feat(evm): endorsers return the delta, the initiator stops building one

The initiator ran the full validator on every request through the same
DeltaFactory as the responder, to get a digest to verify signatures against
and a delta to put in the transaction. That is the work this flow delegates,
and it bought nothing: the contract's rule is that a threshold of registered
endorsers signed the digest, so a quorum wanting to apply something else
would never need the initiator.

It did cost something. The delta covers the public parameters hash and
version, so an initiator reading parameters on the other side of an update
from its endorsers computed a different digest and discarded every signature
as an unknown signer. Its ledger read had the same shape: a lagging node
failed to build a delta and never contacted an endorser at all.

EndorseResponse now carries the delta the endorser signed, the way a Fabric
proposal response carries the RWSet. The initiator binds each delta to the
anchor it asked about, checks the invariants, recovers the signature over
that delta's digest, and groups by delta so a divergent endorser is outvoted
rather than fatal. A shortfall where more than one delta was seen reports
ErrDivergentDeltas next to ErrInsufficientEndorsements, since that is a
determinism failure and not an availability one.

Raised by Angelo in the sync of 2026-08-14.

Signed-off-by: atharrva01 <atharvaborade568@gmail.com>

Author: atharrva01

docs/services/network-ethereum.md

@@ -310,16 +310,16 @@ sequenceDiagram
         E1->>E1: Validate token request
         E1->>E1: Compute state delta
         E1->>E1: Sign state delta
-        E1-->>Driver: Signature 1
+        E1-->>Driver: State delta + signature 1
     and
         Driver->>E2: Request endorsement
         E2->>E2: Validate token request
         E2->>E2: Compute state delta
         E2->>E2: Sign state delta
-        E2-->>Driver: Signature 2
+        E2-->>Driver: State delta + signature 2
     end
     
-    Driver->>Driver: Assemble state update + signatures
+    Driver->>Driver: Check the deltas agree, assemble with signatures
     
     Note over Driver,State: On-Chain Execution Phase
     Driver->>Node: eth_sendRawTransaction

x/token/services/network/evm/driver.go

@@ -274,7 +274,6 @@ func (d *Driver) installEndorsement(n *Network, config *Config, evmClient client
 		BlockTag:     config.Finality.BlockTag,
 		PublicParams: pp.NewChainProvider(evmClient, tokenState, config.Finality.BlockTag),
 		ViewManager:  d.viewManager,
-		TMS:          d.resolveTMS,
 	})
 	if err != nil {
 		return err

x/token/services/network/evm/endorsement/delta.go

@@ -18,11 +18,11 @@ import (
 	"github.com/LFDT-Panurus/panurus/x/token/services/network/evm/statedelta"
 )
 
-// DeltaFactory turns a validated token request into the StateDelta both sides of the flow work with:
-// the responder signs its EIP-712 digest, the initiator assembles the signatures over it and encodes
-// it into the transaction. Sharing one construction path is how the §4.4 determinism guarantee (every
-// endorser and the initiator produce byte-identical deltas) is met, by running the same code rather
-// than trusting independent reimplementations to agree.
+// DeltaFactory turns a validated token request into the StateDelta an endorser signs and returns. It
+// belongs to the responder alone: the initiator neither validates nor translates, it takes the delta
+// from the endorsers' replies. The §4.4 determinism guarantee (every endorser produces byte-identical
+// deltas) is met by them all running this one construction path, rather than by trusting independent
+// reimplementations to agree.
 //
 // Build validates the request against on-chain state (read through the getToken ledger at blockTag),
 // then translates the validated actions with the StateDelta translator, binding the public
@@ -56,35 +56,8 @@ func NewDeltaFactory(
 	}
 }
 
-// ResolveValidator adapts a function that looks a validator up into a RequestValidator, so a delta
-// factory resolves one per request instead of holding the one it was built with.
-//
-// The validator a TMS hands out is derived from that TMS's public parameters, and updating parameters
-// evicts the management service so that the next caller builds a new one. A validator captured at
-// construction therefore keeps checking actions against parameters that no longer describe the
-// network, and so does a validator re-read from a management service captured at construction: both
-// have to be resolved from the id, per request. Getting this wrong is not subtle in its effects -
-// after an update that authorises a new issuer, that issuer's every request is rejected as
-// unauthorised, by a node that has already logged the new parameters.
-type ResolveValidator func() (RequestValidator, error)
-
-// UnmarshallAndVerifyWithMetadata resolves the current validator and delegates to it.
-func (r ResolveValidator) UnmarshallAndVerifyWithMetadata(
-	ctx context.Context,
-	ledger token2.Ledger,
-	anchor token2.RequestAnchor,
-	raw []byte,
-) ([]any, map[string][]byte, error) {
-	validator, err := r()
-	if err != nil {
-		return nil, nil, errors.Wrap(err, "failed to resolve the validator")
-	}
-
-	return validator.UnmarshallAndVerifyWithMetadata(ctx, ledger, anchor, raw)
-}
-
-// Build validates req against on-chain state and returns the StateDelta to sign or assemble. A
-// validation failure is wrapped with ErrValidation so callers can classify it.
+// Build validates req against on-chain state and returns the StateDelta to sign. A validation
+// failure is wrapped with ErrValidation so callers can classify it.
 func (f *DeltaFactory) Build(ctx context.Context, req *EndorseRequest) (*statedelta.StateDelta, error) {
 	ppRaw, ppVersion, err := f.pp.PublicParams(ctx)
 	if err != nil {
@@ -125,6 +98,3 @@ func (f *DeltaFactory) Build(ctx context.Context, req *EndorseRequest) (*statede
 
 	return tr.StateDelta()
 }
-
-// compile-time check that DeltaFactory satisfies the DeltaBuilder the initiator depends on.
-var _ DeltaBuilder = (*DeltaFactory)(nil)

x/token/services/network/evm/endorsement/doc.go

@@ -16,17 +16,23 @@ SPDX-License-Identifier: Apache-2.0
 //     the request.
 //   - Responder (responder.go) is the endorser side: receive → authorize (allowlist, the EVM analog
 //     of the Fabric MSP/ACL check) → validate the request against on-chain state (ledger.go, getToken
-//     at a finalized block tag) → translate to a StateDelta → sign its EIP-712 digest. It recomputes
-//     the digest from the validated actions and never signs one handed to it (design §4.5).
+//     at a finalized block tag) → translate to a StateDelta → sign its EIP-712 digest → reply with
+//     both. It recomputes the digest from the validated actions and never signs one handed to it
+//     (design §4.5).
 //   - Initiator (initiator.go) is the collector side: open a session to each registered endorser,
 //     gather replies, and count a signature only after recovering it to a distinct registered endorser
-//     over the digest it computed itself, mirroring the contract's threshold and distinct-signer rules.
-//   - DeltaFactory (delta.go) is the single validate-and-translate path both sides build the delta
-//     through, so every endorser and the initiator produce byte-identical deltas (the §4.4
-//     determinism guarantee), and Service (service.go) is the per-TMS entry point RequestApproval
-//     drives.
+//     over the digest of the delta that came back with it, mirroring the contract's threshold and
+//     distinct-signer rules.
+//   - DeltaFactory (delta.go) is the responder's validate-and-translate path, the one every endorser
+//     runs so they all produce byte-identical deltas (the §4.4 determinism guarantee), and Service
+//     (service.go) is the per-TMS entry point RequestApproval drives.
 //
-// The request carries no precomputed digest (messages.go): endorsers recompute it. The end-to-end
-// guarantee is pinned by the gate (gate_test.go + contracts/test/Endorsement2ofN.t.sol): a 2-of-3
-// quorum assembled over in-memory sessions verifies on the EndorsementVerifier on-chain.
+// Both directions of the wire follow the same principle: the party that does the work is the party
+// that decides what it means. The request carries no precomputed digest, so endorsers recompute
+// rather than blind-sign; the response carries the delta, so the initiator relays rather than
+// revalidates. That is the shape Fabric already has, where the request travels as transient data and
+// the RWSet comes back inside the endorsers' proposal responses.
+//
+// The end-to-end guarantee is pinned by the gate (gate_test.go + contracts/test/Endorsement2ofN.t.sol):
+// a 2-of-3 quorum assembled over in-memory sessions verifies on the EndorsementVerifier on-chain.
 package endorsement

x/token/services/network/evm/endorsement/errors.go

@@ -39,4 +39,14 @@ var (
 	// contract counts distinct signers only, so the initiator must not assemble a quorum that would be
 	// rejected on-chain.
 	ErrDuplicateSigner = errors.New("duplicate endorser signature")
+
+	// ErrDeltaMismatch is returned when an endorser's delta does not belong to the request it was
+	// asked about, or is not structurally well formed. The signature over it is not counted.
+	ErrDeltaMismatch = errors.New("state delta does not match the request")
+
+	// ErrDivergentDeltas accompanies ErrInsufficientEndorsements when endorsers answered but signed
+	// different deltas for the same request. Endorsers that validated the same request must translate
+	// it identically, so this means the translation is not deterministic, not that endorsers were
+	// unavailable.
+	ErrDivergentDeltas = errors.New("endorsers disagree on the state delta")
 )

x/token/services/network/evm/endorsement/esp.go

@@ -18,15 +18,13 @@ import (
 
 // ServiceFactory builds the endorsement service for a TMS, and caches it.
 //
-// The service is per TMS rather than per network because validating a token request needs that TMS's
-// validator, which knows its token driver and public parameters. Everything else it needs (the
-// endorser set, the threshold, the chain, this node's signing key) is network-wide and is resolved
-// once, here.
+// The service is keyed by TMS because that is the unit RequestApproval works in, but it no longer
+// holds anything derived from a TMS: the initiator collects signatures and takes the delta from the
+// endorsers, so nothing on that side needs a validator. Validation lives entirely in the responder,
+// which resolves its TMS when a request arrives.
 //
-// The factory takes a TMS id and resolves the management service itself, per request. Holding the
-// service would be wrong: updating public parameters evicts the cached management service and the next
-// caller gets a rebuilt one, so a captured pointer keeps serving the parameters that were current when
-// it was captured, and no amount of re-asking it for a validator changes that.
+// What the factory does hold is network-wide and resolved once: the endorser set, the threshold, the
+// chain, the EIP-712 domain, and the parameters a delta is bound to.
 type ServiceFactory struct {
 	registry     *Registry
 	threshold    int
@@ -36,7 +34,6 @@ type ServiceFactory struct {
 	blockTag     string
 	publicParams PublicParamsProvider
 	viewManager  ViewManager
-	resolveTMS   TMSResolver
 
 	mu       sync.Mutex
 	services map[string]*Service
@@ -60,8 +57,6 @@ type FactoryConfig struct {
 	PublicParams PublicParamsProvider
 	// ViewManager runs the initiator.
 	ViewManager ViewManager
-	// TMS resolves a management service from its id, on every request rather than once.
-	TMS TMSResolver
 }
 
 // NewServiceFactory returns a factory for the given network.
@@ -78,9 +73,6 @@ func NewServiceFactory(cfg FactoryConfig) (*ServiceFactory, error) {
 	if cfg.PublicParams == nil {
 		return nil, errors.New("endorsement factory: nil public parameters provider")
 	}
-	if cfg.TMS == nil {
-		return nil, errors.New("endorsement factory: nil tms resolver")
-	}
 	if cfg.Threshold < 1 || cfg.Threshold > cfg.Registry.Len() {
 		return nil, errors.Errorf("endorsement factory: threshold %d out of range [1,%d]",
 			cfg.Threshold, cfg.Registry.Len())
@@ -95,7 +87,6 @@ func NewServiceFactory(cfg FactoryConfig) (*ServiceFactory, error) {
 		blockTag:     cfg.BlockTag,
 		publicParams: cfg.PublicParams,
 		viewManager:  cfg.ViewManager,
-		resolveTMS:   cfg.TMS,
 		services:     map[string]*Service{},
 	}, nil
 }
@@ -113,25 +104,7 @@ func (f *ServiceFactory) ForTMS(tmsID token2.TMSID) (*Service, error) {
 		return service, nil
 	}
 
-	// Both the management service and the validator are resolved per request. The service cached here
-	// lives for the life of the node, but an endorsed setup delta replaces the management service
-	// underneath it, and only a fresh one knows the new public parameters.
-	resolve := ResolveValidator(func() (RequestValidator, error) {
-		tms, err := f.resolveTMS(tmsID)
-		if err != nil {
-			return nil, errors.Wrapf(err, "failed to resolve tms [%s]", tmsID)
-		}
-
-		return tms.Validator()
-	})
-
-	service, err := NewService(
-		f.registry,
-		f.threshold,
-		NewDeltaFactory(resolve, f.publicParams, f.client, f.tokenState, f.blockTag),
-		f.domain,
-		f.viewManager,
-	)
+	service, err := NewService(f.registry, f.threshold, f.domain, f.viewManager)
 	if err != nil {
 		return nil, errors.Wrapf(err, "endorsement factory: failed to build the service for [%s]", tmsID)
 	}

x/token/services/network/evm/endorsement/esp_test.go

@@ -32,9 +32,6 @@ func testFactoryConfig(t *testing.T) FactoryConfig {
 		TokenState:   addr(0xAA),
 		PublicParams: &fakePP{raw: []byte("pp"), version: 1},
 		ViewManager:  &stubViewManager{},
-		TMS: func(token2.TMSID) (*token2.ManagementService, error) {
-			return nil, assert.AnError
-		},
 	}
 }
 
@@ -51,7 +48,6 @@ func TestNewServiceFactoryValidates(t *testing.T) {
 		"no client":            func(c *FactoryConfig) { c.Client = nil },
 		"no view manager":      func(c *FactoryConfig) { c.ViewManager = nil },
 		"no public parameters": func(c *FactoryConfig) { c.PublicParams = nil },
-		"no tms resolver":      func(c *FactoryConfig) { c.TMS = nil },
 		"zero threshold":       func(c *FactoryConfig) { c.Threshold = 0 },
 		"threshold too high":   func(c *FactoryConfig) { c.Threshold = 3 },
 	}
@@ -65,8 +61,8 @@ func TestNewServiceFactoryValidates(t *testing.T) {
 	}
 }
 
-// TestForTMSRejectsAnEmptyID checks the factory does not build a service it could never resolve a TMS
-// for, since the TMS is where the validator comes from.
+// TestForTMSRejectsAnEmptyID checks the factory does not build a service for an id it could not route
+// a request under.
 func TestForTMSRejectsAnEmptyID(t *testing.T) {
 	f, err := NewServiceFactory(testFactoryConfig(t))
 	require.NoError(t, err)
@@ -75,68 +71,53 @@ func TestForTMSRejectsAnEmptyID(t *testing.T) {
 	require.Error(t, err)
 }
 
-// TestForTMSResolvesTheTMSPerRequest pins the reason the initiator holds a TMS id and not a TMS.
+// TestForTMSCachesPerTMS checks the service is built once and reused. It holds nothing derived from a
+// TMS any more (the initiator collects signatures and takes the delta from the endorsers), so the
+// cache is only about not rebuilding the same collaborators on every approval.
+func TestForTMSCachesPerTMS(t *testing.T) {
+	f, err := NewServiceFactory(testFactoryConfig(t))
+	require.NoError(t, err)
+
+	tmsID := token2.TMSID{Network: "evm", Namespace: "token"}
+	service, err := f.ForTMS(tmsID)
+	require.NoError(t, err)
+	again, err := f.ForTMS(tmsID)
+	require.NoError(t, err)
+	assert.Same(t, service, again)
+}
+
+// TestResponderResolvesTheTMSPerRequest pins why the responder holds a TMS id and not a TMS.
 //
 // Updating public parameters evicts the cached management service, so the next caller gets a rebuilt
 // one and whoever kept the old pointer keeps its old parameters. Asking that stale service for a
-// validator again does not help, which is what made this worth a test: the earlier fix resolved the
+// validator again does not help, which is what made this worth a test: an earlier fix resolved the
 // validator per request but from a captured service, and the symptom did not move. After an update
 // that authorises a new issuer, that issuer's requests were still rejected as unauthorised on a node
 // that had already logged the new parameters.
-func TestForTMSResolvesTheTMSPerRequest(t *testing.T) {
-	cfg := testFactoryConfig(t)
-	calls := 0
-	cfg.TMS = func(token2.TMSID) (*token2.ManagementService, error) {
-		calls++
-
-		return nil, assert.AnError
-	}
-	f, err := NewServiceFactory(cfg)
-	require.NoError(t, err)
-
-	service, err := f.ForTMS(token2.TMSID{Network: "evm", Namespace: "token"})
+//
+// Endorsement is now the only place a validator is used at all, so this is the one path where it
+// matters.
+func TestResponderResolvesTheTMSPerRequest(t *testing.T) {
+	f, err := NewServiceFactory(testFactoryConfig(t))
 	require.NoError(t, err)
-	assert.Equal(t, 0, calls, "building the service must not resolve a TMS")
 
-	// The same cached service, asked twice: it must go back to the resolver both times.
-	again, err := f.ForTMS(token2.TMSID{Network: "evm", Namespace: "token"})
+	auth, err := NewAuthorizer([]view.Identity{view.Identity(testCaller)})
 	require.NoError(t, err)
-	assert.Same(t, service, again, "the service itself is still cached per TMS")
-
-	for range 2 {
-		_, err := service.factory.Build(t.Context(),
-			&EndorseRequest{Anchor: "anchor", TokenRequest: []byte("tr")})
-		require.Error(t, err)
-	}
-	assert.Equal(t, 2, calls, "the TMS must be resolved per request, not captured once")
-}
 
-// TestResolveValidatorIsCalledPerBuild is the same invariant one layer down, on the adapter itself.
-func TestResolveValidatorIsCalledPerBuild(t *testing.T) {
 	calls := 0
-	resolve := ResolveValidator(func() (RequestValidator, error) {
+	responder, err := f.NewResponder(auth, newSigner(t, 1), func(token2.TMSID) (*token2.ManagementService, error) {
 		calls++
 
-		return &fakeValidator{err: assert.AnError}, nil
+		return nil, assert.AnError
 	})
-	factory := NewDeltaFactory(resolve, &fakePP{raw: []byte("pp"), version: 1}, nil, addr(0xAA), "")
+	require.NoError(t, err)
+	assert.Equal(t, 0, calls, "building the responder must not resolve a TMS")
 
 	for range 2 {
-		_, err := factory.Build(t.Context(), &EndorseRequest{Anchor: "anchor", TokenRequest: []byte("tr")})
-		require.Error(t, err)
+		resp := responder.Handle(t.Context(), view.Identity(testCaller), validRequest())
+		require.Error(t, resp.Error(), "an unresolvable TMS is refused, not signed for")
 	}
-	assert.Equal(t, 2, calls, "the validator must be resolved per request, not captured once")
-}
-
-// TestResolveValidatorReportsResolutionFailure checks a validator that cannot be resolved surfaces as
-// an error rather than a nil dereference inside validation.
-func TestResolveValidatorReportsResolutionFailure(t *testing.T) {
-	resolve := ResolveValidator(func() (RequestValidator, error) { return nil, assert.AnError })
-	factory := NewDeltaFactory(resolve, &fakePP{raw: []byte("pp"), version: 1}, nil, addr(0xAA), "")
-
-	_, err := factory.Build(t.Context(), &EndorseRequest{Anchor: "anchor", TokenRequest: []byte("tr")})
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "failed to resolve the validator")
+	assert.Equal(t, 2, calls, "the TMS must be resolved per request, not captured once")
 }
 
 // TestNewResponderForNeedsAKey checks a node that does not endorse cannot be turned into a responder:

x/token/services/network/evm/endorsement/gate_test.go

@@ -136,7 +136,7 @@ func (c *gateContext) GetSession(_ view.View, party view.Identity, _ ...view.Vie
 // and asserts a 2-of-3 quorum is assembled whose signatures recover to distinct registered endorsers.
 func TestGateAssembleQuorumOverSessions(t *testing.T) {
 	reg, responders := gateEndorsers(t, 3)
-	initiator := NewInitiator(reg, gateThreshold, gateFactory(), gateDomain(t), gateRequest())
+	initiator := NewInitiator(reg, gateThreshold, gateDomain(t), gateRequest())
 
 	ctx := &gateContext{
 		fakeContext: fakeContext{ctx: context.Background(), me: view.Identity(gateInitiator)},
@@ -167,7 +167,7 @@ func TestGateAssembleQuorumOverSessions(t *testing.T) {
 // on-chain check exercises exactly what the initiator produces.
 func TestGateFixtureMatchesAssembly(t *testing.T) {
 	reg, responders := gateEndorsers(t, 3)
-	initiator := NewInitiator(reg, gateThreshold, gateFactory(), gateDomain(t), gateRequest())
+	initiator := NewInitiator(reg, gateThreshold, gateDomain(t), gateRequest())
 	ctx := &gateContext{
 		fakeContext: fakeContext{ctx: context.Background(), me: view.Identity(gateInitiator)},
 		responders:  responders,