Route admin Configure* messages via DAL + unblock sandbox smoke

[saroupille]

Summary

Restores a working path for admin configuration messages and re-enables the E2E sandbox smoke against current Octez + protocol Alpha. Three regressions introduced in recent commits are addressed; the first (admin config size) is the central one, the others are sandbox-side catch-up. Adds a variant-exhaustive regression test so the next size regression fails at compile time rather than at deploy time.

Bug 1 — ConfigureVerifier / ConfigureBridge exceed the L1 inbox size limit (central)

Symptom. Since 2c45d9c ("Harden rollup config and operator auth") added WOTS signatures to the two admin messages, their serialized size grew past sc_rollup_message_size_limit = 4096 (Tezos protocol constant):

Message	Serialized size (bytes)
ConfigureVerifier	4923
ConfigureBridge	4835

octez-client send smart rollup message enforces this limit and refuses to inject. Admin config is therefore unreachable via the direct L1 inbox path — the only path previously used. No test caught this at merge time (the 288 unit tests don't exercise the L1 path; the E2E sandbox smoke was broken for unrelated reasons and masked the issue).

Fix (commit eae8c6a). Extend the existing DAL routing (already used for large Shield/Transfer/Unshield payloads) to cover both admin variants:

• core/src/kernel_wire.rs
  • KernelDalPayloadKind gains ConfigureVerifier (wire tag 3) and ConfigureBridge (wire tag 4). A comment clarifies that these tags are independent of WireKernelInboxMessage tags.
  • KERNEL_WIRE_VERSION bumped 9 → 10, so older clients that see a DalPointer with kind ∈ {3, 4} get a clean envelope-version error instead of an opaque tag-decode failure.
  • Size sentinels configure_verifier_serialized_size_sentinel (4923) and configure_bridge_serialized_size_sentinel (4835): they assert > 4096 today and fail loudly if the encoding drifts, forcing a review of DAL-routing assumptions.
• tezos/rollup-kernel/src/lib.rs
  • fetch_kernel_message_from_dal handles the two new kinds. Dispatch match is now compile-exhaustive on KernelDalPayloadKind (no _ arm): any future variant is a compile error until handled here.
  • Docstring explains the kind-vs-content check is defense-in-depth; authenticity comes from the WOTS signature / STARK proof inside the payload — DAL is a public bulletin board.
• tezos/rollup-kernel/src/bin/octez_kernel_message.rs
  • configure-verifier-payload and configure-bridge-payload subcommands emit the raw unframed hex (the input to chunking + DAL publish).
  • dal-pointer accepts configure_verifier and configure_bridge kind tokens.
  • When TZEL_ROLLUP_CONFIG_ADMIN_ASK_HEX is unset in debug builds, the fallback to the public dev ask now emits an eprintln! warning.
• tezos/rollup-kernel/build.rs (new)
  • Emits cargo:rerun-if-env-changed= for the three admin env vars read via option_env!(). Without this, cargo's fingerprint misses env-var changes → rotating admin material can silently reuse a cached WASM baked with the old pub_seed → kernel silently rejects every admin signature. The build.rs doc block describes this failure mode end-to-end.

Operator and wallet-server are intentionally left unchanged. By design, admin config flows directly from an admin's octez_kernel_message + octez-client (admin's own L1 key + WOTS ask), never through the user-facing operator API. This keeps the operator surface narrow, preserves admin availability independent of operator health, and prevents a bearer-token leak from granting the ability to inject admin configs.

Documented end-to-end in tezos/rollup-kernel/README.md (commit 1a95bd5).

Bug 2 — Sandbox smoke broken on current Octez / protocol

Three independent breakages in the same smoke script (scripts/octez_rollup_sandbox_dal_smoke.sh), all surfaced while bringing up the Bug 1 repro. Commit aa31ccd.

1. attestation_lags vs attestation_lag. Recent protocol Alpha validates that dal_parametric.attestation_lags (plural, per-level list) contains the attestation_lag (singular, sandbox constant). Default mockup ships [1, 2, 3, 4, 5]; our sandbox sets attestation_lag = 2 for speed. Protocol activation errors with a size mismatch. Fix: force attestation_lags = [attestation_lag] during build_alpha_sandbox_params.

2. Admin material not baked into kernel WASM. prepare_rollup_config_admin.sh generates a runtime ask plus the build-time env vars the kernel bakes via option_env!(). The smoke never called it, so release-profile kernels were built with compiled_config_admin_pub_seed() == Err(_) and silently rejected every admin signature. Fix: call prepare_rollup_config_admin.sh in build_kernel_and_tools and source the env files before the kernel build (with set -a bracketing, commented with a "do not copy to production runners" caveat).

3. xxd -ps -c 0 wraps at 60 chars. The xxd shipped with current vim-common ignores -c 0 and wraps output at 60 hex chars. Embedded newlines corrupted the hex payloads passed to octez-client send smart rollup message. Fix: pipe through | tr -d '\n' in all three call sites (await_bridge_ticketer, deposit_to_bridge, and the main balance-key computation).

Bug 3 — Sandbox catch-up for bde1347 (apply_shield producer notes)

Two smaller regressions from bde1347 ("Add burned rollup fees and DAL producer note outputs") that were masked by Bug 1 (the smoke never got past configure-verifier). Commit a60c929:

• apply_shield now debits v + fee + producer_fee from the sender's balance (was v only). Fixture metadata exposed only shield_amount = fixture.shield.v, so the sandbox deposit fell short by fee + producer_fee. Renamed the metadata field to shield_bridge_deposit and compute it as v + fee + producer_fee (500_001 mutez instead of 400_000 for the checked-in fixture).
• apply_shield appends 2 notes per shield (cm + producer_cm). Sandbox still asserted tree_size == 1. Updated to 2.

The tutorial in docs/shadownet_tutorial.md was affected by the same math mismatch: the shield step deposited 300000 mutez and shielded 200000 mutez, which covered v + burn exactly but left the shield short by the DAL-producer fee. Bumped deposit to 300001 with an explanatory paragraph (commit 3412e0c).

Regression prevention — variant-exhaustive framed-size invariant

Commit 7c08ede adds inbox_size_invariant_covers_all_variants in core/src/kernel_wire.rs::tests. It classifies each KernelInboxMessage variant as FitsL1 or RequiresDal via an exhaustive match (no _ arm), then asserts that the framed on-wire size — unframed bytes + 21 B ExternalMessageFrame::Targetted overhead — matches the classification. Two-sided: a FitsL1 variant growing past 4096 fails; a RequiresDal variant shrinking below 4096 fails too (dead DAL plumbing).

This closes the hole that let 2c45d9c break admin config silently. The existing 288 unit tests didn't exercise the size invariant, and the two size sentinels (configure_*_serialized_size_sentinel) had to be written after the regression surfaced. The new test is structural — any future variant author is forced, at compile time, to classify the new variant before merge.

The sentinels are retained on top of the invariant: they pin exact byte counts (4923, 4835) and catch sub-threshold drift that the invariant's > 4096 bound would miss (e.g. a new optional field in KernelVerifierConfig that shifts size from 4923 → 4987 without crossing any limit).

Code cleanup (adversarial review follow-ups landed in-PR)

• refactor(kernel): the five near-identical arms of the DAL kind-vs-content dispatcher in fetch_kernel_message_from_dal are collapsed into a single boolean check plus one shared error branch. Compile-time exhaustiveness on KernelDalPayloadKind is preserved (no _ arm), so any future variant still compile-breaks until classified. Net -37 / +18 lines, same behaviour, same error message. Commit 8515b32.
• chore(wallet, kernel-readme): kernel_message_kind no longer folds admin Configure* messages into RollupSubmissionKind::Withdraw (they are now unreachable!() with a pointer to the admin CLI); the kernel README step 3 of "Adding a new oversized message type" is rewritten to split user-facing payloads (via operator) from admin-signed payloads (direct octez_kernel_message + octez-client) and cross-reference the new variant-exhaustive test. Commit 390aaaa.

Verification

Full E2E smoke passes end-to-end on current Octez (24.0~rc1+dev) + protocol Alpha:

$ ./scripts/octez_rollup_sandbox_dal_smoke.sh
...
octez rollup sandbox DAL smoke passed
rollup=sr18J7twH6WGpUESoEaPgDLpD1dDfweaPpGs
ticketer=KT1XVsMuAAFuy3Pk85ND8a3mpxoezDsGkRZW

Full flow exercised: configure-verifier via DAL → configure-bridge via DAL → bridge deposit → public balance credit → shield via DAL → public balance drain → shielded note insertion (tree size = 2).

cargo test --workspace --lib → 288 passed (+ 1 new test).

Test plan

• cargo test -p tzel-core --lib passes (72 tests; includes the new invariant + the two existing sentinels)
• cargo build --workspace exit 0
• ./scripts/octez_rollup_sandbox_dal_smoke.sh passes end-to-end on current Octez
• CI workflow runs once CI is unblocked by fix(ci): repair OCaml and cross-impl interop jobs #2

Open questions / follow-ups

Open questions (not addressed in this PR, need a team call):

• scripts/octez_rollup_sandbox_smoke.sh (non-DAL) and its Rust wrapper tezos/rollup-kernel/tests/octez_sandbox.rs are broken by Bug 1 — their only flow is send_configure_bridge_message via direct L1 inbox, which now exceeds 4096 bytes. The DAL smoke exercises a strict superset (configure-bridge + configure-verifier + deposit + shield). Question for reviewers: delete the non-DAL smoke (redundant), migrate it to DAL (duplicates the DAL smoke), or keep as a documentation-only marker?

• scripts/shadownet_live_e2e_smoke.sh (the live shadownet smoke) is broken by both Bug 1 and Bug 3:

  • init_profile() does not pass --dal-fee / --dal-fee-address to init-shadownet, which became required arguments.
  • Even with dal_fee = 1, the hardcoded TZEL_SMOKE_DEPOSIT_AMOUNT = 300000 / TZEL_SMOKE_SHIELD_AMOUNT = 200000 leaves the shield debit (200000 + 100000 + 1 = 300001) short by 1 mutez.
    The fix is more invasive than the sandbox fix (needs a generated DAL producer address + operator fee-policy alignment), so tracking as a separate follow-up rather than expanding this PR's scope.

Follow-ups (not blocking this PR):

• Path-scoped DAL smoke job in .github/workflows/unit-tests.yml (triggered on changes to core/src/kernel_wire.rs, tezos/rollup-kernel/src/**, scripts/octez_rollup_sandbox_dal_smoke.sh). Not added here because CI is currently red on main; fix(ci): repair OCaml and cross-impl interop jobs #2 unblocks it.
• WOTS one-time property (reusing (ask, key_idx) leaks the private signing key) should be documented explicitly in the kernel README before any production signing workflow.
• Noise from Dal_attested_slots internal messages mis-routed through decode_kernel_inbox_message fallback (tezos/rollup-kernel/src/lib.rs:569) — harmless decode-error log spam, root cause is tezos-smart-rollup-encoding = 0.2.2 lacking protocol tags 4 and 5. Upstream the missing variants or scope the fallback to External messages only.

🤖 Generated with Claude Code