Release gate: v0.123-dev → v0.123 (waits for cross-repo E2E)

.claude/settings.json

@@ -2,6 +2,7 @@
   "enabledPlugins": {
     "code-review@claude-plugins-official": true,
     "feature-dev@claude-plugins-official": true,
-    "hookify@claude-plugins-official": true
+    "hookify@claude-plugins-official": true,
+    "sentry@claude-plugins-official": true
   }
 }

.dockerignore

@@ -8,6 +8,8 @@ README.md
 
 docker/
 !docker/entrypoint-*.sh
+!docker/scripts/
+!docker/genvm-source-build.nix.conf
 .venv/
 .vscode/
 .ollama/

.e2e-genvm-prebuilt/.gitkeep

@@ -0,0 +1 @@
+

.env.example

@@ -7,7 +7,6 @@ DBPASSWORD='postgres'
 DBPORT='5432'
 DATABASE_POOL_SIZE='20'           # Database connection pool size
 DATABASE_MAX_OVERFLOW='10'        # Maximum overflow connections
-# Set the compose profile to 'hardhat' to use the hardhat network
 REMOTE_DATABASE='false'
 
 ########################################
@@ -16,6 +15,7 @@ LOGCONFIG='dev'                   # dev/prod
 LOG_LEVEL='debug'                 # 'critical', 'error', 'warning', 'info', 'debug', 'trace'
 DISABLE_INFO_LOGS_ENDPOINTS='["ping", "eth_getTransactionByHash","gen_getContractSchema", "gen_getContractSchemaForCode", "net_version", "sim_getTransactionsForAddress", "sim_getConsensusContract", "eth_estimateGas", "eth_chainId", "eth_getBlockByNumber", "eth_gasPrice", "sim_getFinalityWindowTime"]'
 SHOW_VALIDATOR_PRIVATE_KEYS_IN_LOGS='false' # Set true only when debugging local validator signing.
+SHOW_VALIDATOR_PRIVATE_KEYS_IN_RPC='false'  # Set true only when inspecting validator signing data locally.
 
 ########################################
 # JsonRPC Server Configuration
@@ -26,7 +26,6 @@ SERVER_NAME='studio.genlayer.com'
 
 ########################################
 # Compose and Build
-# Set the compose profile to 'hardhat' to use the hardhat network
 COMPOSE_PROFILES=''
 FRONTEND_BUILD_TARGET='dev'       # change to 'dev' to run in dev mode
 BACKEND_BUILD_TARGET='debug'      # change to 'prod' or remove to run in prod mode
@@ -36,9 +35,52 @@ REDIS_URL='redis://redis:6379/0'  # Redis URL for Socket.IO message queue (e.g.,
 # GenVM Configuration
 GENVM_BIN="/genvm/bin"
 GENVMROOT="/genvm"
+# Acquisition mode: prebuilt, source, release, or empty for auto selection.
+# Auto precedence is prebuilt E2E tree > <branch>:<commit> source pin > release.
+# Release is the default and uses third_party/genvm/version unless GENVM_TAG overrides it.
+GENVM_SOURCE_MODE=""
+GENVM_TAG="" # Exact release tag, e.g. v0.6.0-rc0. Mutually exclusive with GENVM_REF.
+GENVM_REF="" # Source git ref/SHA; set mode=source, or use <branch>:<commit> for auto source mode.
+GENVM_EXECUTOR_VERSION_NAME="" # Optional source-build executor label, e.g. v0.3.0-e2e-dev.
+NIX_NETRC_FILE="./docker/empty.netrc" # Netrc with a nix cache pull token; must exist, empty one just means no cache hits.
 GENVM_LLM_DEBUG="0"
 GENVM_WEB_DEBUG="0"
 
+########################################
+# Studio Fee Accounting
+# Set all three price values to 0 to run Studio in gasless mode.
+GENLAYER_STUDIO_GEN_PER_TIME_UNIT='1'  # v0.6 neutral time-unit multiplier
+GENLAYER_STUDIO_STORAGE_UNIT_PRICE='250000000'  # v0.6 default: 0.25 gwei
+GENLAYER_STUDIO_RECEIPT_GAS_PRICE='250000000'  # v0.6 default: 0.25 gwei
+# Combined developer + DAO share of gross time-unit fees (15% by default).
+GENLAYER_STUDIO_TIME_UNIT_OVERLAY_BPS='1500'
+# v0.6 Idleness phase bounds (PHASE_TIMEOUT_BOUNDS=30,600,30,600).
+GENLAYER_STUDIO_MIN_PROPOSE_TIMEUNITS='30'
+GENLAYER_STUDIO_MAX_PROPOSE_TIMEUNITS='600'
+GENLAYER_STUDIO_MIN_COMMIT_TIMEUNITS='30'
+GENLAYER_STUDIO_MAX_COMMIT_TIMEUNITS='600'
+# Conservative gas cap used when transaction simulation discovers an external
+# message whose exact downstream gas usage is unknowable at submission time.
+GENLAYER_STUDIO_DEFAULT_EXTERNAL_GAS_LIMIT='500000'
+# Governance-controlled external allocation gas-limit floor; 0 disables it.
+GENLAYER_STUDIO_MIN_EXTERNAL_GAS_LIMIT='0'
+# Messages has an independent hard protocol ceiling (20 maximum); the optional
+# FeeManager cap may lower it further when non-zero.
+GENLAYER_STUDIO_MAX_ALLOCATED_MESSAGES='20'
+GENLAYER_STUDIO_MAX_MESSAGES_PER_TX='0'
+# Governance-controlled receipt/output admission caps; 0 disables them.
+GENLAYER_STUDIO_MAX_EQ_OUTPUTS_BYTES='0'
+GENLAYER_STUDIO_MAX_SUBMITTED_MESSAGES_BYTES='0'
+GENLAYER_STUDIO_FIXED_PROPOSE_RECEIPT_GAS='210000'
+GENLAYER_STUDIO_FIXED_MESSAGE_REVEAL_GAS='100000'
+GENLAYER_STUDIO_RECEIPT_WRAPPER_BYTES='1024'
+# Studio's virtual v0.6 GhostFactory deployment. These defaults are stable
+# across RPC replicas. Override all three only when intentionally mirroring a
+# concrete Consensus deployment (GhostFactory, CreationPhase, bytecodeEVM).
+GENLAYER_STUDIO_GHOST_FACTORY_ADDRESS='0x130e09c996462963A6398CA04e1011e6ef9d68a6'
+GENLAYER_STUDIO_GHOST_BYTECODE_HASH='0x4249189346902cb6f0afc196d5719e1b4cbc861a700ae3b0c6dcbe51e5e566de'
+GENLAYER_STUDIO_GHOST_FACTORY_INITIAL_NONCE='2'
+
 # Ollama Server Configuration
 OLAMAPORT='11434'
 
@@ -52,12 +94,13 @@ WEBDRIVER_TIMEOUT_MS="60000"
 WEB_RENDER_RETRIES="2"
 
 ########################################
-# Consensus Rollup
-# Hardhat port
-HARDHAT_URL='http://hardhat'
+# Optional legacy Hardhat inspection bridge. Studio protocol state and ghost
+# addresses are DB-authoritative and do not require this service.
+HARDHAT_URL=''
 HARDHAT_PORT='8545'
-HARDHAT_PRIVATE_KEY='0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
-GENLAYER_CHAIN_ID='61999'
+# Keep this aligned with the SDK localnet preset. Existing pre-v0.123 .env
+# files may still contain 61999 and must be updated before restarting Studio.
+GENLAYER_CHAIN_ID='61127'
 
 ########################################
 # LLM Providers Configuration
@@ -96,12 +139,41 @@ RATE_LIMIT_ENABLED='false'           # Enable/disable API key rate limiting
 RATE_LIMIT_ANON_PER_MINUTE='30'      # Anonymous (no API key) per-minute limit
 RATE_LIMIT_ANON_PER_HOUR='500'       # Anonymous per-hour limit
 RATE_LIMIT_ANON_PER_DAY='5000'       # Anonymous per-day limit
+RATE_LIMIT_READ_MULTIPLIER='10'      # Cheap reads (no GenVM) get this multiple of the tier limits
 
 # PENDING-tx queue depth caps for eth_sendRawTransaction (admission control).
-# Empty / unset = no cap (the default for self-hosted). Public shared
-# deployments should set both to prevent one user filling the queue.
-MAX_PENDING_PER_CONTRACT_DEFAULT=''  # Cap PENDING txs per contract (e.g. 50)
-MAX_PENDING_PER_SENDER_DEFAULT=''    # Cap PENDING txs per sender   (e.g. 20)
+# The per-recipient cap defaults to Consensus Queues' 20 even when empty;
+# the Studio-only per-sender cap remains disabled unless explicitly set.
+MAX_PENDING_PER_CONTRACT_DEFAULT=''  # Empty = protocol default 20
+MAX_PENDING_PER_SENDER_DEFAULT=''    # Empty = disabled
+# Daily per-contract snapshot-byte budget (empty = off). Hosted sandbox
+# example: 1073741824 (1 GiB). First write of the UTC day always allowed.
+MAX_CONTRACT_SNAPSHOT_BYTES_PER_DAY=''
+
+########################################
+# Terminal Contract Snapshot Pruning (Optional)
+# Archives terminal transaction contract_snapshot payloads before pruning them
+# from the hot transactions table. Disabled by default.
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_ENABLED='false'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_ARCHIVE_ENABLED='true'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_VERIFY_ARCHIVE='true'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_ALLOW_LOSSY_PRUNE='false'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_DRY_RUN='false'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_BATCH_SIZE='5'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_RETENTION_HOURS='24'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_INTERVAL_SECONDS='300'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_ARCHIVE_BACKEND='s3' # file, gcs, or s3
+STUDIO_CONTRACT_SNAPSHOT_ARCHIVE_RETRIEVAL_ENABLED='false'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_FILE_DIR='data/terminal-contract-snapshot-archive'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_GCS_BUCKET=''
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_GCS_PREFIX='studio/terminal-contract-snapshots'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_GCS_STORAGE_CLASS='NEARLINE'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_S3_BUCKET=''
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_S3_PREFIX='studio/terminal-contract-snapshots'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_S3_REGION=''
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_S3_STORAGE_CLASS='STANDARD'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_S3_SSE='aws:kms'
+STUDIO_CONTRACT_SNAPSHOT_PRUNER_S3_KMS_KEY_ID=''
 
 ########################################
 # Usage Metrics Configuration (Optional)
@@ -122,6 +194,9 @@ VALIDATORS_CONFIG_JSON='[
 JSONRPC_REPLICAS='1'
 CONSENSUS_WORKERS='3'
 MAX_PARALLEL_TXS_PER_WORKER='1'
+# Max validators executing concurrently per transaction (GenVM subprocesses).
+# Raise for large committees if memory allows.
+CONSENSUS_VALIDATOR_MAX_CONCURRENT='8'
 # Production Configuration (for Gunicorn deployment)
 WEB_CONCURRENCY='1'               # Number of Gunicorn workers (default: CPU cores * 2)
 # Service resources limit

.github/actions/genvm-runners-closure/action.yml

@@ -0,0 +1,61 @@
+name: Prebuild GenVM runners closure
+description: >
+  Builds genvm-manager's `runners-all` on the runner, where the Nix sandbox
+  works, and exports its store closure into the Docker build context so the
+  in-image source build can import it instead of rebuilding it.
+
+  The runner tree is assembled from fixed-output derivations that compile C to
+  wasm (`genvm-cpython-objs`, `genvm-ffi`, bz2/xz/zlib, numpy, PIL). Their
+  identity is their output hash, and the `nixos/nix` image cannot enable the
+  sandbox, so building them there picks up host state and misses the pinned
+  hashes. Everything else in the build is input-addressed and does not care.
+
+inputs:
+  ref:
+    description: GenVM source binding, `<branch>:<commit>` or a bare commit.
+    required: true
+  destination:
+    description: Directory in the build context to write the closure into.
+    required: false
+    default: .genvm-nix-closure
+  nix_cache_pull_token:
+    description: >-
+      pull token for the GenLayer nix cache, which is private. A composite
+      action cannot read `secrets`, so the caller has to thread it through.
+      Empty means the runner closure is built from source.
+    required: false
+    default: ""
+
+outputs:
+  netrc_path:
+    description: >-
+      Netrc holding the cache pull token, written by nix-setup. The Docker
+      source build fetches from the same cache, so it needs the same credential
+      — pass it as a BuildKit secret, never as an ARG or a COPY.
+    value: ${{ steps.nix.outputs.netrc_path }}
+
+runs:
+  using: composite
+  steps:
+    # Substituters, trusted keys and cache auth come from the shared action; the
+    # sandbox settings below are this action's own and must survive it, so they
+    # go through extra_nix_config, whose lines are appended last and win.
+    - name: Install Nix
+      id: nix
+      uses: genlayerlabs/github-actions/nix-setup@39b0a0d5e9bb27a1612d2e98b0f8509d31745157
+      with:
+        cache_pull_token: ${{ inputs.nix_cache_pull_token }}
+        extra_nix_config: |
+          sandbox = true
+          # Without this Nix quietly builds unsandboxed when it cannot set the
+          # sandbox up, which is the exact output this action must never export.
+          sandbox-fallback = false
+
+    - name: Build and export runners-all
+      shell: bash
+      env:
+        GENVM_CLOSURE_REF: ${{ inputs.ref }}
+        GENVM_CLOSURE_DEST: ${{ inputs.destination }}
+      run: |
+        ./scripts/genvm-runners-closure.sh \
+          "$GENVM_CLOSURE_REF" "$GENVM_CLOSURE_DEST"

.github/scripts/install-python-dependencies.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+python -m pip install --only-binary :all: -r requirements.txt
+# The prerelease qualification cut pins the SDK and test harness to immutable
+# Git commits until their coordinated package versions are published.
+python -m pip install -r requirements.test.txt
+python -m pip install --only-binary :all: -r backend/requirements.txt

.github/scripts/resolve-release-policy.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "Usage: $0 <version-tag> <field>" >&2
+  echo "Fields: version-branch, channel, push-latest, deployment-event" >&2
+  exit 2
+}
+
+tag="${1:-}"
+field="${2:-}"
+
+if [[ -z "${tag}" || -z "${field}" ]]; then
+  usage
+fi
+
+if [[ ! "${tag}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*)?$ ]]; then
+  echo "Invalid release tag: ${tag}" >&2
+  exit 1
+fi
+
+release_branch="$(sed -E 's/^((v[0-9]+)\.([0-9]+))\..*$/\1/' <<< "${tag}")"
+
+if [[ "${tag}" == *-* ]]; then
+  version_branch="${release_branch}-dev"
+  channel="preview"
+  push_latest="false"
+  deployment_event="release-backend-preview"
+else
+  version_branch="${release_branch}"
+  channel="stable"
+  push_latest="true"
+  deployment_event="release-backend"
+fi
+
+case "${field}" in
+  version-branch)
+    echo "${version_branch}"
+    ;;
+  channel)
+    echo "${channel}"
+    ;;
+  push-latest)
+    echo "${push_latest}"
+    ;;
+  deployment-event)
+    echo "${deployment_event}"
+    ;;
+  *)
+    usage
+    ;;
+esac