[main] Update 2025-11-18.22 (#403)

Reference commit: f9530839ee

Author: canton-machine

UNRELEASED.md

@@ -33,6 +33,9 @@ Template for a bigger topic
 
 ## Bugfixes
 
+- Fixed a bug preventing automatic synchronization of protocol feature flags.
+Automatic synchronization can be disabled by setting `parameters.auto-sync-protocol-feature-flags = false` in the participant's configuration object.
+
 ### (YY-nnn, Severity): Title
 
 #### Issue Description
@@ -69,7 +72,7 @@ The ability to recompute contract ids upon ACS import has been removed.
 
 ## Compatibility
 
-The following Canton protocol and Ethereum sequencer contract versions are supported:
+The following Canton protocol versions are supported:
 
 | Dependency                 | Version                    |
 |----------------------------|----------------------------|

community-build.sbt

@@ -14,9 +14,12 @@ lazy val `community-integration-testing` = CommunityProjects.`community-integrat
 lazy val `community-integration-testing-lib` = CommunityProjects.`community-integration-testing-lib`
 lazy val `daml-script-tests` = CommunityProjects.`daml-script-tests`
 lazy val microbench = CommunityProjects.microbench
+lazy val `performance-driver` = CommunityProjects.`performance-driver`
+lazy val performance = CommunityProjects.performance
 lazy val demo = CommunityProjects.demo
 lazy val blake2b = CommunityProjects.blake2b
 lazy val `slick-fork` = CommunityProjects.`slick-fork`
+lazy val `pekko-fork` = CommunityProjects.`pekko-fork`
 lazy val `magnolify-addon` = CommunityProjects.`magnolify-addon`
 lazy val `scalatest-addon` = CommunityProjects.`scalatest-addon`
 lazy val `util-external` = CommunityProjects.`util-external`
@@ -52,15 +55,14 @@ lazy val `ledger-json-client` = CommunityProjects.`ledger-json-client`
 lazy val `ledger-api-tools` = CommunityProjects.`ledger-api-tools`
 lazy val `ledger-api-string-interning-benchmark` =
   CommunityProjects.`ledger-api-string-interning-benchmark`
-lazy val `transcode` = CommunityProjects.`transcode`
 lazy val `ledger-api-bench-tool` = CommunityProjects.`ledger-api-bench-tool`
 lazy val `ledger-test-tool-suites-2-1` = CommunityProjects.`ledger-test-tool-suites-2-1`
 lazy val `ledger-test-tool-suites-2-dev` = CommunityProjects.`ledger-test-tool-suites-2-dev`
 lazy val `ledger-test-tool-2-1` = CommunityProjects.`ledger-test-tool-2-1`
 lazy val `ledger-test-tool-2-dev` = CommunityProjects.`ledger-test-tool-2-dev`
 lazy val `conformance-testing` = CommunityProjects.`conformance-testing`
-lazy val `enterprise-upgrading-integration-tests` =
-  CommunityProjects.`enterprise-upgrading-integration-tests`
+lazy val `upgrading-integration-tests` =
+  CommunityProjects.`upgrading-integration-tests`
 
 lazy val root = (project in file("."))
   .disablePlugins(WartRemover)

community/admin-api/src/main/protobuf/com/digitalasset/canton/admin/participant/v30/participant_repair_service.proto

@@ -7,6 +7,7 @@ package com.digitalasset.canton.admin.participant.v30;
 
 import "com/digitalasset/canton/admin/participant/v30/acs_import.proto";
 import "com/digitalasset/canton/admin/participant/v30/synchronizer_connectivity.proto";
+import "com/digitalasset/canton/admin/sequencer/v30/sequencer_connection.proto";
 import "google/protobuf/duration.proto";
 import "google/protobuf/timestamp.proto";
 
@@ -60,6 +61,17 @@ service ParticipantRepairService {
   rpc RollbackUnassignment(RollbackUnassignmentRequest) returns (RollbackUnassignmentResponse);
 
   rpc RepairCommitmentsUsingAcs(RepairCommitmentsUsingAcsRequest) returns (RepairCommitmentsUsingAcsResponse);
+
+  /**
+     Perform a logical synchronizer upgrade
+     This endpoint should ONLY be used when the following two conditions are met:
+     - The participant node missed the upgrade on the old synchronizer, and
+     - The old synchronizer has been decommissioned in the meantime.
+
+     After the upgrade has been done, other repair operations might need to be done.
+     This includes manually repairing the ACS to account for missed activity on both the old and new synchronizer.
+  */
+  rpc PerformSynchronizerUpgrade(PerformSynchronizerUpgradeRequest) returns (PerformSynchronizerUpgradeResponse);
 }
 
 message PurgeContractsRequest {
@@ -349,3 +361,21 @@ message RepairCommitmentsStatus {
     google.protobuf.Timestamp completed_repair_timestamp = 3;
   }
 }
+
+message PerformSynchronizerUpgradeRequest {
+  message Successor {
+    string physical_synchronizer_id = 1;
+
+    // Value should be provided by synchronizer owners
+    google.protobuf.Timestamp announced_upgrade_time = 2;
+
+    SynchronizerConnectionConfig config = 3;
+
+    com.digitalasset.canton.admin.sequencer.v30.SequencerConnectionValidation sequencer_connection_validation = 4;
+  }
+
+  string physical_synchronizer_id = 1;
+  Successor successor = 2;
+}
+
+message PerformSynchronizerUpgradeResponse {}

…se_participant_replication_service.proto …30/participant_replication_service.protocommunity/admin-api/src/main/protobuf/com/digitalasset/canton/admin/participant/v30/enterprise_participant_replication_service.proto renamed to community/admin-api/src/main/protobuf/com/digitalasset/canton/admin/participant/v30/participant_replication_service.proto community/admin-api/src/main/protobuf/com/digitalasset/canton/admin/participant/v30/enterprise_participant_replication_service.proto renamed to community/admin-api/src/main/protobuf/com/digitalasset/canton/admin/participant/v30/participant_replication_service.proto

@@ -5,7 +5,7 @@ syntax = "proto3";
 
 package com.digitalasset.canton.admin.participant.v30;
 
-service EnterpriseParticipantReplicationService {
+service ParticipantReplicationService {
   rpc SetPassive(SetPassiveRequest) returns (SetPassiveResponse);
 }
 

community/admin-api/src/main/protobuf/com/digitalasset/canton/admin/participant/v30/party_management_service.proto

@@ -70,19 +70,23 @@ service PartyManagementService {
 
   // Offline party replication endpoint.
   //
-  // Instructs the target participant to unilaterally clear the 'onboarding' flag on the
-  // party-to-participant topology mapping.
+  // Instructs the participant to unilaterally clear the 'onboarding' flag for a
+  // given party on its party-to-participant topology mapping.
   //
-  // This operation is time-sensitive and will only be attempted after a specific safe
-  // timestamp has passed.
+  // The RPC first attempts to clear the flag immediately. If this is not yet safe
+  // (e.g., due to potential in-flight transactions), it schedules an idempotent
+  // background task to propose the clearance at the appropriate, safe time.
   //
-  // Because the effect of the topology transaction is not instantaneous, this endpoint is
-  // designed to be polled. Callers should invoke it repeatedly until the response confirms
-  // the flag has been cleared.
+  // This RPC is idempotent and designed to be polled.
   //
-  // Prerequisite: A prior party-to-participant mapping topology transaction must exist
-  // that activates the party on the target participant with the onboarding flag set to
-  // `true`.
+  // Response status:
+  // - onboarded = true: The flag is successfully cleared or was already clear.
+  // - onboarded = false: The flag is not yet cleared. A background task is scheduled
+  //   (or was already pending).
+  //
+  // Prerequisites:
+  // - An 'onboarding=true' mapping must exist for the party on this participant.
+  // - The participant must be connected to the requested synchronizer.
   rpc ClearPartyOnboardingFlag(ClearPartyOnboardingFlagRequest) returns (ClearPartyOnboardingFlagResponse);
 }
 
@@ -325,6 +329,13 @@ message GetHighestOffsetByTimestampResponse {
   int64 ledger_offset = 1;
 }
 
+// Request to clear the 'onboarding' flag for a party.
+//
+// The participant uses the `begin_offset_exclusive` and `wait_for_activation_timeout` to find the
+// effective timestamp of the topology transaction that set the `onboarding = true` flag.
+//
+// This effective timestamp serves as the "lower bound" for calculating the "latest decision deadline"
+// which determines the earliest safe time to clear the flag.
 message ClearPartyOnboardingFlagRequest {
   // The identifier of the party whose onboarding flag is being cleared. This party must
   // already be active on the target participant.
@@ -347,8 +358,10 @@ message ClearPartyOnboardingFlagRequest {
   google.protobuf.Duration wait_for_activation_timeout = 4;
 }
 
-//  Responds with the current status:
+//  Responds with the current status of the onboarding flag:
+//
 //  - Cleared: (true, None) – The flag is successfully cleared.
+//
 //  - Pending: (false, Some(timestamp)) – The flag is still set. The timestamp indicates
 //             the earliest safe time to clear the flag.
 //             Calling the service (repeatedly) after that specific time will eventually confirm
@@ -364,6 +377,8 @@ message ClearPartyOnboardingFlagResponse {
 
   // The earliest time for the safe clearance of the onboarding flag.
   //
-  // This field is only present when `onboarded` is `false`.
+  // This field is only present when `onboarded` is `false`. It represents the
+  // computed "latest decision deadline", which is the maximum of all `validUntil + decisionTimeout`
+  // from the synchronizer's parameter history, ensuring all past in-flight transactions are finalized.
   optional google.protobuf.Timestamp earliest_retry_timestamp = 2;
 }

community/app-base/src/main/scala/com/digitalasset/canton/admin/api/client/commands/ParticipantAdminCommands.scala

@@ -20,12 +20,13 @@ import com.digitalasset.canton.admin.api.client.data.{
   PackageDescription,
   ParticipantPruningSchedule,
   ParticipantStatus,
+  PartyOnboardingFlagStatus,
 }
 import com.digitalasset.canton.admin.participant.v30
-import com.digitalasset.canton.admin.participant.v30.EnterpriseParticipantReplicationServiceGrpc.EnterpriseParticipantReplicationServiceStub
 import com.digitalasset.canton.admin.participant.v30.PackageServiceGrpc.PackageServiceStub
 import com.digitalasset.canton.admin.participant.v30.ParticipantInspectionServiceGrpc.ParticipantInspectionServiceStub
 import com.digitalasset.canton.admin.participant.v30.ParticipantRepairServiceGrpc.ParticipantRepairServiceStub
+import com.digitalasset.canton.admin.participant.v30.ParticipantReplicationServiceGrpc.ParticipantReplicationServiceStub
 import com.digitalasset.canton.admin.participant.v30.ParticipantStatusServiceGrpc.ParticipantStatusServiceStub
 import com.digitalasset.canton.admin.participant.v30.PartyManagementServiceGrpc.PartyManagementServiceStub
 import com.digitalasset.canton.admin.participant.v30.PingServiceGrpc.PingServiceStub
@@ -691,7 +692,7 @@ object ParticipantAdminCommands {
     ) extends GrpcAdminCommand[
           v30.ClearPartyOnboardingFlagRequest,
           v30.ClearPartyOnboardingFlagResponse,
-          (Boolean, Option[CantonTimestamp]),
+          PartyOnboardingFlagStatus,
         ] {
 
       override type Svc = PartyManagementServiceStub
@@ -716,16 +717,9 @@ object ParticipantAdminCommands {
 
       override protected def handleResponse(
           response: v30.ClearPartyOnboardingFlagResponse
-      ): Either[String, (Boolean, Option[CantonTimestamp])] =
-        response.earliestRetryTimestamp
-          .traverse(
-            CantonTimestamp
-              .fromProtoTimestamp(_)
-              .leftMap(_.message)
-          )
-          .map(tsOption => (response.onboarded, tsOption))
+      ): Either[String, PartyOnboardingFlagStatus] =
+        PartyOnboardingFlagStatus.fromProtoV30(response).leftMap(_.message)
     }
-
   }
 
   object ParticipantRepairManagement {
@@ -1163,6 +1157,49 @@ object ParticipantAdminCommands {
           response: v30.RollbackUnassignmentResponse
       ): Either[String, Unit] = Either.unit
     }
+
+    final case class PerformSynchronizerUpgrade(
+        currentPSId: PhysicalSynchronizerId,
+        successorPSId: PhysicalSynchronizerId,
+        upgradeTime: CantonTimestamp,
+        successorConfig: SynchronizerConnectionConfig,
+        sequencerConnectionValidation: SequencerConnectionValidation,
+    ) extends GrpcAdminCommand[
+          v30.PerformSynchronizerUpgradeRequest,
+          v30.PerformSynchronizerUpgradeResponse,
+          Unit,
+        ] {
+      override type Svc = ParticipantRepairServiceStub
+
+      override def createService(channel: ManagedChannel): ParticipantRepairServiceStub =
+        v30.ParticipantRepairServiceGrpc.stub(channel)
+
+      override protected def createRequest()
+          : Either[String, v30.PerformSynchronizerUpgradeRequest] =
+        Right(
+          v30.PerformSynchronizerUpgradeRequest(
+            physicalSynchronizerId = currentPSId.toProtoPrimitive,
+            successor = v30.PerformSynchronizerUpgradeRequest
+              .Successor(
+                physicalSynchronizerId = successorPSId.toProtoPrimitive,
+                announcedUpgradeTime = upgradeTime.toProtoTimestamp.some,
+                config = successorConfig.toProtoV30.some,
+                sequencerConnectionValidation = sequencerConnectionValidation.toProtoV30,
+              )
+              .some,
+          )
+        )
+
+      override protected def submitRequest(
+          service: ParticipantRepairServiceStub,
+          request: v30.PerformSynchronizerUpgradeRequest,
+      ): Future[v30.PerformSynchronizerUpgradeResponse] =
+        service.performSynchronizerUpgrade(request)
+
+      override protected def handleResponse(
+          response: v30.PerformSynchronizerUpgradeResponse
+      ): Either[String, Unit] = Either.unit
+    }
   }
 
   object Ping {
@@ -2436,18 +2473,18 @@ object ParticipantAdminCommands {
 
     final case class SetPassiveCommand()
         extends GrpcAdminCommand[v30.SetPassiveRequest, v30.SetPassiveResponse, Unit] {
-      override type Svc = EnterpriseParticipantReplicationServiceStub
+      override type Svc = ParticipantReplicationServiceStub
 
       override def createService(
           channel: ManagedChannel
-      ): EnterpriseParticipantReplicationServiceStub =
-        v30.EnterpriseParticipantReplicationServiceGrpc.stub(channel)
+      ): ParticipantReplicationServiceStub =
+        v30.ParticipantReplicationServiceGrpc.stub(channel)
 
       override protected def createRequest(): Either[String, v30.SetPassiveRequest] =
         Right(v30.SetPassiveRequest())
 
       override protected def submitRequest(
-          service: EnterpriseParticipantReplicationServiceStub,
+          service: ParticipantReplicationServiceStub,
           request: v30.SetPassiveRequest,
       ): Future[v30.SetPassiveResponse] =
         service.setPassive(request)

community/app-base/src/main/scala/com/digitalasset/canton/admin/api/client/data/PartyOnboardingFlagStatus.scala

@@ -0,0 +1,51 @@
+// Copyright (c) 2025 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package com.digitalasset.canton.admin.api.client.data
+
+import cats.implicits.toTraverseOps
+import com.digitalasset.canton.ProtoDeserializationError.OtherError
+import com.digitalasset.canton.admin.participant.v30
+import com.digitalasset.canton.data.CantonTimestamp
+import com.digitalasset.canton.logging.pretty.{Pretty, PrettyPrinting}
+import com.digitalasset.canton.serialization.ProtoConverter.ParsingResult
+
+sealed trait PartyOnboardingFlagStatus extends PrettyPrinting {
+  protected val status: (Boolean, Option[CantonTimestamp])
+}
+
+case object FlagNotSet extends PartyOnboardingFlagStatus {
+  override val status: (Boolean, Option[CantonTimestamp]) = (true, None)
+
+  override protected def pretty: Pretty[FlagNotSet.type] = prettyOfObject[FlagNotSet.type]
+}
+
+final case class FlagSet(safeToClear: CantonTimestamp) extends PartyOnboardingFlagStatus {
+  override val status: (Boolean, Option[CantonTimestamp]) = (false, Some(safeToClear))
+
+  override protected def pretty: Pretty[FlagSet] = prettyOfClass(
+    param("earliest safe time to clear the flag", _.safeToClear)
+  )
+}
+
+object PartyOnboardingFlagStatus {
+
+  def fromProtoV30(
+      proto: v30.ClearPartyOnboardingFlagResponse
+  ): ParsingResult[PartyOnboardingFlagStatus] =
+    proto.earliestRetryTimestamp
+      .traverse(CantonTimestamp.fromProtoTimestamp)
+      .flatMap { tsOption =>
+        (proto.onboarded, tsOption) match {
+          case FlagNotSet.status => Right(FlagNotSet)
+          case (false, Some(ts)) => Right(FlagSet(ts))
+          case (onboarded, ts) =>
+            Left(
+              OtherError(
+                s"Invalid PartyOnboardingFlagStatus: onboarded=$onboarded, earliest_retry_timestamp=$ts"
+              )
+            )
+        }
+      }
+
+}

community/app-base/src/main/scala/com/digitalasset/canton/config/CantonConfig.scala

@@ -459,15 +459,8 @@ final case class CantonConfig(
   private def validate(
       edition: CantonEdition,
       ensurePortsSet: Boolean,
-  ): Validated[NonEmpty[Seq[String]], Unit] = {
-    val validator = edition match {
-      case CommunityCantonEdition =>
-        CommunityConfigValidations
-      case EnterpriseCantonEdition =>
-        EnterpriseConfigValidations
-    }
-    validator.validate(this, edition, ensurePortsSet = ensurePortsSet)
-  }
+  ): Validated[NonEmpty[Seq[String]], Unit] =
+    CommunityConfigValidations.validate(this, edition, ensurePortsSet = ensurePortsSet)
 
   private lazy val participantNodeParameters_ : Map[InstanceName, ParticipantNodeParameters] =
     participants.fmap { participantConfig =>
@@ -500,6 +493,7 @@ final case class CantonConfig(
           participantParameters.doNotAwaitOnCheckingIncomingCommitments,
         disableOptionalTopologyChecks = participantConfig.topology.disableOptionalTopologyChecks,
         commitmentCheckpointInterval = participantParameters.commitmentCheckpointInterval,
+        autoSyncProtocolFeatureFlags = participantParameters.autoSyncProtocolFeatureFlags,
       )
     }
 
@@ -522,6 +516,8 @@ final case class CantonConfig(
         maxConfirmationRequestsBurstFactor =
           sequencerNodeConfig.parameters.maxConfirmationRequestsBurstFactor,
         asyncWriter = sequencerNodeConfig.parameters.asyncWriter.toParameters,
+        sequencingTimeLowerBoundExclusive =
+          sequencerNodeConfig.parameters.sequencingTimeLowerBoundExclusive,
         unsafeEnableOnlinePartyReplication =
           sequencerNodeConfig.parameters.unsafeEnableOnlinePartyReplication,
         requestLimits = sequencerNodeConfig.publicApi.limits,