canton: make core-bridge contracts publicly readable via a public observer#26
Closed
bengtlofgren wants to merge 2 commits into
Closed
canton: make core-bridge contracts publicly readable via a public observer#26bengtlofgren wants to merge 2 commits into
bengtlofgren wants to merge 2 commits into
Conversation
bengtlofgren
force-pushed
the
feat/canton-public-observer
branch
from
July 1, 2026 18:00
827d7dd to
72117f3
Compare
…erver party Add a read-only public party as an observer on the durable core-bridge templates (CoreState, EmitterIdentity, Emitter) so the full records — config, emitter registrations, sequences, and published messages — are readable by anyone the participant grants read-as rights to that party. - public is chosen once at setup and stored on CoreState (the single source of truth). ApproveEmitter sources it AUTHORITATIVELY from CoreState (fetching the operator's own singleton), not from a requester-supplied value, so every Emitter/EmitterIdentity is guaranteed to share the one canonical public party; it is carried forward on every recreate (publish, governance transition). EmitterRequest drops its public field (it is a transient proposal). - Tests: testPublicVisibility (public reads CoreState/Emitter/EmitterIdentity across two publishes, asserts the canonical public, non-stakeholder sees nothing), testGovernancePreservesPublic, testApproveEmitterRejectsForeignCoreState. - Add cantonclient.GetActiveContracts (ACS query) and a public-read integration test that reads the ACS as the public party over the real Ledger API and confirms it sees the three durable templates. - Surface the public party id in the devnet bootstrap; document the model and the required participant-side read-as-public grant (README section 4.6).
bengtlofgren
force-pushed
the
feat/canton-public-observer
branch
from
July 1, 2026 18:43
72117f3 to
c91c254
Compare
bengtlofgren
force-pushed
the
feat/canton-public-observer
branch
from
July 1, 2026 19:44
aa03c1a to
55f967c
Compare
Author
|
I dont know if this is going to be needed .. |
Author
|
Closing in favor of #32 (canton-guardian-observer). On the current (post-#29) template set, the |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
publicobserver party to the durable core-bridge contracts (CoreState,Emitter,EmitterIdentity) so their state is readable by any participant granted read-as rights for that party, without exposing any signing authority. Thepublicparty is sourced authoritatively fromCoreStateinApproveEmitterso all emitter records are guaranteed to share one canonical visibility party.Changes
canton/core/daml/Wormhole/Core/State.daml—public : Partyadded toCoreState,Emitter, andEmitterIdentity; listed asobserveron each.ApproveEmitterfetchespublicfromCoreState(operator is signatory) rather than accepting a requester-supplied value.canton/core/daml/Wormhole/Core/Setup.daml—setupallocates and stores thepublicparty onCoreState.canton/devnet/bootstrap.sh— bootstrap passes thepublicparty through tosetup.canton/test/daml/Test/TestCore.daml— tests updated for the newpublicfield; coverage added for public-read visibility.node/pkg/cantonclient/—GetActiveContractsadded to the client interface and gRPC implementation to support public-read queries.node/pkg/watchers/canton/public_read_integration_test.go— new integration test verifying that contracts are visible when read as thepublicparty.canton/README.md— §4.6 added documenting the public-readability design.