feat(vats): implement "big hammer" governance #4642

michaelfig · 2022-02-23T01:22:09Z

closes: #4352

Description

Implement 'core' bridge handler to enable governance to evaluate core boot code. Update solo to allow new home objects to be pushed.

Remove "leftover actions" assertion, since it is fragile in the face of governance and has thus outlived its usefulness (all actions that make it through the actionQueue are precious, not just heuristically-determined ones).

Drive-by update faucet-helper.sh not to give away so many assets.

Demo

This is a demo of the end-to-end: passing a governance action to add something to every ag-solo's home:

cd packages/cosmic-swingset
make scenario2-setup scenario2-run-chain # in one console
make scenario2-run-client # in another console
# Wait for chain and client to boot, then type at the REPL: `agoric`
# propose and vote on gov-permit.json and gov-code.js:
make scenario2-core-eval scenario2-vote
agd query gov proposals
# Wait for the voting_end_time to happen, then voila, typing `agoric` at REPL results in `youAreGoverned`:

Security Considerations

No new security dependencies beyond what 2/3 validators could do anyway.

Documentation Considerations

Testing Considerations

Will be tested in earnest on the next Devnet.

dckc

Looks great!

where is the .proto thingy?

I should probably test this a bit.

packages/cosmic-swingset/gov-code.js

packages/deployment/ansible/roles/cosmos-genesis/files/faucet-helper.sh

packages/solo/src/vat-http.js

dckc · 2022-02-23T02:20:39Z

packages/vats/src/core/chain-behaviors.js

@@ -32,6 +33,58 @@ const { keys } = Object;

 const NUM_IBC_PORTS = 3;

+/**
+ * This is the code triggered by `agd tx gov submit-proposal swingset-core-eval


Suggested change

* This is the code triggered by `agd tx gov submit-proposal swingset-core-eval

* This registers the code triggered by `agd tx gov submit-proposal swingset-core-eval

dckc · 2022-02-23T02:23:43Z

packages/vats/src/core/chain-behaviors.js

+          const { evals } = obj;
+          return Promise.all(
+            evals.map(({ json_permits: permit, js_code: code }) =>


I can haz static type plz?

Or a comment cross-referencing a .proto file?

Ah, that helped me catch a bug. The json_permits needed parsing.

dckc · 2022-02-23T02:24:53Z

packages/vats/src/core/chain-behaviors.js

+                // Inspired by ../repl.js:
+                const globals = harden({
+                  ...farExports,
+                  console,


console... hm... I guess that's reasonable.

How about assert while we're at it?

How about assert while we're at it?

Added here and in repl.js for the pleasure of the ag-solo REPL.

dckc · 2022-02-23T02:27:43Z

packages/vats/src/core/chain-behaviors.js

+      }
+    },
+  });
+  await E(bridgeManager).register('core', handler);


I feel even more strongly about magic strings than I did before getting into this bootstrap stuff.

Suggested change

await E(bridgeManager).register('core', handler);

const CORE_BRIDGE_ID = 'core';

await E(bridgeManager).register(CORE_BRIDGE_ID, handler);

with the definition at the top. and exported.

Well... I dunno... Maybe I can stand to leave it alone until we have another piece of code that has to use the same string.

Well... I dunno... Maybe I can stand to leave it alone until we have another piece of code that has to use the same string.

That day is today. I've created packages/vats/src/bridge-ids.js.

packages/vats/src/core/client-behaviors.js

dckc · 2022-02-23T02:29:36Z

packages/vats/src/core/manifest.js

@@ -1,5 +1,6 @@
 // @ts-check
 const SHARED_BOOTSTRAP_MANIFEST = harden({
+  makeCoreEval: true,


is makeCoreEval useful on the sim-chain?

I've renamed it to bridgeCoreEval and moved it to just the chain manifest.

dckc

I verified that this works as advertised:

command[4] agoric.youAreGoverned
history[4] "agoric15ccjs5hmhrnsszd55npfr22gkfjeu4les90l4a"

I see the .proto was introduced in #4625 .

There I find discussion of documentation burden:

There will certainly be documentation, but this help string is not the place for it.
-- #4625 (comment)

I prefer that any such statements about the future come with references to issues by number, but I don't suppose that's critical to landing this PR.

I'm also a little hesitant that the bulk of the testing here is manual integration testing, but again, test-boot.js does seem to cover it at least a little.

just realized: I should test starting the RUN protocol.

dckc · 2022-02-23T23:01:15Z

packages/vats/src/core/chain-behaviors.js

+                });
+
+                // Evaluate the code in the context of the globals.
+                return new Compartment(globals).evaluate(code);


Let's have the evaluated code return a function and pass the powers to that function, so that the evaluated code can be organized according to POLA rather than having powerful globals available ambiently.

dckc · 2022-02-24T04:56:54Z

I was able to start the RUN protocol, though it's a little twisty. I'll be thinking about ways to straighten it out.

dckc

feel free to add powerless stuff such as utils, bootBehaviors, ... to the globals.

refs: #4642, #4352

michaelfig added cosmic-swingset package: cosmic-swingset Governance Governance labels Feb 23, 2022

michaelfig self-assigned this Feb 23, 2022

michaelfig requested a review from dckc February 23, 2022 01:43

dckc mentioned this pull request Feb 23, 2022

Make types of home available to deploy scripts #3154

Open

dckc reviewed Feb 23, 2022

View reviewed changes

michaelfig force-pushed the mfig-core-eval-governance branch 2 times, most recently from c6bdfc9 to b1bfb16 Compare February 23, 2022 03:35

michaelfig requested a review from dckc February 23, 2022 03:36

dckc previously approved these changes Feb 23, 2022

View reviewed changes

dckc reviewed Feb 23, 2022

View reviewed changes

dckc approved these changes Feb 24, 2022

View reviewed changes

michaelfig and others added 7 commits February 23, 2022 23:24

feat(cosmic-swingset): add tools for core-eval governance

7368aa6

chore(cosmic-swingset): move governance test to test/gov-*

0fffad9

fix(vats): parse coreEval permits correctly

eb04df5

refactor(vats): make bridge IDs manifest constants

c2c93f3

test(vats): mock getConfiguration

c297c85

chore: bridgeCoreEval: pass powers explicitly rather than ambiently

42ca4a4

feat(vats): pass some module namespaces to core eval

7b063db

michaelfig force-pushed the mfig-core-eval-governance branch from bc5dbc5 to 7b063db Compare February 24, 2022 05:24

michaelfig added the automerge:no-update (expert!) Automatically merge without updates label Feb 24, 2022

mergify bot merged commit 2e6e57c into master Feb 24, 2022

mergify bot deleted the mfig-core-eval-governance branch February 24, 2022 05:40

dckc mentioned this pull request Feb 25, 2022

Committee should have the ability to re-issue invitations #4658

Closed

dckc added a commit that referenced this pull request Mar 6, 2022

fix: freeze globalThis in coreEval to enforce OCap discipline

93d0db7

refs: #4642, #4352

dckc mentioned this pull request Mar 6, 2022

fix: freeze globalThis in coreEval to enforce OCap discipline #4753

Merged

dckc added a commit that referenced this pull request Mar 6, 2022

fix: freeze globalThis in coreEval to enforce OCap discipline

02f401f

refs: #4642, #4352

dckc mentioned this pull request Apr 8, 2022

deploy runStake to devnet (agoricdev-8) by cosmos governance #4348

Closed

7 tasks

gibson042 mentioned this pull request Apr 29, 2022

chore: Fix harmless bootstrap-related bugs and typos #5259

Merged

dckc mentioned this pull request Nov 9, 2023

separate E(zoe).startInstance() authority from E(zoe).offer() #3725

Open

This was referenced Nov 30, 2023

[Snyk] Security upgrade @agoric/cosmic-swingset from 0.19.0 to 0.34.6 Kashuhackerone/agoric-sdk#220

Open

[Snyk] Fix for 1 vulnerabilities Kashuhackerone/agoric-sdk#240

Open

Kashuhackerone mentioned this pull request Dec 31, 2023

[Snyk] Security upgrade @agoric/cosmic-swingset from 0.19.0 to 0.34.6 Kashuhackerone/agoric-sdk#246

Open

Kashuhackerone mentioned this pull request Jan 20, 2024

[Snyk] Security upgrade @agoric/swingset-vat from 0.10.0 to 0.25.1 Kashuhackerone/agoric-sdk#252

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vats): implement "big hammer" governance #4642

feat(vats): implement "big hammer" governance #4642

michaelfig commented Feb 23, 2022

dckc left a comment

dckc Feb 23, 2022

dckc Feb 23, 2022

michaelfig Feb 23, 2022

dckc Feb 23, 2022

michaelfig Feb 23, 2022

dckc Feb 23, 2022

michaelfig Feb 23, 2022

dckc Feb 23, 2022

michaelfig Feb 23, 2022

dckc left a comment

dckc Feb 23, 2022

dckc commented Feb 24, 2022

dckc left a comment

	* This is the code triggered by `agd tx gov submit-proposal swingset-core-eval
	* This registers the code triggered by `agd tx gov submit-proposal swingset-core-eval

	await E(bridgeManager).register('core', handler);
	const CORE_BRIDGE_ID = 'core';
	await E(bridgeManager).register(CORE_BRIDGE_ID, handler);

feat(vats): implement "big hammer" governance #4642

feat(vats): implement "big hammer" governance #4642

Conversation

michaelfig commented Feb 23, 2022

Description

Demo

Security Considerations

Documentation Considerations

Testing Considerations

dckc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dckc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dckc commented Feb 24, 2022

dckc left a comment

Choose a reason for hiding this comment