PoC (draft): register dedicated synchronizers via governance (rung 1/2) - #1
Open
salindne wants to merge 6 commits into
Open
PoC (draft): register dedicated synchronizers via governance (rung 1/2)#1salindne wants to merge 6 commits into
salindne wants to merge 6 commits into
Conversation
… 1/2) [ci] Signed-off-by: Sebastian Lindner <33971232+salindne@users.noreply.github.com>
salindne
force-pushed
the
multi-sync-poc-registration
branch
from
July 21, 2026 10:14
51a8808 to
56e4666
Compare
…isfy check-daml-warts The trailing doc comment on the choice's `p` field ended with the word "fetch", which the grep-based scripts/check-daml-warts.sh flags as a naked fetch invocation (it only ignores full-line -- comments). Reword to drop the word; no code/behaviour change. Fixes the static_tests "Run Daml warts check" step. [ci] Signed-off-by: Sebastian Lindner <33971232+salindne@users.noreply.github.com>
…for damlc docs gen-daml-docs.sh (dpm docs) rejects a Haddock '-- |' doc comment attached directly to a choice: 'parse error on input -- |'. Splice's own choices use plain '--' comments (0/81 in splice-amulet use '-- |' on a choice), and damlc build ignores the distinction, so the Daml tests stayed green while the docs build failed. Convert the doc comments on RegisteredSynchronizer_Fetch and DsoRules_RegisterSynchronizer to plain comments. Verified locally with dpm docs on splice-amulet and splice-dso-governance (both exit 0). [ci] Signed-off-by: Sebastian Lindner <33971232+salindne@users.noreply.github.com>
timwu20
reviewed
Jul 21, 2026
…erSynchronizer last (SCU) Two issues surfaced by static_tests, both previously masked by the damlc-docs parse error that ran earlier in the same step: 1. DAR lock: the PoC changed splice-amulet + splice-dso-governance source but the checked-in daml/dars/*.dar and daml/dars.lock were stale (DarLockChecker: 'update the checked-in DAR'). Regenerated with 'sbt damlDarsLockFileUpdate'. No version bump needed: 0.1.22 / 0.1.28 are not in release-line-0.6.11. 2. Smart-contract upgrade (per @timwu20 review on PR): moved SRARC_RegisterSynchronizer to the END of DsoRules_ActionRequiringConfirmation. New constructors of a serializable variant must be appended after all existing ones - LF encodes constructor ranks, so inserting mid-list re-ranks the following constructors and breaks upgrade compatibility with the released splice-dso-governance. Semantically identical (matching is by name); the case arm and the choice are unchanged. [ci] Signed-off-by: Sebastian Lindner <33971232+salindne@users.noreply.github.com>
…esources
static_tests' illegal-references check bans deployment-specific vocabulary
in daml/ ("global", "CC", DSO outside allowed phrases, lowercase dso in
comments). Reword the PoC comments to the upstream whitelabel terms: "the
decentralized synchronizer", "Amulet", "DSO governance" / "DSO party".
Comment-only, but Daml-LF embeds source locations, so package ids change
anyway: regenerated the checked-in DARs + dars.lock (sbt
damlDarsLockFileUpdate) and DarResources.scala (sbt updateDarResources).
The latter was still carrying pre-refresh package ids, which is what
failed the Scala shards ("No package found for template ...") in the
last CI run.
Verified locally: splice-dso-governance-test and splice-amulet-test
damlTest both green (test_RegisterSynchronizer_viaVote: ok).
[ci]
Signed-off-by: Timothy Wu <tim.wu@chainsafe.io>
timwu20
force-pushed
the
multi-sync-poc-registration
branch
from
July 22, 2026 04:28
0cee7c8 to
c514673
Compare
This was referenced Jul 27, 2026
timwu20
marked this pull request as ready for review
July 27, 2026 16:03
| -- Controlled by the DSO party and `nonconsuming`: a vote reaches this via executeActionRequiringConfirmation, | ||
| -- and the DsoRules contract is not archived by exercising it. | ||
| -- (Plain comment, not a `-- |` doc comment: damlc docs rejects a doc comment attached to a choice.) | ||
| nonconsuming choice DsoRules_RegisterSynchronizer : DsoRules_RegisterSynchronizerResult |
There was a problem hiding this comment.
we probably also want a vote to archive it again
Collaborator
There was a problem hiding this comment.
Agreed — tracked as the registration-lifecycle action in ChainSafe/canton-extending-mainnet#30 (offboard/revoke by vote, plus the lifecycle-state field). Fine as a follow-up PR unless you'd rather see it in this one.
Per review on PR #1: doc comment via -- ^ after the choice declaration (damlc docs accepts this placement), drop the kept-last upgrade note and the redundant nonconsuming/vote-dispatch explainer; regenerate artifacts. Signed-off-by: Timothy Wu <tim.wu@chainsafe.io>
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PoC, rung 1 of 2, on DA's
splice-multi-syncfork (using this fork's CI).What this does
Adds the on-ledger registration step for the "Extending Mainnet" CIP: letting DSO governance authorize a dedicated (operator-run) synchronizer so its traffic can later be funded in Canton Coin, the way the decentralized synchronizer's traffic is today.
RegisteredSynchronizertemplate: a registry entry binding asynchronizerIdto theoperatorparty that runs it. Signatory is the DSO party; the operator is an observer, so it learns it has been registered. A publicRegisteredSynchronizer_Fetchchoice (mirrorsOpenMiningRound_Fetch) lets a later buyer read it via explicit disclosure.DsoRules_RegisterSynchronizergovernance action (SRARC_RegisterSynchronizervariant + choice + dispatch inexecuteActionRequiringConfirmation): a supermajority SV vote creates the registry entry.In plain terms: a DSO vote records "synchronizer X, run by operator Y, is authorized for CC-funded traffic."
How it's verified (
TestRegisterSynchronizer, Daml Script)test_RegisterSynchronizer_viaVoteruns a real 4-SV supermajority vote (RequestVote, CastVote x3, CloseVoteRequest,executeActionRequiringConfirmation,DsoRules_RegisterSynchronizer) and asserts the resultingRegisteredSynchronizercarries exactly the{dso, synchronizerId, operator}voted for and is visible to the operator. Negative: emptysynchronizerIdis rejected by the templateensure.Design notes
Additive: new template + new governance variant/choice only; no change to existing templates or
MemberTraffic. The newSRARC_RegisterSynchronizerconstructor is appended last (SCU upgrade-safe).Out of scope (next phase)
On-ledger only. The off-ledger side (the operator node granting the traffic) and a LocalNet end-to-end are the next workstream, not in this PR.
Rung 2 (the CC-funded buy) stacks on this in #2.
Heads-up for review: two code comments in this diff refer to the buy rung by its earlier sibling name (
AmuletRules_BuyDedicatedSyncTraffic); #2 reworked the buy rung to extendAmuletRules_BuyMemberTrafficand corrects those comments.Tracked in
Implements E1-1 (ChainSafe/canton-extending-mainnet#27) and E1-2 (#28); ChainSafe work breakdown; part of Epic E1 (#13). Follow-ups from review: registry uniqueness (ChainSafe/canton-extending-mainnet#54), registry-held
migrationIdwith operator-controlled bump (#55), and registration lifecycle (#30).