canton: free replay roots; single-trie discipline is the consumer's own

Author: kcsongor

canton/README.md

@@ -529,23 +529,36 @@ the digest — verify + consume + act in one transaction.
 
 Properties:
 
-- **No archive-and-replay, no shadow roots.** Archival alone only bricks
-  (fail-closed); the replay vector is node *re-creation*. Nodes are co-signed,
-  so neither the consumer nor the operator can archive or create one alone;
-  splits inherit both signatures from the archived parent (the operator is not
-  involved per consume). Roots are granted exactly once per consumer through
-  the operator's `ReplayRootRegistry` — a *positive*, on-ledger
-  one-root-per-consumer check (the registry carries the granted set and every
-  grant consumes it), via a one-time propose-accept ceremony
-  (`ReplayRootRequest`), mirroring emitter registration. The irreducible
-  remainder: consumer and operator *colluding* can rebuild a trie —
-  signatories can always unmake their own contracts.
+- **Nobody can touch someone else's scope; your own scope is your own
+  problem.** Archival alone only bricks (fail-closed); the replay vector is
+  node *re-creation*. Nodes are co-signed, so no third party can archive or
+  re-create them (splits inherit both signatures from the archived parent —
+  the operator is not involved per consume), and roots come only from the
+  operator's `ReplayRootRegistry` — a stateless, never-churning anchor whose
+  nonconsuming `ClaimReplayRoot` lends the operator's *inherited* signature
+  to a consumer-submitted claim (the `RegisterEmitter` pattern: no crank; the
+  operator multisig signs nothing after genesis). Claiming a root for a
+  consumer requires **that consumer's authority**, so nobody can fork another
+  app's replay scope. There is deliberately *no* one-root-per-consumer
+  enforcement: maintaining a single trie is the consumer's own responsibility
+  (its disclosure service defines which trie its consumes resolve into, and
+  detects forks — more than one covering node — for free). This is EVM
+  parity: nobody grants replay storage there either; every integrator owns
+  its mapping. A consumer minting parallel roots, like a consumer whose key
+  is stolen, only harms itself — and a stolen consumer key defeats the app
+  more directly anyway. (If key-compromise resilience is ever wanted, the
+  hardening is trie-identity pinning: thread the original root's cid through
+  successors via `self` and pin it in the app contract — documented, not
+  built.) Spam claims cost the spammer synchronizer traffic per transaction
+  and the operator ~300 B of storage per worthless root; no shared contract
+  grows, nothing bricks.
 - **Scoping and contention.** Tries are per consumer party: different apps
   consume the same VAA independently. Consumes racing on the *same node*
   conflict — exactly one commits (validator-checked, regardless of submitter);
   the loser re-resolves the covering node and retries. A blind retry of a
-  consume that actually committed fails on membership ("VAA already consumed")
-  — a clean idempotency signal. Until the first split, all of one app's
+  consume that actually committed fails on membership ("digest already
+  consumed") — a clean idempotency signal. Until the first split, all of one
+  app's
   consumes serialize through its root; 16-way fan-out begins at
   `splitThreshold` consumes.
 - **Cost.** `defaultSplitThreshold = 128`: suffixes are ≤64-char hex (~66 B
@@ -607,7 +620,7 @@ it must serve:
 | `CoreState`             | the one true instance              | integrators/users exercising §4.3 verify or §4.6 consume       | yes — every non-stakeholder submitter           | per governance action (rare) |
 | `ReplayNode`            | (consumer, prefix covering digest) | every `VerifyAndConsumeVAA` / integrator redeem                | yes for non-stakeholders (e.g. end users); the consumer itself only needs the cid | every consume under that node |
 | `EmitterRegistry`       | operator                           | `RegisterEmitter`                                              | yes — the requester submits                     | per emitter registration     |
-| `ReplayRootRegistry`    | operator                           | `ApproveReplayRoot`                                            | no — operator submits, own ACS                  | per root grant               |
+| `ReplayRootRegistry`    | operator                           | `ClaimReplayRoot`                                              | yes — the consumer submits (static blob, cacheable) | never (stateless anchor)     |
 | `Emitter`               | (operator, owner, emitterId)       | `PublishMessage`                                               | no — owner submits, own ACS                     | per publish                  |
 | app contracts (e.g. `ExampleIntegrator`) | app-defined      | the app's own choices                                          | app's concern (its users are observers)         | app-defined                  |
 
@@ -1096,10 +1109,16 @@ the quorum and turn guardian downtime into a chain-halt).
 > access to the operator party and its namespace key. Prefer the dedicated
 > `guardianObserver`; use operator replica-hosting only as a migration stopgap.
 
+Note the operator party's ACTIVE signing surface after genesis is empty: every
+day-to-day flow (`RegisterEmitter`, `ClaimReplayRoot`, splits, governance
+transitions) reaches its signature by inheritance from contracts it signed at
+setup. If the operator is stood up as a k-of-n external threshold party (the
+§9 machinery, `GG_THRESHOLD=k`), the interactive-submission signing ceremony
+is needed for genesis only.
+
 **What a compromised operator can and cannot do.** It can degrade **liveness**
-(stop serving disclosures, stop granting replay roots, evict observers — all
-fail-safe: transactions stop constructing, guardians simply stop seeing and
-stop signing). It **cannot** produce
+(stop serving disclosures, evict observers — all fail-safe: transactions stop
+constructing, guardians simply stop seeing and stop signing). It **cannot** produce
 anything guardians would wrongly attest: emitting under an existing address
 requires that owner's signature (§4.2), so an outbound forge is either an invalid
 transaction (rejected in replay, never observed) or a valid contract with a

canton/core/daml/Wormhole/Core/Replay.daml

@@ -35,16 +35,18 @@
 -- its subspace — no covering node, nothing verifies — fail-closed, the
 -- opposite of the key model.
 --
--- The replay vector is therefore node RE-CREATION (archive-and-recreate, or a
--- parallel shadow root), which the signatory design closes: the @operator@
--- co-signs every node, so the consumer alone can neither archive nor create
--- one, and roots are granted exactly once per consumer through the
--- 'ReplayRootRegistry' — a positive, on-ledger one-root-per-consumer check
--- linearized by consuming the registry (the 'EmitterRegistry' pattern, minus
--- the key). Splits inherit both signatures from the archived parent, so the
--- operator is not involved per consume. The irreducible remainder: consumer
--- and operator COLLUDING can archive and rebuild a trie — signatories can
--- always unmake their own contracts.
+-- The replay vector is therefore node RE-CREATION. Against THIRD PARTIES the
+-- signatory design closes it: the @operator@ co-signs every node (inherited
+-- from the 'ReplayRootRegistry' anchor at the root, from the archived parent
+-- at splits — the operator never signs per consume), and claiming a root for
+-- a consumer requires that consumer's authority, so nobody can archive,
+-- re-create, or fork someone ELSE'S replay scope. Against the consumer
+-- ITSELF there is deliberately no on-ledger defense: a consumer can mint
+-- parallel roots for its own scope (see 'ReplayRootRegistry'), which is
+-- self-harm — replay protection is the consumer's own safety property, and a
+-- compromised consumer key defeats the app more directly anyway. Same class
+-- as the irreducible signatory remainder: signatories can always unmake (or
+-- here, duplicate) their own state.
 --
 -- OFF-LEDGER: consumers (and their users) locate the covering node for a
 -- digest via a disclosure service — an ACS index over (consumer, prefix) that
@@ -53,7 +55,7 @@
 -- RETRY PROTOCOL: racing consumes on the same node conflict and exactly one
 -- commits; on rejection, re-resolve the covering node (the cid churns on every
 -- consume) and resubmit. A blind retry of a consume that actually committed
--- hits the membership check and fails "VAA already consumed" — a clean
+-- hits the membership check and fails "digest already consumed" — a clean
 -- idempotency signal.
 module Wormhole.Core.Replay where
 
@@ -123,7 +125,7 @@ template ReplayNode
         -- The replay check MUST precede the split branch: a split inserting a
         -- duplicate would be a silent Set.insert no-op — a replay that
         -- "succeeds".
-        assertMsg "VAA already consumed" (not (Set.member suffix consumed))
+        assertMsg "digest already consumed" (not (Set.member suffix consumed))
         if Set.size consumed < splitThreshold || T.length prefix == 63
           -- Depth-63 nodes never split: suffixes are single nibbles (≤16
           -- distinct, so the set is bounded), and children would be degenerate
@@ -143,51 +145,41 @@ template ReplayNode
               Some cid -> pure cid
               None -> abort "unreachable: split lost the covering child"
 
--- | Grants each consumer AT MOST ONE trie root — the positive, on-ledger
--- uniqueness check that a contract key cannot provide. One registry per
--- operator, created at setup ('mkInitialReplayRootRegistry'); every grant
--- consumes it, so grants are linearized through the operator. The set grows by
--- one Party per integrator app — dozens, not millions.
+-- | Hands out trie roots to any consumer that asks — a stateless O(1) anchor
+-- whose one nonconsuming choice lends the operator's INHERITED co-signature to
+-- consumer-submitted claims (the 'RegisterEmitter' pattern): no operator
+-- crank, no contention, no churn — the registry's disclosure blob is static
+-- and cacheable. One per operator, created at setup
+-- ('mkInitialReplayRootRegistry').
+--
+-- There is deliberately NO one-root-per-consumer enforcement: maintaining a
+-- single trie is the CONSUMER'S OWN responsibility (its disclosure service
+-- defines which trie its consumes resolve into). The controller is what keeps
+-- that sound against everyone else — a third party cannot fork someone else's
+-- replay scope, because claiming a root for @consumer@ requires @consumer@'s
+-- authority. Parallel roots can only be minted by the consumer itself (or its
+-- stolen key), which is self-harm of the same class as the signatory
+-- remainder above. Spam claims cost the spammer synchronizer traffic per
+-- transaction and the operator ~300 B of storage per worthless root; no
+-- shared contract grows. If consumer-key-compromise resilience is ever
+-- wanted, the hardening is trie-identity pinning: thread the original root's
+-- cid through successors (via @self@ in 'ConsumeDigest') and pin it in the
+-- app contract — documented, not built.
 template ReplayRootRegistry
   with
     operator : Party
-    granted  : Set Party
   where
     signatory operator
 
-    choice GrantReplayRoot : ContractId ReplayRootRegistry
-      with
-        consumer : Party
-      controller operator
-      do
-        assertMsg "consumer already has a replay root" (not (Set.member consumer granted))
-        create this with granted = Set.insert consumer granted
-
--- | The consumer's half of the root-creation ceremony: a one-time
--- propose-accept per app. The consumer's signature on this request is what
--- authorizes its co-signature on the root; the operator accepts against its
--- registry, which enforces one-root-per-consumer.
-template ReplayRootRequest
-  with
-    consumer       : Party
-    operator       : Party
-    splitThreshold : Int  -- normally 'defaultSplitThreshold'; tiny in tests
-  where
-    signatory consumer
-    observer operator
-
-    choice ApproveReplayRoot : (ContractId ReplayRootRegistry, ContractId ReplayNode)
+    nonconsuming choice ClaimReplayRoot : ContractId ReplayNode
       with
-        registryCid : ContractId ReplayRootRegistry  -- passed by cid: no keys
-      controller operator
+        consumer       : Party
+        splitThreshold : Int  -- normally 'defaultSplitThreshold'; tiny in tests
+      controller consumer
       do
-        reg <- fetch registryCid
-        assertMsg "registry belongs to a different operator" (reg.operator == operator)
-        regCid' <- exercise registryCid GrantReplayRoot with consumer
-        rootCid <- create ReplayNode with
+        create ReplayNode with
           consumer
           operator
           prefix = ""
           splitThreshold
           consumed = Set.empty
-        pure (regCid', rootCid)

canton/core/daml/Wormhole/Core/Setup.daml

@@ -55,9 +55,9 @@ mkInitialEmitterRegistry : Party -> Party -> EmitterRegistry
 mkInitialEmitterRegistry operator guardianObserver =
   EmitterRegistry with operator, guardianObserver, nextId = 0
 
--- | The replay-root registry the operator creates alongside the 'CoreState' at
--- setup. Grants each integrator consumer at most one 'ReplayNode' trie root
--- (see 'Wormhole.Core.Replay').
+-- | The replay-root registry (the stateless claim anchor) the operator
+-- creates alongside the 'CoreState' at setup. Hands a 'ReplayNode' trie root
+-- to any consumer that claims one (see 'Wormhole.Core.Replay').
 mkInitialReplayRootRegistry : Party -> ReplayRootRegistry
 mkInitialReplayRootRegistry operator =
-  ReplayRootRegistry with operator, granted = Set.empty
+  ReplayRootRegistry with operator

canton/test/daml/Test/TestReplay.daml

@@ -29,26 +29,31 @@ pad64 t = t <> mconcat (replicate (64 - T.length t) "0")
 nibbles : [Text]
 nibbles = T.explode "0123456789abcdef"
 
--- | Propose-accept ceremony granting @consumer@ its trie root: the consumer
--- requests, the operator approves against its (queried, cid-passed — no keys)
--- 'ReplayRootRegistry'.
+-- | Direct, consumer-submitted root claim: the consumer holds the one static
+-- disclosure of the 'ReplayRootRegistry' anchor (served off-ledger by the
+-- disclosure service — simulated here by reading as the operator, and
+-- cacheable forever since the anchor never churns) and submits alone. No
+-- operator crank.
 registerReplayRoot : Party -> Party -> Int -> Script (ContractId ReplayNode)
 registerReplayRoot operator consumer threshold = do
-  reqCid <- submit consumer do
-    createCmd ReplayRootRequest with consumer, operator, splitThreshold = threshold
   [(regCid, _)] <- query @ReplayRootRegistry operator
-  (_, rootCid) <- submit operator do
-    exerciseCmd reqCid ApproveReplayRoot with registryCid = regCid
-  pure rootCid
+  regDisc <- fromSome <$> queryDisclosure operator regCid
+  submit (actAs consumer <> disclose regDisc) do
+    exerciseCmd regCid ClaimReplayRoot with
+      consumer
+      splitThreshold = threshold
 
 -- | The disclosure-service lookup: the unique active node of @consumer@'s trie
--- covering @digest@. Aborts if coverage is not exactly one — every call doubles
--- as a check of the partition invariant.
+-- covering @digest@, queried as @consumer@. The filter matches the trie owner
+-- too, because a reader can see nodes of several tries (the operator co-signs
+-- all of them). Aborts if coverage is not exactly one — every call doubles as
+-- a check of the partition invariant, and this abort is also how the service
+-- detects a forked trie (a consumer that minted parallel roots).
 coveringNode : Party -> Text -> Script (ContractId ReplayNode, ReplayNode)
 coveringNode consumer digest = do
   nodes <- query @ReplayNode consumer
   let d = normalizeHex digest
-  case filter (\(_, n) -> n.prefix `T.isPrefixOf` d) nodes of
+  case filter (\(_, n) -> n.consumer == consumer && n.prefix `T.isPrefixOf` d) nodes of
     [one] -> pure one
     covering -> abort ("partition invariant violated: " <> show (length covering) <> " covering nodes")
 
@@ -254,30 +259,41 @@ testNodeArchiveNeedsBoth = do
   submitMustFail consumer do archiveCmd rootCid
   submitMustFail operator do archiveCmd rootCid
   -- Both together can (the irreducible signatory remainder) — coverage for the
-  -- auto-generated Archive choices, including request and registry.
+  -- auto-generated Archive choices, including the registry anchor.
   submit (actAs consumer <> actAs operator) do archiveCmd rootCid
-  reqCid <- submit consumer do
-    createCmd ReplayRootRequest with consumer, operator, splitThreshold = 4
-  submit consumer do archiveCmd reqCid
   [(regCid, _)] <- query @ReplayRootRegistry operator
   submit operator do archiveCmd regCid
 
--- | The root registry grants at most one root per consumer — the positive,
--- on-ledger check that replaces key uniqueness — and roots cannot be minted
--- outside it (the consumer alone lacks the operator's signature).
-testRootRegistry : Script ()
-testRootRegistry = do
+-- | Root claims are free and self-serve; what the registry pins down is WHOSE
+-- scope a claim can touch. Claiming a root for a consumer requires that
+-- consumer's authority — the load-bearing property: nobody can fork someone
+-- ELSE'S replay scope. A consumer duplicating its own root is deliberately
+-- possible (pinned below): parallel roots are self-harm, detected off-ledger
+-- by the disclosure service ('coveringNode' aborts on more than one covering
+-- node). Roots cannot be minted outside the registry — the consumer alone
+-- lacks the operator's signature.
+testRootClaims : Script ()
+testRootClaims = do
   (operator, consumer, rootCid) <- setupTrie 4
   Some root <- queryContractId consumer rootCid
   root.prefix === ""
   root.splitThreshold === 4
   Set.size root.consumed === 0
-  -- A second grant for the same consumer is rejected.
-  reqCid <- submit consumer do
-    createCmd ReplayRootRequest with consumer, operator, splitThreshold = 4
   [(regCid, _)] <- query @ReplayRootRegistry operator
-  submitMustFail operator do
-    exerciseCmd reqCid ApproveReplayRoot with registryCid = regCid
+  regDisc <- fromSome <$> queryDisclosure operator regCid
+  -- A third party cannot claim a root for someone else's scope.
+  mallory <- allocateParty "TrieMallory"
+  submitMustFail (actAs mallory <> disclose regDisc) do
+    exerciseCmd regCid ClaimReplayRoot with
+      consumer
+      splitThreshold = 4
+  -- The consumer CAN duplicate its own root — by design, self-harm only.
+  _ <- submit (actAs consumer <> disclose regDisc) do
+    exerciseCmd regCid ClaimReplayRoot with
+      consumer
+      splitThreshold = 4
+  roots <- query @ReplayNode consumer
+  length roots === 2
   -- The consumer cannot create a co-signed node alone.
   submitMustFail consumer do
     createCmd ReplayNode with