAttestation already exists for the account.
- submit_participant_info (Dstack path) inserts a PendingAttestation keyed by account id.
- TeeState::revert_dstack_store restores the displaced entry on UpdatedExistingParticipant(_) and removes the new entry on NewlyInsertedParticipant.
- charge_attestation_storage returns InsufficientDeposit when attached < cost and does not schedule a partial refund on that branch.
Please add these before merge; sandbox coverage in the follow-up PR is complementary, not a substitute.

Non-blocking (nits, follow-ups, suggestions):

crates/contract/src/lib.rs:2503 vs lib.rs:878 -- NearToken::from_near(0) vs NearToken::from_yoctonear(0). Pick one.
crates/contract/src/lib.rs:821 -- caller_is_participant = self.voter_account().is_ok() quietly conflates "not signer", "auth failed", and "not a participant" into a single bool. A dedicated caller_is_attested_participant() helper (or a one-line note pinning the dependency) would prevent silent regressions if voter_account ever changes meaning.
crates/contract/src/lib.rs:907-909 -- comment restates the helper docstring at lib.rs:329-330. Could be deleted.
crates/contract/src/lib.rs:2417-2418 -- "MUST be the last host call: anything after could panic..." is slightly misleading since promise_yield_resume returns bool and never panics; the real risk is the preceding serde_json::to_vec(...).expect(...). Consider reframing.
crates/contract/src/lib.rs:2474-2507 -- on_attestation_verified's Ok(AttestationResult::Err(reason)) branch silently relies on resolve_verification having already cleaned up. A debug_assert!(!self.pending_attestations.contains_key(&account_id)) in the Ok(_) arms (or an inline note that resolve_verification owns cleanup on the resolved-with-error path) would prevent a future change on either side from silently leaking a pending entry.
crates/contract/src/tee/pending_attestation.rs:14-30 -- PendingAttestation's fields are pub even though the only consumer is crate::lib. Consider pub(crate).
crates/contract/src/lib.rs:875-880 -- a one-line pointer at tee_verifier_interface::verify_quote (or method_names::VERIFY_QUOTE) would make the implicit two-positional-args borsh wire contract discoverable from this call site.
Documentation alignment: if any pre-existing design doc on main describes in-WASM verification, please flag/update it in the same PR per CLAUDE.md "Documentation alignment".
Gas defaults (config.rs:40,43,47): DEFAULT_VERIFIER_TERA_GAS = 100, DEFAULT_RESOLVE_VERIFICATION_TERA_GAS = 60, DEFAULT_ON_ATTESTATION_VERIFIED_TERA_GAS = 10 are reasonable upper-bound guesses but unbenchmarked at this layer; mirror the cleanup_orphaned_node_migrations_tera_gas TODO (config.rs:32) with a TODO(#issue): benchmark note so the work is tracked once the stub verifier lands.

⚠️ Issues found

- refund the attached deposit when a participant refreshes an existing attestation (charge_attestation_storage early-return kept it silently) - add v3_13_0_state migration shadow so migrate() can upgrade from a deployed 3.13.0 layout, not just 3.12.0 - collapse the two per-arm debug_asserts in on_attestation_verified into one guarding both resolved paths, with a note on why cleanup stays in resolve_verification (its remove-before-store gates the timeout race) - nits: from_yoctonear(0) on the fail-call; drop a redundant yield comment; reframe the promise_yield_resume comment; PendingAttestation fields pub(crate); document the verify_quote wire args; benchmark TODOs on the new gas defaults - TODO(#3720): stash only tcb_info in PendingAttestation (follow-up)

…n-core

Rename the attestation verify-and-store helpers so they describe what they do rather than when they run: - add_mock_participant -> verify_and_store_mock - finish_dstack_verify -> verify_and_store_dstack - finish_verified_attestation -> verify_post_dcap_and_store Also tighten the resolve_verification and on_attestation_verified comments: scope the no-verdict note to the Err arm, name the ~200-block yield-resume timeout explicitly, and trim the debug_assert rationale to the single invariant it rests on

…n-core

Copilot

Pull request overview

Copilot reviewed 20 out of 21 changed files in this pull request and generated 1 comment.

pbeza · 2026-07-01T14:46:13Z

@claude review

claude · 2026-07-01T14:54:52Z

Pull request overview

Splits the async TEE attestation core out of #3664. submit_participant_info now branches on the attestation variant: Mock keeps the synchronous in-WASM path (verify_and_store_mock + charge_attestation_storage), while Dstack schedules a verify_quote cross-contract call to the voted-in tee-verifier, registers a yield, and resumes via resolve_verification / on_attestation_verified (refunding the attached deposit and failing from a separate receipt on rejection or timeout). The contract stops linking dcap-qvl (drops mpc-attestation/local-verify), which is what produces the ~296 KB WASM shrink in the PR description. Introduces a v3.13.0 migration shadow, the pending_attestations LookupMap, four new gas knobs, and the VerificationAlreadyPending / VerifierNotConfigured errors.

Changes:

Async Dstack submission: yield/resume plumbing, pending-entry state, revert path on post-DCAP failure, refund on rejection/timeout.
New v3_13_0_state.rs migration snapshot so upgrades from the 3.13.0 release deserialize cleanly.
Errors: AttestationSubmissionError promoted to pub and lifted into Error as a top-level variant; TeeError gains VerificationAlreadyPending and VerifierNotConfigured.
Config: new verifier_tera_gas, resolve_verification_tera_gas, on_attestation_verified_tera_gas, fail_attestation_submission_tera_gas (plus DTO/InitConfig plumbing).
Method-name constants: verify_quote, resolve_verification, on_attestation_verified, fail_attestation_submission.
Removes the three inline unit tests that covered the old sync Dstack path; author confirms replacements land in stacked PR test(contract): sandbox coverage + stub verifier for async attestation #3715.
Regenerates ABI + borsh schema snapshots.

Reviewed changes

Per-file summary

File	Description
`crates/contract/src/lib.rs`	New async Dstack flow (`submit_dstack_attestation`, `resolve_verification`, `verify_post_dcap_and_store`, `on_attestation_verified`, `fail_attestation_submission`), pending-attestations map, deposit-refund helper, `charge_attestation_storage` refactor, migration path prepended for v3.13.0.
`crates/contract/src/tee/pending_attestation.rs`	New `PendingAttestation` state (with TODO(#3720) to strip `quote`/`collateral`) and `AttestationResult` yield payload; JSON round-trip unit test.
`crates/contract/src/tee/tee_state.rs`	Splits `add_participant` into `verify_and_store_mock` / `verify_and_store_dstack`, adds `revert_dstack_store`, `expected_report_data`, `store_verified_attestation` helpers; `ParticipantInsertion::UpdatedExistingParticipant` now carries the displaced entry.
`crates/contract/src/v3_13_0_state.rs`	New migration shadow for the 3.13.0 release layout.
`crates/contract/src/v3_12_0_state.rs`	Initializes `pending_attestations` in the v3.12.0 → current migration.
`crates/contract/src/config.rs` / `dto_mapping.rs`	Four new gas knobs, default values, DTO mapping.
`crates/contract/src/errors.rs`	New `TeeError` variants and `AttestationSubmission` top-level variant.
`crates/contract/src/storage_keys.rs` / `tee.rs`	New `PendingAttestations` storage key + module wiring.
`crates/contract/Cargo.toml` / `Cargo.lock`	Drop `mpc-attestation/local-verify`; add `attestation` and `tee-verifier-interface`; wire `borsh-schema` for ABI.
`crates/mpc-attestation/src/attestation.rs`	Doc update: `verify_locally` no longer used by the contract.
`crates/near-mpc-contract-interface/src/method_names.rs` / `types/config.rs`	New method-name constants and `InitConfig`/`Config` gas fields.
`crates/contract/tests/inprocess/attestation_submission.rs`	Updates assertion to the new `AttestationSubmission(TlsKeyOwnedByOtherAccount)` variant.
`crates/contract/tests/sandbox/{contract_configuration,upgrade_from_current_contract}.rs`	Populates the four new config fields.
`crates/contract/tests/snapshots/abi__abi_has_not_changed.snap` / `src/snapshots/…borsh_schema…snap`	Regenerated ABI + borsh schema.
`crates/test-utils/src/contract_types.rs`	`dummy_config` populates the four new fields.

Findings

Blocking issues from my prior review have been addressed in this iteration:

v3.13.0 state migration is now shadowed via crates/contract/src/v3_13_0_state.rs, with migrate() trying it before the v3.12.0 path. Field order in OldConfig matches the current Config on main (i.e. the deployed 3.13.0 layout).
PendingAttestation fields are pub(crate).
charge_attestation_storage now refunds the full attached deposit on the participant-refresh early return (refund_attestation_deposit(account_id, attached)), matching the docstring.
on_attestation_verified's success arm has the requested debug_assert!(!self.pending_attestations.contains_key(&account_id)) guarding the invariant that resolve_verification cleans up first.
Missing unit-level coverage for the new async paths is acknowledged and deferred to stacked PR test(contract): sandbox coverage + stub verifier for async attestation #3715.

Non-blocking (nits, follow-ups, suggestions):

crates/contract/src/lib.rs:135,845 vs lib.rs:2266,2299,2332 — NearToken::from_yoctonear(0) (new code) vs NearToken::from_near(0) (existing timeout callbacks). Same value, different spellings across files. Pick one to keep the codebase consistent.
crates/contract/src/lib.rs (async Dstack path) — the transient PendingAttestation entry (~200 blocks lifetime) is inserted using the contract's own storage staking; the caller's attached_deposit is stashed and refunded verbatim on timeout, but never accounted against the pending entry's storage cost. Bounded to one entry per account (via VerificationAlreadyPending) and self-clearing on timeout, so the blast radius is small — but with a verifier that takes the full yield window, a burst of Dstack submissions from distinct accounts could occupy contract-staked storage at zero cost to submitters. Worth a follow-up issue tracking either a per-pending storage charge or a minimum-deposit requirement for the Dstack path (probably alongside the Trim VerificationContext to carry only TcbInfo (drop quote/collateral) #3720 slimming that reduces the per-entry footprint).
crates/contract/src/lib.rs (submit_participant_info error contract) — this PR changes the shape of the error returned to callers: the "TLS key owned by other account" and "attestation failed verification" cases previously returned Error::InvalidParameters(InvalidTeeRemoteAttestation { reason: … }); they now return Error::AttestationSubmission(AttestationSubmissionError::…) with different Display output. attestation_submission.rs is updated in-tree, but any off-chain code / integration test / dashboard string-matching the old error text will silently break. If nothing off-chain matches these strings today, it's fine — please confirm, and add a note to the changelog either way.
crates/contract/src/lib.rs:820 — caller_is_participant = self.voter_account().is_ok() is now captured into PendingAttestation and consumed later in a callback receipt where voter_account() would no longer answer meaningfully. A caller who was a participant at submit time but is voted out during the yield window still gets the "free storage" refresh path. Impact is trivial (one small entry), but the semantics might drift silently — worth either a one-line comment on caller_is_participant in pending_attestation.rs calling out this design decision, or a dedicated caller_is_attested_participant() helper (still holds if you use it inside PendingAttestation::caller_is_participant).
crates/contract/src/lib.rs (resolve_verification) — the comment "MUST be the last host call: anything after could panic and roll back the state mutations above" is technically correct in intent, but reads oddly because the actual panic risk is the serde_json::to_vec(&attestation_result).expect(...) in the argument position, evaluated before promise_yield_resume. If that panics the receipt rolls back cleanly (pending stays, yield times out) — which is the safe fallback. Consider rephrasing the comment to describe the invariant it's protecting ("no state-mutating host calls may follow this point") rather than the panic mechanism.
crates/contract/src/lib.rs (submit_dstack_attestation) — a one-line pointer to tee_verifier_interface::verify_quote (or method_names::VERIFY_QUOTE) at the Promise::new(verifier_account_id).function_call(...) call site would make the implicit two-positional-args borsh wire contract discoverable without cross-crate hunting.
Gas defaults (crates/contract/src/config.rs:75-83) — DEFAULT_VERIFIER_TERA_GAS = 100, DEFAULT_RESOLVE_VERIFICATION_TERA_GAS = 60, DEFAULT_ON_ATTESTATION_VERIFIED_TERA_GAS = 10 are unbenchmarked estimates. Mirroring the cleanup_orphaned_node_migrations_tera_gas TODO with a TODO(#issue): benchmark once the stub verifier lands would make the follow-up work explicit and searchable.
Documentation alignment: I didn't find pre-existing prose docs describing the in-WASM DCAP path, but if any docs/design/* or module-level //! doc still describes contract-side dcap-qvl verification as the current design, flag/update it in the same PR per CLAUDE.md.

✅ Approved

- Fix broken rustdoc intra-doc link in tee_state.rs (Attestation was not in scope; use the in-scope DstackAttestation), which the workspace broken_intra_doc_links=deny lint would fail CI on - Correct the v3_13_0_state module doc field count (four Config gas fields plus the pending_attestations map, not two) - Rename stale add_participant_* tests to the verify_and_store_mock SUT and the <sut>__should_<assertion> form - Fix a/an grammar in an Attestation::Dstack doc comment

The a->an grammar fix in on_attestation_verified's doc comment changed the doc string embedded in the ABI, which test_abi_has_not_changed compares against the committed snapshot. Update the snapshot to match

The fail_on_timeout callback sites used NearToken::from_near(0) while the new attestation code uses from_yoctonear(0); both are zero. Unify on from_yoctonear(0)

…n-core

kevindeforth

Thank you!

#3715)

…-participants submit_participant_info required a deposit unconditionally, which broke nodes signing with a function-call access key: such keys cannot attach any deposit, so every re-attestation failed at tx validation with DepositWithFunctionCall. Restore the pre-#3714 conditional: a participant re-attesting an existing entry attaches no deposit and is charged nothing (so the node's function-call key can re-attest), while a new entry or a non-participant caller still pays the storage delta. The client and node stop attaching the deposit; an operator's full-access key funds a first-time (join) submission. Adds a sandbox regression test that drives submit_participant_info through a real function-call access key (zero deposit succeeds; a deposit is rejected). Closes #3925

… onboarding The fixed MINIMUM_ATTESTATION_STORAGE_DEPOSIT floor rejected zero-deposit submissions outright. Restore the pre-#3714 behavior: charge only the measured storage delta and reject only when the attached deposit is below it. A participant re-attesting an unchanged entry grows nothing, so it pays nothing and its function-call key works; a new entry costs the measured delta, funded by a deposit-capable caller. In e2e, fund each new participant's first attestation before resharing, signed with the node's near_signer_key so the stored account_public_key matches the key the node later uses for key-event votes (an operator key would store the wrong key and stall resharing). Add MpcNodeState::near_signer_key for this. Repurpose the worst-case test to assert the entry cost stays under a bounded ceiling, and regenerate the ABI snapshot.

submit_participant_info takes no deposit; the contract's own balance stakes the bounded attestation entry. A node self-submits with its function-call access key for its first attestation and re-attestations alike, fixing onboarding: #3714 required a deposit, which a function-call key cannot attach. This makes intentional what pre-#3714 did by accident. Pre-#3714 measured the storage delta right after inserting into the IterableMap, before the deferred write was flushed, so the delta read as 0 and the caller was never charged. #3714 added the flush (kept here), which exposed the real cost and started rejecting the node's zero-deposit submit. Storage is bounded and reclaimed by clean_invalid_attestations, so the contract-funded cost is bounded and self-healing. Removes the charge path, the payable modifiers, deposit forwarding, and the e2e funding workaround; updates tests and the ABI snapshot.

…ragraph The background implied contract-funded storage started with #3940. It did not: the deployed 3.13.0 contains charging code that never collects, because it reads the storage delta before the write is flushed, and #3714 -- the only version that genuinely required a deposit -- never shipped. So this has been true of every deployed version, and #3940 only made it intentional. That matters because it means the drain is not a regression to be reverted but a gap that was always there. Also split the run-on sentence about the security implication into three bullets: unlimited entries, roughly 7x cost asymmetry, and the contract being unable to write state at all once its balance is gone.

Copilot AI review requested due to automatic review settings June 30, 2026 17:15

Copilot started reviewing on behalf of pbeza June 30, 2026 17:15 View session

pbeza mentioned this pull request Jun 30, 2026

test(contract): sandbox coverage + stub verifier for async attestation #3715

Merged

Copilot AI reviewed Jun 30, 2026

View reviewed changes

Comment thread crates/contract/src/tee/pending_attestation.rs Outdated

Comment thread crates/contract/src/lib.rs Outdated

pbeza mentioned this pull request Jun 30, 2026

feat(contract): async TEE attestation verification via verifier contract, drop dcap-qvl #3664

Closed

pbeza mentioned this pull request Jul 1, 2026

Trim VerificationContext to carry only TcbInfo (drop quote/collateral) #3720

Open

pbeza added 2 commits July 1, 2026 12:50

Merge remote-tracking branch 'origin/main' into 3642-async-attestatio…

68837a1

…n-core

pbeza changed the title ~~feat(contract): async TEE attestation verification, drop dcap-qvl~~ feat(contract): async TEE attestation verification, drop dcap-qvl Jul 1, 2026

pbeza added 3 commits July 1, 2026 15:00

docs(contract): fix migrate doc link in v3_13_0_state

79dc9fe

Merge remote-tracking branch 'origin/main' into 3642-async-attestatio…

cde4a47

…n-core

pbeza requested a review from Copilot July 1, 2026 13:02

Copilot started reviewing on behalf of pbeza July 1, 2026 13:03 View session

Copilot AI reviewed Jul 1, 2026

View reviewed changes

Comment thread crates/contract/src/lib.rs Outdated

pbeza added 4 commits July 1, 2026 17:09

test(contract): sync ABI snapshot with a/an doc fix

fd2291f

The a->an grammar fix in on_attestation_verified's doc comment changed the doc string embedded in the ABI, which test_abi_has_not_changed compares against the committed snapshot. Update the snapshot to match

refactor(contract): unify zero-NearToken spelling to from_yoctonear(0)

e15bc3d

The fail_on_timeout callback sites used NearToken::from_near(0) while the new attestation code uses from_yoctonear(0); both are zero. Unify on from_yoctonear(0)

Merge remote-tracking branch 'origin/main' into 3642-async-attestatio…

74e9f72

…n-core

pbeza requested review from anodar, barakeinav1, gilcu3 and kevindeforth July 2, 2026 10:49

barakeinav1 reviewed Jul 5, 2026

View reviewed changes

Comment thread crates/contract/src/lib.rs Outdated

barakeinav1 reviewed Jul 5, 2026

View reviewed changes

Comment thread crates/contract/src/lib.rs Outdated

pbeza dismissed barakeinav1’s stale review via 8710f65 July 22, 2026 12:57

barakeinav1 mentioned this pull request Jul 22, 2026

Add a gas-metered sandbox test for verify_quote with a valid quote (cover the verifier_tera_gas budget) #3897

Open

2 tasks

pbeza requested review from barakeinav1, gilcu3 and kevindeforth July 22, 2026 13:02

gilcu3 previously approved these changes Jul 22, 2026

View reviewed changes

kevindeforth previously approved these changes Jul 22, 2026

View reviewed changes

test(contract): sandbox coverage + stub verifier for async attestation (

28f9b90

#3715)

pbeza dismissed stale reviews from kevindeforth and gilcu3 via 28f9b90 July 22, 2026 13:19

pbeza enabled auto-merge July 22, 2026 13:19

kevindeforth approved these changes Jul 22, 2026

View reviewed changes

gilcu3 approved these changes Jul 22, 2026

View reviewed changes

pbeza added this pull request to the merge queue Jul 22, 2026

Merged via the queue into main with commit ebc7f0d Jul 22, 2026
15 checks passed

pbeza deleted the 3642-async-attestation-core branch July 22, 2026 13:44

barakeinav1 mentioned this pull request Jul 23, 2026

main: node with a function-call signer key cannot submit_participant_info (deposit → DepositWithFunctionCall) #3925

Closed

2 tasks

pbeza mentioned this pull request Jul 23, 2026

fix(contract): drop the deposit for submit_participant_info #3940

Merged

This was referenced Jul 23, 2026

Port max-collateral-age fix (#3941) to main #3943

Closed

fix: Extend max collateral age (port #3941 to main) #3944

Closed

pbeza mentioned this pull request Jul 24, 2026

feat(contract): auto-expire unused launcher image hashes #3564

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(contract): async TEE attestation verification, drop `dcap-qvl` - #3714

feat(contract): async TEE attestation verification, drop `dcap-qvl`#3714
pbeza merged 48 commits into
mainfrom
3642-async-attestation-core

pbeza commented Jun 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jun 30, 2026

Uh oh!

claude Bot commented Jun 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

pbeza commented Jul 1, 2026

Uh oh!

claude Bot commented Jul 1, 2026

Uh oh!

Uh oh!

Uh oh!

kevindeforth left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

pbeza commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

WASM size impact

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

claude Bot commented Jun 30, 2026

Uh oh!

claude Bot commented Jun 30, 2026

Pull request overview

Findings

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

pbeza commented Jul 1, 2026

Uh oh!

claude Bot commented Jul 1, 2026

Pull request overview

Reviewed changes

Findings

Uh oh!

Uh oh!

Uh oh!

kevindeforth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

pbeza commented Jun 30, 2026 •

edited

Loading