feat(capabilities): arm ADDRESS_PROOF_HEIGHT at 966_000 (H-7, #605) - #824
Merged
Conversation
H-7's probe has run report-only in the verification rotation since #633. This gate governs EMISSION: at and above 966_000 a challenger broadcasts the address proof it already performs, so the `/24` a node claims becomes a converged, majority-attested fact rather than a self-report nothing checks. Both preconditions the constant's own docs demand were checked on the RUNNING fleet, not from the source tree: 1. Every node knows the `CapabilityType::Address` variant. All eight run v1.11.33 at commit `bf3f822b5`, verified per binary through `--version`, which names the commit since #820 — not by version string, which is a weaker claim and the whole subject of #759. 2. A live pass rate on the rolled binary: 722 pass / 0 fail across all eight nodes since the roll, with zero `Unreachable`, `WrongSigner` or `BadSignature`. The 24h baseline from 2026-08-21 (9,681 / 181, 98.2%, every failure `Unreachable`) stands as the longer sample; this confirms the new binary behaves the same. 966_000 is ~785 blocks past where the arming roll lands — the chain was at 965,065 and is running ~150 blocks/day (144 blocks took 23h), so about five days of margin. Deliberately more than the ~2.2 days SHARE_TIER_BIND_HEIGHT used, because this gate fails SILENTLY: `CapabilityType` is a plain serde enum with no unknown-variant fallback, so a peer that does not know `"address"` does not reject the verdict, it drops the entire message without saying so. Margin is what buys room to roll back and re-roll. Three tests, each with a control. Reverting the constant to `u64::MAX` fails `the_armed_height_is_pinned` and `the_gate_is_armed_not_dormant`; `the_accessor_agrees_with_the_constant` correctly still passes, because it checks consistency rather than the value. The existing gate-summary test is unaffected — MESH_ENVELOPE_V2 and ARCHIVE_TX_PROOF remain dormant, so `never` still renders. ⚠ Requires a fleet roll. Mainnet gates ignore `GHOST_*_HEIGHT` env overrides (`from_env` returns the compiled default before reading the environment), so arming AND rolling back are both binary changes. Claude-Session: https://claude.ai/code/session_01Td1vvfowptTTnu88qG2iym
This was referenced Sep 1, 2026
defenwycke
added a commit
that referenced
this pull request
Sep 1, 2026
The arming release. Two consensus-visible gates fire from this build, and both require every node to be running it beforehand: * ADDRESS_PROOF_HEIGHT 966_000 (#824, H-7, #605) * MESH_ENVELOPE_V2_HEIGHT 966_400 (#825, H-11, #604) Deliberately ~400 blocks apart rather than sharing a height, so a mesh problem in that window is attributable to one gate rather than two. MESH_ENVELOPE_V2 is the reason that matters: it does not degrade, it PARTITIONS — a node left on an older binary rejects every mesh message from every upgraded peer, and the only way back is upgrading it. ⛔ ALL EIGHT must carry this before 966_400. At 965,085 that is ~8 days. Also carries #826: the deploy now prunes stale `$BINARY.bak.*` to the two most recent instead of accumulating them forever. Measured before the fix, after the v1.11.33 roll: vm1 39 files / 1.4 GB, vm4 38 / 765 MB, vm5 33 / 712 MB. Both lockfiles synced; `tests/integration-sv2`, `crates/stratum-apps` and `prototypes/ghast-bench` carry no workspace version and still resolve under `--locked`. Checked with `grep -F`, since an unescaped `1.11.33` matches digits inside dependency checksums. Claude-Session: https://claude.ai/code/session_01Td1vvfowptTTnu88qG2iym
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #605 (audit H-7).
What changes
ADDRESS_PROOF_HEIGHTgoes fromu64::MAX(never) to 966_000. At and above that height a challenger broadcasts the address proof it already performs, so the/24a node claims becomes a converged, majority-attested fact instead of a self-report nothing checks. The probe itself has run report-only since #633 — this gate governs emission, not probing.Preconditions, checked on the running fleet
The constant's docs demand two things before arming. Both verified against live nodes rather than the source tree:
1. Every node knows the
CapabilityType::Addressvariant. All eight run v1.11.33 atbf3f822b5, verified per binary via--version— which names the commit since #820. Version string alone is a weaker claim, and the gap between the two is exactly what #759 is about.2. A live pass rate on the rolled binary:
Unreachable/WrongSigner/BadSignatureThe 24h baseline from 2026-08-21 (9,681 pass / 181 fail, 98.2%, every failure
Unreachable) stands as the longer sample; this confirms the newly rolled binary behaves the same.Why 966_000
Chain was at 965,065, running ~150 blocks/day (measured: 144 blocks took 23h). The arming roll lands around 965,215, leaving ~785 blocks / ~5 days of margin.
That is deliberately more than the ~2.2 days
SHARE_TIER_BIND_HEIGHTused, because this gate fails silently:CapabilityTypeis a plain serde enum with no unknown-variant fallback, so a peer that does not know"address"does not reject the verdict — it drops the entire message without saying so. Margin is what buys room to roll back and re-roll.Tests and controls
u64::MAXthe_armed_height_is_pinnedandthe_gate_is_armed_not_dormantfailthe_accessor_agrees_with_the_constantcorrectly still passes (checks consistency, not the value)Existing gate-summary test unaffected: MESH_ENVELOPE_V2 and ARCHIVE_TX_PROOF stay dormant, so
neverstill renders andu64::MAXis still never printed raw.cargo test -p ghost-pool --lib: 495 passed, 0 failed. Clippy and fmt clean.⚠ Requires a fleet roll before 966_000
Mainnet gates ignore
GHOST_*_HEIGHTenv overrides —from_envreturns the compiled default before reading the environment — so arming and rolling back are both binary changes plus a full roll. Plan: merge this, cut v1.11.34, roll all eight, with ~5 days of margin before it fires.https://claude.ai/code/session_01Td1vvfowptTTnu88qG2iym