From 3e38e6892ebc4015333e421f3e432108f367d859 Mon Sep 17 00:00:00 2001 From: Leopold Joy Date: Thu, 20 Aug 2026 02:00:34 +0100 Subject: [PATCH 1/4] revert: restore Nitro validator cutover task Co-authored-by: OpenCode --- .../FACILITATOR.md | 0 .../2026-08-19-upgrade-tee-registry-nitro-validator/Makefile | 0 .../addresses.json | 0 .../config/zeronet/.env | 0 .../config/zeronet/README.md | 0 .../config/zeronet/validations/base-signer-rollback.json | 0 .../config/zeronet/validations/base-signer.json | 0 .../zeronet/validations/security-council-signer-rollback.json | 0 .../config/zeronet/validations/security-council-signer.json | 0 .../DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json | 0 .../560048/run-1787157386323.json | 0 .../SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json | 0 .../SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json | 0 .../SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json | 0 .../script/DeployNitroValidatorStack.s.sol | 0 .../script/DeployTEEProverRegistryImpl.s.sol | 0 .../script/SetTEEProverRegistryImpl.s.sol | 0 17 files changed, 0 insertions(+), 0 deletions(-) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol (100%) rename {archive/evm => active/evm/tasks}/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol (100%) diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/.env diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/README.md diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer-rollback.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/base-signer.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer-rollback.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/validations/security-council-signer.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployNitroValidatorStack.s.sol/560048/run-1787156234845.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/DeployTEEProverRegistryImpl.s.sol/560048/run-1787157386323.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175280444.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175385343.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/records/SetTEEProverRegistryImpl.s.sol/560048/run-1787175698595.json diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployTEEProverRegistryImpl.s.sol diff --git a/archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol similarity index 100% rename from archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/SetTEEProverRegistryImpl.s.sol From a3a25fc54fad3250802bff2313c73d95733d6f4b Mon Sep 17 00:00:00 2001 From: Leopold Joy Date: Thu, 20 Aug 2026 02:15:41 +0100 Subject: [PATCH 2/4] feat(sepolia): add Nitro validator cutover config Co-authored-by: OpenCode --- .../FACILITATOR.md | 48 +++++++++---------- .../Makefile | 4 +- .../config/sepolia/.env | 11 +++++ .../config/sepolia/README.md | 28 +++++++++++ .../{ => config/zeronet}/addresses.json | 0 5 files changed, 65 insertions(+), 26 deletions(-) create mode 100644 active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env create mode 100644 active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md rename active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/{ => config/zeronet}/addresses.json (100%) diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md index 66dc47bb..3a7af402 100644 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md @@ -1,12 +1,12 @@ # Facilitator Guide -Guide for deploying the hinted Nitro validator stack and upgrading the Zeronet TEE registry. +Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry. The active rollout is Sepolia; completed Zeronet artifacts remain in `config/zeronet/` and `records/`. ## 1. Install dependencies ```bash cd active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator -make deps +make TASK_NETWORK=sepolia deps ``` ## 2. Deploy contracts @@ -14,26 +14,26 @@ make deps Use the normal funded personal Ledger account: ```bash -make deploy-nitro-validator -VERIFIER_API_KEY= make verify-nitro-validator -make deploy-tee-registry-impl -VERIFIER_API_KEY= make verify-tee-registry-impl +make TASK_NETWORK=sepolia deploy-nitro-validator +VERIFIER_API_KEY= make TASK_NETWORK=sepolia verify-nitro-validator +make TASK_NETWORK=sepolia deploy-tee-registry-impl +VERIFIER_API_KEY= make TASK_NETWORK=sepolia verify-tee-registry-impl ``` -This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `addresses.json` and deployment records to `records/`. +This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `config/sepolia/addresses.json` and deployment records to `records/` under chain ID `11155111`. -Review and commit `addresses.json` and the timestamped deployment records before generating validations. +Review and commit `config/sepolia/addresses.json` and the timestamped deployment records before generating validations. Do not modify the executed Zeronet artifacts. ## 3. Generate forward and rollback validations ```bash -make gen-validation-cb -make gen-validation-sc -make gen-validation-cb-rollback -make gen-validation-sc-rollback +make TASK_NETWORK=sepolia gen-validation-cb +make TASK_NETWORK=sepolia gen-validation-sc +make TASK_NETWORK=sepolia gen-validation-cb-rollback +make TASK_NETWORK=sepolia gen-validation-sc-rollback ``` -For Zeronet, remove each generated `taskOriginConfig` and add this root field: +For Sepolia, remove each generated `taskOriginConfig` and add this root field: ```json "skipTaskOriginValidation": true @@ -43,26 +43,26 @@ Commit the four validation files after reviewing their state diffs. Record the current nonces for `PROXY_ADMIN_OWNER`, `CB_MULTISIG`, and `BASE_SECURITY_COUNCIL`. Do not allow unrelated transactions from those Safes during the cutover. Regenerate all validations if any nonce changes unexpectedly. -Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8` to the implementation in `addresses.json`. +Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `0xF9Ab55c35cE7Fb183A50E611B63558499130D849` to the implementation in `config/sepolia/addresses.json`. -Expected rollback state change: the same slot changes from the new implementation back to `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8`. +Expected rollback state change: the same slot changes from the new implementation back to `0xF9Ab55c35cE7Fb183A50E611B63558499130D849`. ## 4. Collect signatures -Ask signers to run `make sign-task` from the repository root and select this task. Collect signatures for all four validation files before cutover. +Ask signers to run `make sign-task` from the repository root and select the Sepolia entry for this task. Collect signatures for all four validation files before cutover. ## 5. Prepare the offchain cutover -Confirm the migrated registrar uses signer `0x5F109182a097c40Cc936742be4B55c1A08aC4dd9` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks. +Confirm the migrated registrar uses signer `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks. Keep the existing registrar and enclaves available for rollback. Stop the old registrar immediately before executing the onchain upgrade. ## 6. Approve and execute the upgrade ```bash -SIGNATURES= make approve-cb -SIGNATURES= make approve-sc -make execute +SIGNATURES= make TASK_NETWORK=sepolia approve-cb +SIGNATURES= make TASK_NETWORK=sepolia approve-sc +make TASK_NETWORK=sepolia execute ``` ## 7. Start the migrated registrar @@ -74,13 +74,13 @@ Start the migrated registrar after the proxy upgrade. Rotate one enclave first s If the migrated registrar path fails, use the rollback signatures collected before cutover: ```bash -SIGNATURES= make approve-cb-rollback -SIGNATURES= make approve-sc-rollback -make execute-rollback +SIGNATURES= make TASK_NETWORK=sepolia approve-cb-rollback +SIGNATURES= make TASK_NETWORK=sepolia approve-sc-rollback +make TASK_NETWORK=sepolia execute-rollback ``` Restart the legacy registrar after the rollback. Do not decommission the legacy Nitro verifier in this task. ## 9. Verify and archive -Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update the signer README to `Status: [EXECUTED]()`, commit execution records, and run `make archive-task` from the repository root before merging the PR. +Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update the Sepolia signer README to `Status: [EXECUTED]()`, commit execution records, and run `make archive-task` from the repository root only after the Sepolia rollout is complete. diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile index c17e11d6..aeb35686 100644 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile @@ -1,7 +1,7 @@ include ../../../../Makefile include $(REPO_ROOT)/Multisig.mk -TASK_NETWORK ?= zeronet +TASK_NETWORK ?= sepolia PROJECT_DIR := $(abspath ../..) include $(REPO_ROOT)/config/$(TASK_NETWORK).env @@ -10,7 +10,7 @@ include config/$(TASK_NETWORK)/.env SIGNER_TOOL_PATH := $(REPO_ROOT)/signer-tool VALIDATIONS_DIR := $(CURDIR)/config/$(TASK_NETWORK)/validations RPC_URL := $(L1_RPC_URL) -ADDRESSES_JSON := $(CURDIR)/addresses.json +ADDRESSES_JSON := $(CURDIR)/config/$(TASK_NETWORK)/addresses.json DEPLOYER = $(shell $(MISE_EXEC) cast wallet address --ledger --mnemonic-derivation-path $(LEDGER_HD_PATH)) DEPLOY_NITRO_SCRIPT := tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol:DeployNitroValidatorStack diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env new file mode 100644 index 00000000..da361125 --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env @@ -0,0 +1,11 @@ +# https://github.com/base/contracts/commit/8897196c2a77b04fe69e47e158c6c112a936d65c +BASE_CONTRACTS_COMMIT=8897196c2a77b04fe69e47e158c6c112a936d65c +RECORD_STATE_DIFF=true + +# New CertManager custody. +CERT_MANAGER_OWNER=0x646132A1667ca7aD00d36616AFBA1A28116C770A +CERT_MANAGER_REVOKER=0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3 + +# Rollback anchors verified against Sepolia before task creation. +OLD_TEE_PROVER_REGISTRY_IMPL=0xF9Ab55c35cE7Fb183A50E611B63558499130D849 +OLD_NITRO_VERIFIER=0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72 diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md new file mode 100644 index 00000000..1453b695 --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md @@ -0,0 +1,28 @@ +# Upgrade TEE Registry to Hinted Nitro Validation + +Status: READY TO SIGN + +## Description + +Deploy the hinted Nitro validator stack and upgrade the existing `TEEProverRegistry` proxy to an implementation that validates registrations through it. + +The registry proxy and all existing signer, proposer, owner, manager, game type, and image-hash storage remain unchanged. + +## Custody + +| Role | Address | +| -- | -- | +| `CertManager` owner | `0x646132A1667ca7aD00d36616AFBA1A28116C770A` | +| `CertManager` revoker | `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` | +| ProxyAdmin owner | `0x0fe884546476dDd290eC46318785046ef68a0BA9` | +| TEE registry proxy | `0xf0d7E15673fBA052e83d7f2b26BB6071E86b972e` | + +## Sign + +From the repository root: + +```bash +make sign-task +``` + +Select this Sepolia task and sign both the forward and rollback transactions. Send the signatures to the facilitator. diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/addresses.json similarity index 100% rename from active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/addresses.json rename to active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/addresses.json From 7c4126d7107551e7824a89529f39d7a7dfde7f71 Mon Sep 17 00:00:00 2001 From: Leopold Joy Date: Thu, 20 Aug 2026 03:15:35 +0100 Subject: [PATCH 3/4] fix(active-evm): require explicit task network Co-authored-by: OpenCode --- .../FACILITATOR.md | 52 +++++++++---------- .../Makefile | 7 ++- .../config/sepolia/FACILITATOR.md | 25 +++++++++ .../config/zeronet/FACILITATOR.md | 23 ++++++++ 4 files changed, 78 insertions(+), 29 deletions(-) create mode 100644 active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md create mode 100644 active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md index 3a7af402..3eb005e3 100644 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md @@ -1,12 +1,12 @@ # Facilitator Guide -Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry. The active rollout is Sepolia; completed Zeronet artifacts remain in `config/zeronet/` and `records/`. +Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry on a selected network. Read `config/NETWORK_NAME/FACILITATOR.md` first, then replace `NETWORK_NAME` in every command below with that network, for example `sepolia`. ## 1. Install dependencies ```bash cd active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator -make TASK_NETWORK=sepolia deps +make TASK_NETWORK=NETWORK_NAME deps ``` ## 2. Deploy contracts @@ -14,55 +14,51 @@ make TASK_NETWORK=sepolia deps Use the normal funded personal Ledger account: ```bash -make TASK_NETWORK=sepolia deploy-nitro-validator -VERIFIER_API_KEY= make TASK_NETWORK=sepolia verify-nitro-validator -make TASK_NETWORK=sepolia deploy-tee-registry-impl -VERIFIER_API_KEY= make TASK_NETWORK=sepolia verify-tee-registry-impl +make TASK_NETWORK=NETWORK_NAME deploy-nitro-validator +VERIFIER_API_KEY= make TASK_NETWORK=NETWORK_NAME verify-nitro-validator +make TASK_NETWORK=NETWORK_NAME deploy-tee-registry-impl +VERIFIER_API_KEY= make TASK_NETWORK=NETWORK_NAME verify-tee-registry-impl ``` -This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `config/sepolia/addresses.json` and deployment records to `records/` under chain ID `11155111`. +This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `config/NETWORK_NAME/addresses.json` and chain-keyed deployment records under `records/`. -Review and commit `config/sepolia/addresses.json` and the timestamped deployment records before generating validations. Do not modify the executed Zeronet artifacts. +Review and commit the selected network's addresses and timestamped deployment records before generating validations. Do not modify artifacts from completed network rollouts. ## 3. Generate forward and rollback validations ```bash -make TASK_NETWORK=sepolia gen-validation-cb -make TASK_NETWORK=sepolia gen-validation-sc -make TASK_NETWORK=sepolia gen-validation-cb-rollback -make TASK_NETWORK=sepolia gen-validation-sc-rollback +make TASK_NETWORK=NETWORK_NAME gen-validation-cb +make TASK_NETWORK=NETWORK_NAME gen-validation-sc +make TASK_NETWORK=NETWORK_NAME gen-validation-cb-rollback +make TASK_NETWORK=NETWORK_NAME gen-validation-sc-rollback ``` -For Sepolia, remove each generated `taskOriginConfig` and add this root field: - -```json -"skipTaskOriginValidation": true -``` +Follow the selected network's facilitator notes for task-origin validation and expected state changes. Commit the four validation files after reviewing their state diffs. Record the current nonces for `PROXY_ADMIN_OWNER`, `CB_MULTISIG`, and `BASE_SECURITY_COUNCIL`. Do not allow unrelated transactions from those Safes during the cutover. Regenerate all validations if any nonce changes unexpectedly. -Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `0xF9Ab55c35cE7Fb183A50E611B63558499130D849` to the implementation in `config/sepolia/addresses.json`. +Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `OLD_TEE_PROVER_REGISTRY_IMPL` in `config/NETWORK_NAME/.env` to the implementation in `config/NETWORK_NAME/addresses.json`. -Expected rollback state change: the same slot changes from the new implementation back to `0xF9Ab55c35cE7Fb183A50E611B63558499130D849`. +Expected rollback state change: the same slot changes from the new implementation back to `OLD_TEE_PROVER_REGISTRY_IMPL`. ## 4. Collect signatures -Ask signers to run `make sign-task` from the repository root and select the Sepolia entry for this task. Collect signatures for all four validation files before cutover. +Ask signers to run `make sign-task` from the repository root and select the chosen network entry for this task. Collect signatures for all four validation files before cutover. ## 5. Prepare the offchain cutover -Confirm the migrated registrar uses signer `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks. +Confirm the migrated registrar uses the signer configured as `CERT_MANAGER_REVOKER` in `config/NETWORK_NAME/.env` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks. Keep the existing registrar and enclaves available for rollback. Stop the old registrar immediately before executing the onchain upgrade. ## 6. Approve and execute the upgrade ```bash -SIGNATURES= make TASK_NETWORK=sepolia approve-cb -SIGNATURES= make TASK_NETWORK=sepolia approve-sc -make TASK_NETWORK=sepolia execute +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-cb +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-sc +make TASK_NETWORK=NETWORK_NAME execute ``` ## 7. Start the migrated registrar @@ -74,13 +70,13 @@ Start the migrated registrar after the proxy upgrade. Rotate one enclave first s If the migrated registrar path fails, use the rollback signatures collected before cutover: ```bash -SIGNATURES= make TASK_NETWORK=sepolia approve-cb-rollback -SIGNATURES= make TASK_NETWORK=sepolia approve-sc-rollback -make TASK_NETWORK=sepolia execute-rollback +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-cb-rollback +SIGNATURES= make TASK_NETWORK=NETWORK_NAME approve-sc-rollback +make TASK_NETWORK=NETWORK_NAME execute-rollback ``` Restart the legacy registrar after the rollback. Do not decommission the legacy Nitro verifier in this task. ## 9. Verify and archive -Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update the Sepolia signer README to `Status: [EXECUTED]()`, commit execution records, and run `make archive-task` from the repository root only after the Sepolia rollout is complete. +Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update `config/NETWORK_NAME/README.md` to `Status: [EXECUTED]()` and commit execution records. Run `make archive-task` from the repository root only after every currently intended network rollout is complete. diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile index aeb35686..af29f0ba 100644 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile @@ -1,7 +1,12 @@ include ../../../../Makefile include $(REPO_ROOT)/Multisig.mk -TASK_NETWORK ?= sepolia +ifneq ($(origin TASK_NETWORK),command line) +$(error TASK_NETWORK must be set on the make command line; run make TASK_NETWORK=sepolia ) +endif +ifeq ($(strip $(TASK_NETWORK)),) +$(error TASK_NETWORK cannot be empty; run make TASK_NETWORK=sepolia ) +endif PROJECT_DIR := $(abspath ../..) include $(REPO_ROOT)/config/$(TASK_NETWORK).env diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md new file mode 100644 index 00000000..c7c77eeb --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md @@ -0,0 +1,25 @@ +# Sepolia Facilitator Notes + +Use `TASK_NETWORK=sepolia` for every command in the root facilitator guide. + +## Artifacts + +- Deployment addresses: `config/sepolia/addresses.json` +- Forge records chain ID: `11155111` +- Signer README and status: `config/sepolia/README.md` + +## Validation + +Remove each generated `taskOriginConfig` and add this root field to all four validation files: + +```json +"skipTaskOriginValidation": true +``` + +Confirm the forward validation changes the TEE registry implementation from `0xF9Ab55c35cE7Fb183A50E611B63558499130D849` to the implementation in `config/sepolia/addresses.json`. + +Confirm the rollback validation restores implementation `0xF9Ab55c35cE7Fb183A50E611B63558499130D849`, points back to legacy Nitro verifier `0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72`, and uses the planned post-upgrade Safe nonces. + +## Offchain Cutover + +Confirm the migrated registrar uses signer `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` for rollback. diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md new file mode 100644 index 00000000..eb29deca --- /dev/null +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md @@ -0,0 +1,23 @@ +# Zeronet Facilitator Notes + +Status: EXECUTED. Preserve these artifacts as historical records and do not regenerate the Zeronet validations. + +Use `TASK_NETWORK=zeronet` when inspecting the completed configuration. + +## Artifacts + +- Deployment addresses: `config/zeronet/addresses.json` +- Forge records chain ID: `560048` +- Signer README and status: `config/zeronet/README.md` + +## Validation + +The committed validation files already skip task-origin validation. + +The executed forward transition changed the TEE registry implementation from `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8` to the implementation in `config/zeronet/addresses.json`. + +The rollback configuration restores implementation `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8` and legacy Nitro verifier `0xDC06089B0224e59bAAa9B59c3C5aAF9Ff105997C`. + +## Offchain Cutover + +The migrated registrar uses signer `0x5F109182a097c40Cc936742be4B55c1A08aC4dd9` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` for rollback. From 455dfb21a587e66816b1a937b11432e715176f77 Mon Sep 17 00:00:00 2001 From: Leopold Joy Date: Thu, 20 Aug 2026 04:11:28 +0100 Subject: [PATCH 4/4] docs(active-evm): keep facilitator guide authoritative Co-authored-by: OpenCode --- .../FACILITATOR.md | 12 +++++++-- .../config/sepolia/FACILITATOR.md | 25 ------------------- .../config/zeronet/FACILITATOR.md | 23 ----------------- 3 files changed, 10 insertions(+), 50 deletions(-) delete mode 100644 active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md delete mode 100644 active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md index 3eb005e3..07fb944c 100644 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md +++ b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md @@ -1,6 +1,8 @@ # Facilitator Guide -Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry on a selected network. Read `config/NETWORK_NAME/FACILITATOR.md` first, then replace `NETWORK_NAME` in every command below with that network, for example `sepolia`. +Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry on a selected network. + +Before running anything, replace every literal `NETWORK_NAME` below with the selected config directory, for example `sepolia`. The Makefile has no default and rejects an inherited or exported `TASK_NETWORK`; every invocation must visibly use `make TASK_NETWORK= `. ## 1. Install dependencies @@ -33,7 +35,13 @@ make TASK_NETWORK=NETWORK_NAME gen-validation-cb-rollback make TASK_NETWORK=NETWORK_NAME gen-validation-sc-rollback ``` -Follow the selected network's facilitator notes for task-origin validation and expected state changes. +For a non-mainnet rollout, remove each generated `taskOriginConfig` and add this root field to all four validation files: + +```json +"skipTaskOriginValidation": true +``` + +For a mainnet rollout through the proxy admin owner, retain task-origin validation and collect the required task-origin signatures. Commit the four validation files after reviewing their state diffs. diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md deleted file mode 100644 index c7c77eeb..00000000 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/FACILITATOR.md +++ /dev/null @@ -1,25 +0,0 @@ -# Sepolia Facilitator Notes - -Use `TASK_NETWORK=sepolia` for every command in the root facilitator guide. - -## Artifacts - -- Deployment addresses: `config/sepolia/addresses.json` -- Forge records chain ID: `11155111` -- Signer README and status: `config/sepolia/README.md` - -## Validation - -Remove each generated `taskOriginConfig` and add this root field to all four validation files: - -```json -"skipTaskOriginValidation": true -``` - -Confirm the forward validation changes the TEE registry implementation from `0xF9Ab55c35cE7Fb183A50E611B63558499130D849` to the implementation in `config/sepolia/addresses.json`. - -Confirm the rollback validation restores implementation `0xF9Ab55c35cE7Fb183A50E611B63558499130D849`, points back to legacy Nitro verifier `0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72`, and uses the planned post-upgrade Safe nonces. - -## Offchain Cutover - -Confirm the migrated registrar uses signer `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` for rollback. diff --git a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md b/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md deleted file mode 100644 index eb29deca..00000000 --- a/active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/zeronet/FACILITATOR.md +++ /dev/null @@ -1,23 +0,0 @@ -# Zeronet Facilitator Notes - -Status: EXECUTED. Preserve these artifacts as historical records and do not regenerate the Zeronet validations. - -Use `TASK_NETWORK=zeronet` when inspecting the completed configuration. - -## Artifacts - -- Deployment addresses: `config/zeronet/addresses.json` -- Forge records chain ID: `560048` -- Signer README and status: `config/zeronet/README.md` - -## Validation - -The committed validation files already skip task-origin validation. - -The executed forward transition changed the TEE registry implementation from `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8` to the implementation in `config/zeronet/addresses.json`. - -The rollback configuration restores implementation `0x98ff839d2671bbaf6394bf03a496ea634f8a39c8` and legacy Nitro verifier `0xDC06089B0224e59bAAa9B59c3C5aAF9Ff105997C`. - -## Offchain Cutover - -The migrated registrar uses signer `0x5F109182a097c40Cc936742be4B55c1A08aC4dd9` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` for rollback.