test(contract): port async attestation tests to the no-yield design

The tests were written against the old yield-resume resolve_verification
(pending_attestations + on_attestation_verified yield-callback + ~200-block
timeout). #3766 replaced that with a plain promise chain
(verify_quote -> .then(resolve_verification)) whose failures refund and fire a
separate fail_attestation_submission receipt, with no pending state and no
timeout. Rewrite the sandbox tests to match:

- tee_verifier.rs: drop YIELD_TIMEOUT_BLOCKS / fast_forward and the pending-entry
  assertions; observe failures via the chain's receipt outcomes
  (ExecutionFinalResult::failures) instead of a queryable pending state. The
  verifier-crash test now expects an immediate VerifierUnavailable rather than a
  timeout cleanup. Keep the Verified happy-path and the OOG-resolve test
  #[ignore]d (they need fixture-allowlist + signer-key setup to reach a
  successful store) and point them at #3738 rather than the wrong #3730.
- Remove has_pending_attestation (it read the removed pending_attestations map)
  from sandbox_test_methods.rs, its sandbox helper, and the HAS_PENDING_ATTESTATION
  method-name constant.
- docs/design/attestation-verifier-contract.md: rewrite the submission-flow,
  handling-failures, state, API, and testing sections to the promise-chain design.

Also reflow one pre-existing rustfmt violation in participants_gas.rs.

Author: pbeza

crates/contract/src/sandbox_test_methods.rs

@@ -11,7 +11,7 @@
 use crate::MpcContract;
 use crate::primitives::ckd::CKDRequest;
 use crate::primitives::signature::SignatureRequest;
-use near_sdk::{AccountId, near};
+use near_sdk::near;
 
 // Import the generated extension trait from near
 use crate::MpcContractExt;
@@ -48,8 +48,4 @@ impl MpcContract {
         u32::try_from(len)
             .expect("queue length must fit in u32 — bounded by MAX_PENDING_REQUEST_FAN_OUT")
     }
-
-    pub fn has_pending_attestation(&self, account_id: AccountId) -> bool {
-        self.pending_attestations.contains_key(&account_id)
-    }
 }

crates/contract/tests/sandbox/participants_gas.rs

@@ -289,8 +289,15 @@ async fn setup_test_env_with_state(n_participants: usize, running_state: bool) -
         let keyset = Keyset::new(EpochId::new(1), vec![key]);
         let domains = vec![domain];
         let next_domain_id = domains.len() as u64 + 1;
-        init_contract_running(&contract, domains, next_domain_id, keyset, threshold_params, None)
-            .await;
+        init_contract_running(
+            &contract,
+            domains,
+            next_domain_id,
+            keyset,
+            threshold_params,
+            None,
+        )
+        .await;
     } else {
         init_contract(&contract, threshold_params, None).await;
     }

crates/contract/tests/sandbox/tee_verifier.rs

@@ -4,13 +4,24 @@
 //! Each test deploys the `test-tee-verifier` stub, whose verify-quote returns a
 //! response the test picks instead of running real `dcap-qvl`, votes it in as the
 //! trusted verifier via [`vote_tee_verifier_change`], and then covers one branch
-//! of the yield-resume flow:
+//! of the promise-chain flow.
 //!
-//! - verifier not configured → submission rejected, nothing stored.
-//! - [`StubResponse::Rejected`] → submission fails, deposit refunded, nothing stored.
-//! - no-verdict (stub panics) → the ~200-block yield timeout cleans up.
-//! - out-of-gas resolve → the receipt rolls back atomically and the same timeout
-//!   cleans up (no half-committed state).
+//! A Dstack submission spawns `verify_quote` on the trusted verifier with
+//! [`MpcContract::resolve_verification`] chained as its callback. There is no
+//! yield-resume and no timeout: [`resolve_verification`] settles every outcome
+//! synchronously within the same chain.
+//!
+//! - verifier not configured → the submit tx fails synchronously with
+//!   [`TeeError::VerifierNotConfigured`], nothing stored.
+//! - [`StubResponse::Rejected`] → [`resolve_verification`] refunds the deposit and
+//!   fires `fail_attestation_submission`, which panics in a separate receipt to
+//!   fail the submitter's transaction; nothing stored.
+//! - stub panics (verifier unreachable) → the callback observes a failed promise,
+//!   resolves to [`TeeError::VerifierUnavailable`], and fails the same way.
+//!
+//! On failure the top-level submit call still returns its chained promise, so the
+//! failure surfaces on the chain's receipt outcomes
+//! ([`ExecutionFinalResult::failures`]), not on the top-level tx result.
 #![allow(non_snake_case)]
 
 use crate::sandbox::{
@@ -19,21 +30,19 @@ use crate::sandbox::{
         consts::ALL_PROTOCOLS,
         contract_build::stub_tee_verifier_contract,
         mpc_contract::{
-            get_participant_attestation, has_pending_attestation, submit_participant_info,
+            get_participant_attestation, submit_participant_info,
             submit_participant_info_with_deposit, vote_tee_verifier_change,
         },
     },
 };
 use mpc_contract::errors::TeeError;
 use near_mpc_contract_interface::types as dtos;
-use near_workspaces::{Account, Contract, Worker, network::Sandbox, types::NearToken};
+use near_workspaces::{
+    Account, Contract, Worker, network::Sandbox, result::ExecutionFinalResult, types::NearToken,
+};
 use test_tee_verifier_types::StubResponse;
 use test_utils::attestation::{mock_dto_dstack_attestation, p2p_tls_key, verified_report};
 
-/// Blocks to fast-forward past the ~200-block yield-resume timeout so the
-/// runtime fires the yield-callback's timeout branch.
-const YIELD_TIMEOUT_BLOCKS: u64 = 250;
-
 /// Deposit attached to a Dstack submission: covers storage on success, fully
 /// refunded on failure.
 const SUBMIT_DEPOSIT: NearToken = NearToken::from_near(1);
@@ -72,9 +81,7 @@ async fn setup_with_stub(
     response: StubResponse,
     init_config: Option<dtos::InitConfig>,
 ) -> (Worker<Sandbox>, Contract, Account, NearToken) {
-    let mut builder = SandboxTestSetup::builder()
-        .with_protocols(ALL_PROTOCOLS)
-        .with_sandbox_test_methods();
+    let mut builder = SandboxTestSetup::builder().with_protocols(ALL_PROTOCOLS);
     if let Some(init_config) = init_config {
         builder = builder.with_init_config(init_config);
     }
@@ -91,33 +98,45 @@ async fn setup_with_stub(
     (worker, contract, submitter, balance_before)
 }
 
-async fn submit_dstack(submitter: &Account, contract: &Contract) {
-    let _ = submit_participant_info_with_deposit(
+async fn submit_dstack(submitter: &Account, contract: &Contract) -> ExecutionFinalResult {
+    submit_participant_info_with_deposit(
         submitter,
         contract,
         &mock_dto_dstack_attestation(),
         &p2p_tls_key().into(),
         SUBMIT_DEPOSIT,
     )
     .await
-    .unwrap();
+    .unwrap()
 }
 
-/// Asserts a failed submission left no stored attestation, no pending entry, and
-/// refunded the deposit.
-async fn assert_submission_cleaned_up(
+/// Asserts a Dstack submission failed on the chain and left no committed state:
+/// the failure surfaces on a receipt (`fail_attestation_submission` panics in its
+/// own receipt), carries `expected_error`, nothing is stored, and the deposit is
+/// refunded.
+async fn assert_submission_failed_cleanly(
+    result: &ExecutionFinalResult,
     contract: &Contract,
     submitter: &Account,
     balance_before: NearToken,
+    expected_error: &TeeError,
 ) {
+    let failures = result.failures();
+    assert!(
+        !failures.is_empty(),
+        "expected the promise chain to fail on a receipt, got: {result:#?}"
+    );
+    let rendered = format!("{failures:?}");
+    let expected = expected_error.to_string();
+    assert!(
+        rendered.contains(&expected),
+        "expected a receipt failure containing {expected:?}, got: {rendered}"
+    );
+
     let stored = get_participant_attestation(contract, &p2p_tls_key().into())
         .await
         .unwrap();
     assert!(stored.is_none(), "nothing should be stored on failure");
-    assert!(
-        !has_pending_attestation(contract, submitter.id()).await.unwrap(),
-        "the pending entry must be cleaned up"
-    );
     assert_deposit_refunded(submitter, balance_before).await;
 }
 
@@ -143,8 +162,8 @@ async fn submit_participant_info__should_reject_dstack_when_verifier_not_configu
     .await
     .unwrap();
 
-    // Then: it fails synchronously (before any yield), so the error is on the tx
-    // result.
+    // Then: it fails synchronously (before any cross-contract call), so the error
+    // is on the top-level tx result, not a later receipt.
     let err = result
         .into_result()
         .expect_err("Dstack submit must fail when no verifier is configured")
@@ -170,58 +189,121 @@ async fn submit_participant_info__should_refund_and_store_nothing_on_verifier_re
         setup_with_stub(StubResponse::Rejected("test rejection".to_string()), None).await;
 
     // When: a Dstack attestation is submitted.
-    submit_dstack(&submitter, &contract).await;
+    let result = submit_dstack(&submitter, &contract).await;
 
-    // Then: the submission is cleaned up. The rejection resolves in the verifier's
-    // response receipt, so the outcome is observable in state, not the tx result.
-    assert_submission_cleaned_up(&contract, &submitter, balance_before).await;
+    // Then: resolve_verification refunds and fails the submission in a separate
+    // receipt; the failure is on the chain, not the top-level tx result. The
+    // stub wraps the reason in `VerifierError::DcapVerification`, whose Display
+    // prefixes "dcap verification failed: ".
+    assert_submission_failed_cleanly(
+        &result,
+        &contract,
+        &submitter,
+        balance_before,
+        &TeeError::QuoteRejected {
+            reason: "dcap verification failed: test rejection".to_string(),
+        },
+    )
+    .await;
 }
 
 #[tokio::test]
-async fn submit_participant_info__should_clean_up_on_verifier_crash() {
-    // Given: a verifier that panics, so no resume lands.
-    let (worker, contract, submitter, balance_before) =
+async fn submit_participant_info__should_fail_and_store_nothing_on_verifier_crash() {
+    // Given: a verifier that panics, so the verify_quote promise fails.
+    let (_worker, contract, submitter, balance_before) =
         setup_with_stub(StubResponse::Panic, None).await;
 
-    // When: a submission times out (no verdict within the yield window).
-    submit_dstack(&submitter, &contract).await;
-    worker.fast_forward(YIELD_TIMEOUT_BLOCKS).await.unwrap();
+    // When: a Dstack attestation is submitted.
+    let result = submit_dstack(&submitter, &contract).await;
 
-    // Then: the timeout cleans up. Guards the regression where cleanup was rolled
-    // back by a panic in the same receipt, leaking the entry and wedging the account.
-    assert_submission_cleaned_up(&contract, &submitter, balance_before).await;
+    // Then: the callback sees a failed promise, resolves to VerifierUnavailable,
+    // refunds, and fails the submission in a separate receipt. No timeout: the
+    // outcome settles synchronously within the same chain.
+    assert_submission_failed_cleanly(
+        &result,
+        &contract,
+        &submitter,
+        balance_before,
+        &TeeError::VerifierUnavailable,
+    )
+    .await;
 }
 
-// TODO(#3730): un-ignore once the fixture allowlist setup lands. To OOG,
-// `resolve_verification` must reach the heavy RTMR3 replay, which needs the
-// post-DCAP allowlist checks to pass first (fixture image/launcher hashes and
-// measurements voted in, submitter using the fixture keys). With an empty
-// allowlist the check fails fast and `resolve_verification` completes at 1 TGas,
-// so this would re-test the rejection path.
-#[ignore = "needs fixture allowlist setup to reach the gas-heavy post-DCAP path; tracked in #3730"]
+// TODO(#3738): un-ignore once the fixture allowlist setup lands. A Verified
+// verdict routes through `verify_post_dcap_and_store`, whose allowlist checks
+// (fixture image/launcher hashes and measurements voted in, submitter using the
+// fixture keys) must pass before the attestation is stored. With an empty
+// allowlist the post-DCAP check fails and the submission is rejected instead of
+// stored, so the happy path cannot be exercised here yet.
+#[ignore = "needs fixture allowlist setup to pass the post-DCAP checks; tracked in #3738"]
 #[tokio::test]
-async fn submit_participant_info__should_clean_up_when_resolve_verification_runs_out_of_gas() {
+async fn submit_participant_info__should_store_attestation_on_verified_quote() {
+    // Given: a verifier that returns the report the real verifier would produce
+    // for the fixture quote.
+    let (_worker, contract, submitter, balance_before) =
+        setup_with_stub(StubResponse::Verified(verified_report()), None).await;
+
+    // When: a Dstack attestation is submitted.
+    let result = submit_dstack(&submitter, &contract).await;
+
+    // Then: the chain succeeds and the attestation is stored; storage is charged
+    // and the excess deposit refunded (net spend is storage + gas, well under the
+    // full deposit).
+    assert!(
+        result.failures().is_empty(),
+        "the verified submission chain must succeed, got: {result:#?}"
+    );
+    let stored = get_participant_attestation(&contract, &p2p_tls_key().into())
+        .await
+        .unwrap();
+    assert!(stored.is_some(), "a verified attestation must be stored");
+    let balance_after = submitter.view_account().await.unwrap().balance;
+    assert!(
+        balance_after < balance_before,
+        "storage must be charged from the attached deposit"
+    );
+}
+
+// TODO(#3738): un-ignore once the fixture allowlist setup lands. To OOG,
+// `resolve_verification` must reach the heavy RTMR3 replay in the post-DCAP
+// checks, which needs the allowlist populated and the submitter using the fixture
+// keys. With an empty allowlist the post-DCAP check fails fast and
+// `resolve_verification` completes well under 1 TGas, re-testing the rejection
+// path instead. Under the promise-chain model an OOG rolls the whole callback
+// receipt back atomically: nothing is stored, the runtime refunds the attached
+// deposit to the predecessor, and `fail_attestation_submission` never fires, so
+// the chain still surfaces a failed receipt. No timeout is involved.
+#[ignore = "needs fixture allowlist setup to reach the gas-heavy post-DCAP path; tracked in #3738"]
+#[tokio::test]
+async fn submit_participant_info__should_fail_and_store_nothing_when_resolve_verification_runs_out_of_gas()
+ {
     // Given: a Verified stub and a resolve gas budget too small for the post-DCAP
-    // work, so that branch OOGs and rolls back. (Rejected is too light to OOG.)
+    // work, so that callback OOGs and rolls back atomically.
     let init_config = dtos::InitConfig {
         resolve_verification_tera_gas: Some(1),
         ..Default::default()
     };
-    let (worker, contract, submitter, balance_before) =
+    let (_worker, contract, submitter, balance_before) =
         setup_with_stub(StubResponse::Verified(verified_report()), Some(init_config)).await;
 
-    // When: a submission is made; resolve rolls back rather than resuming.
-    submit_dstack(&submitter, &contract).await;
+    // When: a Dstack attestation is submitted.
+    let result = submit_dstack(&submitter, &contract).await;
 
-    // Then: unlike the rejection path, the entry is still pending before the
-    // timeout; the timeout then cleans up, proving an atomic rollback of a partial
-    // resolve receipt cannot wedge the account.
+    // Then: the callback receipt fails wholesale, nothing is stored, and the
+    // runtime refunds the attached deposit. Proves an OOG in resolve cannot commit
+    // partial state.
+    assert!(
+        !result.failures().is_empty(),
+        "an OOG resolve_verification must fail the chain, got: {result:#?}"
+    );
+    let stored = get_participant_attestation(&contract, &p2p_tls_key().into())
+        .await
+        .unwrap();
     assert!(
-        has_pending_attestation(&contract, submitter.id()).await.unwrap(),
-        "pending entry must survive an OOG resolve_verification (cleanup is left to the timeout)"
+        stored.is_none(),
+        "nothing should be stored on an OOG resolve"
     );
-    worker.fast_forward(YIELD_TIMEOUT_BLOCKS).await.unwrap();
-    assert_submission_cleaned_up(&contract, &submitter, balance_before).await;
+    assert_deposit_refunded(&submitter, balance_before).await;
 }
 
 /// Asserts the full 1 NEAR storage deposit was returned: the net spend is only

crates/contract/tests/sandbox/utils/mpc_contract.rs

@@ -74,17 +74,6 @@ pub async fn submit_participant_info_with_deposit(
         .await?)
 }
 
-pub async fn has_pending_attestation(
-    contract: &Contract,
-    account_id: &AccountId,
-) -> anyhow::Result<bool> {
-    Ok(contract
-        .view(method_names::HAS_PENDING_ATTESTATION)
-        .args_json(serde_json::json!({ "account_id": account_id }))
-        .await?
-        .json()?)
-}
-
 pub async fn vote_tee_verifier_change(
     account: &Account,
     contract: &Contract,

crates/near-mpc-contract-interface/src/method_names.rs

@@ -97,10 +97,6 @@ pub const OS_MEASUREMENT_VOTES: &str = "os_measurement_votes";
 pub const ALLOWED_OS_MEASUREMENTS: &str = "allowed_os_measurements";
 pub const MIGRATION_INFO: &str = "migration_info";
 
-// Sandbox-test-only methods (gated behind the contract's `sandbox-test-methods`
-// feature; never in the production wasm).
-pub const HAS_PENDING_ATTESTATION: &str = "has_pending_attestation";
-
 // Deprecated methods
 #[deprecated(note = "https://github.com/near/mpc/issues/3079")]
 pub const REGISTER_FOREIGN_CHAIN_CONFIG: &str = "register_foreign_chain_config";