diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md new file mode 100644 index 00000000..07fb944c --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md @@ -0,0 +1,90 @@ +# Facilitator Guide + +Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry on a selected network. + +Before running anything, replace every literal `NETWORK_NAME` below with the selected config directory, for example `sepolia`. The Makefile has no default and rejects an inherited or exported `TASK_NETWORK`; every invocation must visibly use `make TASK_NETWORK= `. + +## 1. Install dependencies + +```bash +cd active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator +make TASK_NETWORK=NETWORK_NAME deps +``` + +## 2. Deploy contracts + +Use the normal funded personal Ledger account: + +```bash +make TASK_NETWORK=NETWORK_NAME deploy-nitro-validator +VERIFIER_API_KEY= make TASK_NETWORK=NETWORK_NAME verify-nitro-validator +make TASK_NETWORK=NETWORK_NAME deploy-tee-registry-impl +VERIFIER_API_KEY= make TASK_NETWORK=NETWORK_NAME verify-tee-registry-impl +``` + +This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `config/NETWORK_NAME/addresses.json` and chain-keyed deployment records under `records/`. + +Review and commit the selected network's addresses and timestamped deployment records before generating validations. Do not modify artifacts from completed network rollouts. + +## 3. Generate forward and rollback validations + +```bash +make TASK_NETWORK=NETWORK_NAME gen-validation-cb +make TASK_NETWORK=NETWORK_NAME gen-validation-sc +make TASK_NETWORK=NETWORK_NAME gen-validation-cb-rollback +make TASK_NETWORK=NETWORK_NAME gen-validation-sc-rollback +``` + +For a non-mainnet rollout, remove each generated `taskOriginConfig` and add this root field to all four validation files: + +```json +"skipTaskOriginValidation": true +``` + +For a mainnet rollout through the proxy admin owner, retain task-origin validation and collect the required task-origin signatures. + +Commit the four validation files after reviewing their state diffs. + +Record the current nonces for `PROXY_ADMIN_OWNER`, `CB_MULTISIG`, and `BASE_SECURITY_COUNCIL`. Do not allow unrelated transactions from those Safes during the cutover. Regenerate all validations if any nonce changes unexpectedly. + +Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `OLD_TEE_PROVER_REGISTRY_IMPL` in `config/NETWORK_NAME/.env` to the implementation in `config/NETWORK_NAME/addresses.json`. + +Expected rollback state change: the same slot changes from the new implementation back to `OLD_TEE_PROVER_REGISTRY_IMPL`. + +## 4. Collect signatures + +Ask signers to run `make sign-task` from the repository root and select the chosen network entry for this task. Collect signatures for all four validation files before cutover. + +## 5. Prepare the offchain cutover + +Confirm the migrated registrar uses the signer configured as `CERT_MANAGER_REVOKER` in `config/NETWORK_NAME/.env` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks. + +Keep the existing registrar and enclaves available for rollback. Stop the old registrar immediately before executing the onchain upgrade. + +## 6. Approve and execute the upgrade + +```bash +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-cb +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-sc +make TASK_NETWORK=NETWORK_NAME execute +``` + +## 7. Start the migrated registrar + +Start the migrated registrar after the proxy upgrade. Rotate one enclave first so its new ephemeral signer exercises certificate caching and hinted registration. Confirm the new signer is valid before rotating the remaining enclaves. + +## 8. Roll back if required + +If the migrated registrar path fails, use the rollback signatures collected before cutover: + +```bash +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-cb-rollback +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-sc-rollback +make TASK_NETWORK=NETWORK_NAME execute-rollback +``` + +Restart the legacy registrar after the rollback. Do not decommission the legacy Nitro verifier in this task. + +## 9. Verify and archive + +Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update `config/NETWORK_NAME/README.md` to `Status: [EXECUTED]()` and commit execution records. Run `make archive-task` from the repository root only after every currently intended network rollout is complete. diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile similarity index 96% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile index c17e11d6..af29f0ba 100644 --- a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile @@ -1,7 +1,12 @@ include ../../../../Makefile include $(REPO_ROOT)/Multisig.mk -TASK_NETWORK ?= zeronet +ifneq ($(origin TASK_NETWORK),command line) +$(error TASK_NETWORK must be set on the make command line; run make TASK_NETWORK=sepolia ) +endif +ifeq ($(strip $(TASK_NETWORK)),) +$(error TASK_NETWORK cannot be empty; run make TASK_NETWORK=sepolia ) +endif PROJECT_DIR := $(abspath ../..) include $(REPO_ROOT)/config/$(TASK_NETWORK).env @@ -10,7 +15,7 @@ include config/$(TASK_NETWORK)/.env SIGNER_TOOL_PATH := $(REPO_ROOT)/signer-tool VALIDATIONS_DIR := $(CURDIR)/config/$(TASK_NETWORK)/validations RPC_URL := $(L1_RPC_URL) -ADDRESSES_JSON := $(CURDIR)/addresses.json +ADDRESSES_JSON := $(CURDIR)/config/$(TASK_NETWORK)/addresses.json DEPLOYER = $(shell $(MISE_EXEC) cast wallet address --ledger --mnemonic-derivation-path $(LEDGER_HD_PATH)) DEPLOY_NITRO_SCRIPT := tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol:DeployNitroValidatorStack diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env new file mode 100644 index 00000000..da361125 --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env @@ -0,0 +1,11 @@ +# https://github.com/base/contracts/commit/8897196c2a77b04fe69e47e158c6c112a936d65c +BASE_CONTRACTS_COMMIT=8897196c2a77b04fe69e47e158c6c112a936d65c +RECORD_STATE_DIFF=true + +# New CertManager custody. +CERT_MANAGER_OWNER=0x646132A1667ca7aD00d36616AFBA1A28116C770A +CERT_MANAGER_REVOKER=0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3 + +# Rollback anchors verified against Sepolia before task creation. +OLD_TEE_PROVER_REGISTRY_IMPL=0xF9Ab55c35cE7Fb183A50E611B63558499130D849 +OLD_NITRO_VERIFIER=0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72 diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md new file mode 100644 index 00000000..1453b695 --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md @@ -0,0 +1,28 @@ +# Upgrade TEE Registry to Hinted Nitro Validation + +Status: READY TO SIGN + +## Description + +Deploy the hinted Nitro validator stack and upgrade the existing `TEEProverRegistry` proxy to an implementation that validates registrations through it. + +The registry proxy and all existing signer, proposer, owner, manager, game type, and image-hash storage remain unchanged. + +## Custody + +| Role | Address | +| -- | -- | +| `CertManager` owner | `0x646132A1667ca7aD00d36616AFBA1A28116C770A` | +| `CertManager` revoker | `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` | +| ProxyAdmin owner | `0x0fe884546476dDd290eC46318785046ef68a0BA9` | +| TEE registry proxy | `0xf0d7E15673fBA052e83d7f2b26BB6071E86b972e` | + +## Sign + +From the repository root: + +```bash +make sign-task +``` + +Select this Sepolia task and sign both the forward and rollback transactions. Send the signatures to the facilitator. diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/addresses.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/addresses.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md b/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md deleted file mode 100644 index 66dc47bb..00000000 --- a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md +++ /dev/null @@ -1,86 +0,0 @@ -# Facilitator Guide - -Guide for deploying the hinted Nitro validator stack and upgrading the Zeronet TEE registry. - -## 1. Install dependencies - -```bash -cd active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator -make deps -``` - -## 2. Deploy contracts - -Use the normal funded personal Ledger account: - -```bash -make deploy-nitro-validator -VERIFIER_API_KEY= make verify-nitro-validator -make deploy-tee-registry-impl -VERIFIER_API_KEY= make verify-tee-registry-impl -``` - -This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `addresses.json` and deployment records to `records/`. - -Review and commit `addresses.json` and the timestamped deployment records before generating validations. - -## 3. Generate forward and rollback validations - -```bash -make gen-validation-cb -make gen-validation-sc -make gen-validation-cb-rollback -make gen-validation-sc-rollback -``` - -For Zeronet, remove each generated `taskOriginConfig` and add this root field: - -```json -"skipTaskOriginValidation": true -``` - -Commit the four validation files after reviewing their state diffs. - -Record the current nonces for `PROXY_ADMIN_OWNER`, `CB_MULTISIG`, and `BASE_SECURITY_COUNCIL`. Do not allow unrelated transactions from those Safes during the cutover. Regenerate all validations if any nonce changes unexpectedly. - -Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8` to the implementation in `addresses.json`. - -Expected rollback state change: the same slot changes from the new implementation back to `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8`. - -## 4. Collect signatures - -Ask signers to run `make sign-task` from the repository root and select this task. Collect signatures for all four validation files before cutover. - -## 5. Prepare the offchain cutover - -Confirm the migrated registrar uses signer `0x5F109182a097c40Cc936742be4B55c1A08aC4dd9` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks. - -Keep the existing registrar and enclaves available for rollback. Stop the old registrar immediately before executing the onchain upgrade. - -## 6. Approve and execute the upgrade - -```bash -SIGNATURES= make approve-cb -SIGNATURES= make approve-sc -make execute -``` - -## 7. Start the migrated registrar - -Start the migrated registrar after the proxy upgrade. Rotate one enclave first so its new ephemeral signer exercises certificate caching and hinted registration. Confirm the new signer is valid before rotating the remaining enclaves. - -## 8. Roll back if required - -If the migrated registrar path fails, use the rollback signatures collected before cutover: - -```bash -SIGNATURES= make approve-cb-rollback -SIGNATURES= make approve-sc-rollback -make execute-rollback -``` - -Restart the legacy registrar after the rollback. Do not decommission the legacy Nitro verifier in this task. - -## 9. Verify and archive - -Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update the signer README to `Status: [EXECUTED]()`, commit execution records, and run `make archive-task` from the repository root before merging the PR.