Feature deterministic input outcomes and replay verification - #794
Merged
Conversation
Treat zero max-cycle settings as no operator-imposed cap while retaining the machine-enforced 2^48 execution window. Validate increments and ceilings consistently across the model, CLI, schema, and JSON-RPC discovery, and refuse startup when node and emulator computation-hash constants disagree.
Restrict canonical input history to deterministic completed statuses, reject incomplete results before opening a transaction, and persist guest exception payloads with matching model, JSON-RPC, schema, and repository invariants.
Validate canonical input hash-collection spans and index ranges before persistence, then stream rows through PostgreSQL COPY so full-span collections do not allocate a second multi-million-row statement representation.
Carry machine completion status and exception payloads through the manager and HTTP API. Distinguish deterministic guest outcomes from incomplete execution failures while preserving partial reports and sanitizing internal diagnostics.
vfusco
requested review from
mpolitzer and
renatomaia
and
a balanced review from Copilot
August 14, 2026 21:57
There was a problem hiding this comment.
Pull request overview
Introduces deterministic machine outcomes, atomic persistence, and replay verification for dispute-capable execution.
Changes:
- Restricts persisted outcomes to four guest-decided statuses.
- Adds canonical computation-hash collection and replay verification.
- Updates persistence, inspect APIs, validation, and build configuration.
Reviewed changes
Copilot reviewed 65 out of 65 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
Makefile |
Separates CGO and pure-Go builds. |
api/openapi/inspect.yaml |
Updates inspect response contract. |
cmd/cartesi-rollups-cli/root/app/execution-parameters/execution_parameters.go |
Refactors parameter output. |
cmd/cartesi-rollups-cli/root/app/execution-parameters/execution_parameters_test.go |
Tests cycle parameter output. |
internal/advancer/advancer.go |
Handles deterministic failures and persistence fencing. |
internal/advancer/service.go |
Validates emulator constants and readiness. |
internal/appstatus/appstatus.go |
Exposes reason normalization. |
internal/inspect/hardening_test.go |
Updates inspect test interfaces. |
internal/inspect/inspect.go |
Maps typed inspect outcomes to HTTP responses. |
internal/inspect/inspect_test.go |
Tests the revised inspect contract. |
internal/jsonrpc/execution_outcome_contract_test.go |
Verifies discovery schema changes. |
internal/jsonrpc/jsonrpc-discover.json |
Narrows statuses and documents exception data. |
internal/manager/errors.go |
Adds failure-durability error types. |
internal/manager/instance.go |
Applies typed outcomes and canonical hash handling. |
internal/manager/manager.go |
Integrates startup replay and application fencing. |
internal/manager/types.go |
Revises manager and inspect interfaces. |
internal/model/execution_parameters_test.go |
Tests cycle bounds and statuses. |
internal/model/input_hash_collection.go |
Defines computation-hash geometry. |
internal/model/input_hash_collection_test.go |
Tests collection dimensions and spans. |
internal/model/models.go |
Adds deterministic statuses and replay models. |
internal/model/models_json_test.go |
Tests exception-data serialization. |
internal/replay/compare.go |
Compares replayed and persisted evidence. |
internal/replay/compare_test.go |
Tests replay contradictions. |
internal/replay/run.go |
Implements paginated replay execution. |
internal/replay/run_test.go |
Tests replay sequencing and errors. |
internal/replay/types.go |
Defines replay errors and options. |
internal/repository/postgres/application.go |
Persists revised execution parameters. |
internal/repository/postgres/bulk.go |
Atomically stores completed results. |
internal/repository/postgres/db/rollupsdb/public/enum/inputcompletionstatus.go |
Regenerates the narrowed status enum. |
internal/repository/postgres/db/rollupsdb/public/table/input.go |
Adds the exception-data column mapping. |
internal/repository/postgres/input.go |
Reads persisted exception data. |
internal/repository/postgres/input_exception_data_test.go |
Tests exception constraints and immutability. |
internal/repository/postgres/postgres_repo_test.go |
Tests schema outcome constraints. |
internal/repository/postgres/replay.go |
Implements replay evidence queries. |
internal/repository/postgres/replay_source_test.go |
Tests replay verification levels. |
internal/repository/postgres/replay_test.go |
Tests replay and state-hash helpers. |
internal/repository/postgres/schema/migrations/000001_create_initial_schema.down.sql |
Updates baseline rollback operations. |
internal/repository/postgres/schema/migrations/000001_create_initial_schema.up.sql |
Updates the baseline deterministic schema. |
internal/repository/replay.go |
Defines the replay repository contract. |
internal/repository/replay_test.go |
Tests replay types and errors. |
internal/repository/repository.go |
Adds replay access to repositories. |
internal/repository/repotest/application_test_cases.go |
Updates execution-parameter tests. |
internal/repository/repotest/bulk_test_cases.go |
Tests atomic deterministic writes. |
internal/repository/repotest/epoch_test_cases.go |
Stores completed outcomes atomically in tests. |
internal/repository/repotest/input_test_cases.go |
Updates processed-input fixtures. |
internal/repository/repotest/repotest.go |
Adds valid exception fixtures. |
internal/repository/repotest/state_hash_test_cases.go |
Updates compressed hash collection tests. |
internal/validator/validator.go |
Uses shared computation-hash dimensions. |
internal/validator/validator_test.go |
Updates commitment geometry tests. |
pkg/emulator/types.go |
Exposes emulator rollup limits. |
pkg/inspectclient/generated.go |
Regenerates the inspect client contract. |
pkg/machine/backend.go |
Revises hash collector state. |
pkg/machine/computation_hash.go |
Defines machine computation-hash constants. |
pkg/machine/computation_hash_test.go |
Tests computation-hash dimensions. |
pkg/machine/doc.go |
Documents deterministic machine semantics. |
pkg/machine/libcartesi.go |
Validates emulator limits and collection responses. |
pkg/machine/libcartesi_test.go |
Tests backend validation and collection state. |
pkg/machine/machine.go |
Introduces typed completion outcomes. |
pkg/machine/machine_test.go |
Tests the revised machine contract. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mpolitzer
reviewed
Aug 17, 2026
mpolitzer
previously approved these changes
Aug 21, 2026
vfusco
force-pushed
the
feature/deterministic-input-outcomes
branch
from
August 21, 2026 16:40
8599d10 to
68b210f
Compare
renatomaia
approved these changes
Aug 21, 2026
mpolitzer
approved these changes
Aug 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR makes the node's persisted history deterministic — the foundation for the dispute-capable PRT node. The machine layer now returns only the four guest-decided outcomes (accepted, rejected, exception, halted) as results; everything else — cycle ceilings, deadlines, payload limits, emulator faults — travels as an error and is never persisted, so two nodes can no longer durably disagree about the same input. The database enforces the same rule with a narrowed status enum, atomic result writes, and immutability constraints, and a new replay engine re-executes stored history at startup, fencing any application whose records contradict actual execution while healthy applications continue. Machine state storage and recovery (snapshots, retention, state serving) is deliberately out of scope and follows in a separate changeset.