fix: harden ciphernode runtime and Rust architecture [skip-line-limit]

[hmzakhalid]

Summary

This draft PR carries the production-readiness and Rust architecture pass for the ciphernode and its protocol-critical dependencies.

• fixes replay crash loops and propagates backpressure through the startup event pipeline;
• hardens durable storage, schema preflight, snapshot atomicity, logical-clock recovery, shutdown draining, and supervisor cleanup;
• bounds and validates network ingress, historical synchronization, startup buffers, DHT metadata, and external serialization;
• strengthens EVM confirmation, parsing, nonce, receipt, replay, and slashing-effect behavior;
• binds proof/share aggregation to canonical E3, signer, committee, party, phase, parameter, and multiplicity invariants;
• restricts program-server callback destinations, timeouts, payload logging, and job concurrency while keeping the development/test server token-free;
• updates compatible vulnerable dependencies without adding release-policy or supply-chain test machinery;
• adds the final 45-package runtime and protocol architecture map under agent/.

No Solidity public ABI, deployed storage layout, Noir circuit source, circuit semantics, wire format, production deployment, key, secret, fund, release, or publication action is included.

Validation

• pnpm rust:test: PASS, 1,108 listed tests; real 1,021.30s; no failures.
• e3-tests actor integration: 3 passed, 2 ignored; TRBFV completed in 354.79s.
• correlated NodeFold proof/verify E2E: 1 passed in 82.01s.
• cargo check --workspace --all-targets --locked: PASS in 1m41s.
• cargo clippy --workspace --all-targets --locked -- -D warnings: PASS in 1m03s.
• cargo test --workspace --doc --locked: PASS.
• cargo fmt --all -- --check and git diff --check: PASS.
• pre-push repository lint, pnpm/license, and committee consistency hooks: PASS; existing Solidity lint emitted 3 warnings and nargo was unavailable, so the hook skipped Noir lint.
• cargo audit --no-fetch: reduced from 18 to 5 vulnerabilities; remains non-zero and is tracked by Upgrade libp2p TLS and DNS stack to clear remaining RustSec advisories #1690.
• circuit diff versus main: empty.
• default-template locked support build and CRISP wasm-target locked check: PASS.
• token-free program-server, CRISP caller, and template caller regressions: PASS (8 Rust server tests, 1 focused CRISP test, 1 template server test).
• C0/C6 restart recovery regressions (restored_): PASS (2 tests; 128 filtered).

Docker-backed disk-full/partition fault injection was not run because the Docker daemon is unavailable. The standalone crates/support-scripts/dev manifest remains blocked by its pre-existing workspace-membership error.

Fixed issues

• Closes Bind C0 proofs to the canonical E3 request and committee slot #1645 — Bind C0 proofs to the canonical E3 request and committee slot

• Closes Use the honest-party quorum for accusation voting #1646 — Use the honest-party quorum for accusation voting

• Closes Fail closed on corrupt event logs and reconcile indexes in bounded pages #1647 — Fail closed on corrupt event logs and reconcile indexes in bounded pages

• Closes Keep network broadcast consumers alive after receiver lag #1648 — Keep network broadcast consumers alive after receiver lag

• Closes Make startup replay end-to-end backpressured #1649 — Make startup replay end-to-end backpressured

• Closes Validate canonical H-of-N shapes before DKG aggregation #1650 — Validate canonical H-of-N shapes before DKG aggregation

• Closes Match the SDK finalized-committee event to the contract ABI #1651 — Match the SDK finalized-committee event to the contract ABI

• Closes Bound ciphernode startup with a configurable readiness deadline #1652 — Bound ciphernode startup with a configurable readiness deadline

• Closes Serialize pending nonce allocation for each chain signer #1653 — Serialize pending nonce allocation for each chain signer

• Closes Replace probabilistic event deduplication and reject timestamp conflicts #1654 — Replace probabilistic event deduplication and reject timestamp conflicts

• Closes Redact and bound sensitive structured tracing fields #1655 — Redact and bound sensitive structured tracing fields

• Closes Bound historical peer synchronization and require cursor progress #1656 — Bound historical peer synchronization and require cursor progress

• Closes Fail DAppNode startup closed on invalid credentials and false health #1657 — Fail DAppNode startup closed on invalid credentials and false health

• Closes Bind share proof bundles to canonical signers phases and multiplicity #1658 — Bind share proof bundles to canonical signers phases and multiplicity

• Closes Bind aggregation shares to canonical committee party slots #1659 — Bind aggregation shares to canonical committee party slots

• Closes Fail startup closed when EVM event buffers exceed their limit #1660 — Fail startup closed when EVM event buffers exceed their limit

• Closes Defer live EVM logs until confirmed canonical backfill #1661 — Defer live EVM logs until confirmed canonical backfill

• Closes Bound network startup buffering by event count and bytes #1662 — Bound network startup buffering by event count and bytes

• Closes Drain event snapshot and database state during graceful shutdown #1663 — Drain event snapshot and database state during graceful shutdown

• Closes Preserve large chain finalization delays without integer overflow #1664 — Preserve large chain finalization delays without integer overflow

• Closes Reject internal-only events received through protocol gossip #1665 — Reject internal-only events received through protocol gossip

• Closes Make multi-key snapshot writes atomic and acknowledged #1666 — Make multi-key snapshot writes atomic and acknowledged

• Closes Preserve existing node identities during autowallet startup #1667 — Preserve existing node identities during autowallet startup

• Closes Isolate snapshot batches by aggregate and await final persistence #1668 — Isolate snapshot batches by aggregate and await final persistence

• Closes Restore the full logical clock from durable replay history #1669 — Restore the full logical clock from durable replay history

• Closes Reject incomplete multi-chain EVM history during startup #1670 — Reject incomplete multi-chain EVM history during startup

• Closes Reject incompatible storage schemas before actors write state #1671 — Reject incompatible storage schemas before actors write state

• Closes Bound and exactly consume external bincode payloads #1672 — Bound and exactly consume external bincode payloads

• Closes Reject already-expired DHT documents #1673 — Reject already-expired DHT documents

• Closes Bind BFV proofs to exact supported parameter presets #1674 — Bind BFV proofs to exact supported parameter presets

• Closes Reject malformed EVM logs before dispatch or checkpointing #1675 — Reject malformed EVM logs before dispatch or checkpointing

• Closes Reject reverted EVM transaction receipts across all writer paths #1676 — Reject reverted EVM transaction receipts across all writer paths

• Closes Replay aggregates in global timestamp order #1677 — Replay aggregates in global timestamp order

• Closes Bind DHT notification metadata to decoded document payloads #1678 — Bind DHT notification metadata to decoded document payloads

• Closes Backpressure remote network-to-actor ingress #1679 — Backpressure remote network-to-actor ingress

• Closes Defer and coalesce slashing submissions during replay #1680 — Defer and coalesce slashing submissions during replay

• Closes Constrain program-server callbacks and concurrency #1681 — Constrain program-server callbacks and concurrency

• Closes Report supervised child exits and prevent orphaned ciphernodes #1682 — Report supervised child exits and prevent orphaned ciphernodes

• Closes Preserve buffered request-event order and clean terminal state #1683 — Preserve buffered request-event order and clean terminal state

• Closes Fence startup recovery phases before entering live mode #1684 — Fence startup recovery phases before entering live mode

• Closes Count C3 share-encryption proofs by threshold share rows #1685 — Count C3 share-encryption proofs by threshold share rows

• Closes Use committee-scoped artifacts in the correlated NodeFold E2E test #1686 — Use committee-scoped artifacts in the correlated NodeFold E2E test

• Closes Apply compatible RustSec patches to locked runtime dependencies #1687 — Apply compatible RustSec patches to locked runtime dependencies

• Closes Upgrade tracing-subscriber to prevent ANSI log injection #1688 — Upgrade tracing-subscriber to prevent ANSI log injection

• Closes Upgrade Alloy ABI crates to fix typed-data hashing denial of service #1689 — Upgrade Alloy ABI crates to fix typed-data hashing denial of service

• Closes Synchronize independent Rust consumer lockfiles after Alloy upgrade #1692 — Synchronize independent Rust consumer lockfiles after Alloy upgrade

Follow-up risk

• Upgrade libp2p TLS and DNS stack to clear remaining RustSec advisories #1690 tracks the five remaining libp2p-transitive RustSec advisories and the required tested libp2p/TLS/DNS migration.
• Additional protocol and operational residuals that need design approval or external fault infrastructure remain tracked in linked follow-up issues.

CI follow-up fixes

• Closes Allow schema preflight after atomic bootstrap identity creation #1693 — Allow schema preflight after atomic bootstrap identity creation
• Closes Remove bearer authentication from the development program server #1695 — Remove bearer authentication from the development program server
• Closes Restore finalized committee slots before C6 verification after restart #1696 — Restore finalized committee slots before C6 verification after restart
• Closes Restore C0 verification context before replay after restart #1697 — Restore C0 verification context before replay after restart

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crisp	Ready	Preview, Comment	Jul 11, 2026 4:57pm
interfold-dashboard	Ready	Preview, Comment	Jul 11, 2026 4:57pm
interfold-docs	Ready	Preview, Comment	Jul 11, 2026 4:57pm