test(localnet): deploy + vote the tee-verifier in the cluster script by barakeinav1 · Pull Request #3888 · near/mpc

barakeinav1 · 2026-07-21T17:19:05Z

Closes #3887 (script + doc portion).

Adds TEE verifier support to the localnet TDX deploy so the verifier path can be exercised on a real cluster (the account voting vote_tee_verifier_change is already on main; the async verify_quote wiring lands with #3714):

deploy_verifier (in the near_contract phase): builds crates/tee-verifier (or reuses TEE_VERIFIER_PATH), creates tee-verifier.<root>, deploys the wasm (stateless, no init).
vote_tee_verifier_threshold (right after init, while Initializing): each node account votes vote_tee_verifier_change committing to the wasm sha256, crossing threshold so the verifier is trusted before keygen finishes.
VERIFIER_TERA_GAS_OVERRIDE (opt-in): sets init_config.verifier_tera_gas. Off by default so this stays valid on main (no such InitConfig field there yet); needed once feat(contract): async TEE attestation verification, drop dcap-qvl #3714 lands, since real dcap_qvl::verify burns ~173 Tgas and the contract's 100 default OOGs the cross-call.
A how-to doc: localnet/tee/scripts/rust-launcher/how-to-test-tee-verifier-e2e.md.

Verified end-to-end on a localnet TDX cluster (stock release-v3.13 node + a #3714 contract): both nodes attested as Dstack (get_attestation → Dstack), contract reached Running, and an ECDSA sign succeeded. Full context in #3887.

Follow-up (tracked in #3887): a sandbox/e2e test that runs verify_quote at production gas against a valid quote (see #3715).

Adds deploy_verifier (build/create/deploy tee-verifier) and vote_tee_verifier_threshold (vote_tee_verifier_change from threshold participants during Initializing) to deploy-tee-cluster.sh, plus a how-to doc. Optional VERIFIER_TERA_GAS_OVERRIDE sets init_config.verifier_tera_gas (off by default; needed once #3714 lands). Refs #3887, #3642.

claude · 2026-07-21T17:20:34Z

PR title type suggestion: This PR changes development infrastructure scripts and documentation, not test code itself. The type prefix should probably be chore: instead of test:.

Suggested title: chore(localnet): deploy + vote the tee-verifier in the cluster script

claude · 2026-07-21T17:23:22Z

Pull request overview

Extends the localnet TDX deploy script (deploy-tee-cluster.sh) with an automated flow that (a) builds/deploys the standalone tee-verifier contract into a fresh subaccount, (b) commits every voter to the wasm sha256 via vote_tee_verifier_change right after init_contract, and (c) optionally injects init_config.verifier_tera_gas once #3714 lands. Adds a companion how-to doc. No production Rust or contract code changes.

Changes:

New deploy_verifier step in the near_contract phase — builds crates/tee-verifier (or reuses TEE_VERIFIER_PATH), creates tee-verifier.<root>, deploys the wasm without an init call.
New vote_tee_verifier_threshold step in the near_init phase — first threshold node accounts call vote_tee_verifier_change with the sha256 as expected_code_hash.
Opt-in VERIFIER_TERA_GAS_OVERRIDE env var — injected into init_args.json only when set, keeping the payload valid on main.
New how-to doc: localnet/tee/scripts/rust-launcher/how-to-test-tee-verifier-e2e.md.

Reviewed changes

Per-file summary

File	Description
localnet/tee/scripts/rust-launcher/deploy-tee-cluster.sh	Adds `TEE_VERIFIER_ACCOUNT` var, `build_verifier` / `deploy_verifier` / `vote_tee_verifier_threshold` functions, wires them into `near_contract` and `near_init` phases; optional `verifier_tera_gas` in the init-args Python heredoc.
localnet/tee/scripts/rust-launcher/how-to-test-tee-verifier-e2e.md	How-to for exercising the verifier path on a localnet TDX cluster: what the script does, verification RPCs, and the gas-budget note for #3714.

Findings

Non-blocking (nits, follow-ups, suggestions):

localnet/tee/scripts/rust-launcher/deploy-tee-cluster.sh:1197-1201 — On a resume that starts at near_init in a fresh shell, both TEE_VERIFIER_HASH and TEE_VERIFIER_PATH are unset (they're exported by build_verifier, which only ran in a previous shell), and the phase aborts with TEE_VERIFIER_HASH unset and no TEE_VERIFIER_PATH wasm to hash. Consider falling back to the default post-build path when TEE_VERIFIER_PATH is unset:
```
if [ -z "${TEE_VERIFIER_PATH:-}" ]; then
  TEE_VERIFIER_PATH="$(pwd)/target/near/tee_verifier/tee_verifier.wasm"
fi
```
Alternatively, document explicitly that TEE_VERIFIER_PATH must be re-exported on any resume that skips near_contract.
localnet/tee/scripts/rust-launcher/how-to-test-tee-verifier-e2e.md:20 — Doc says "every node account calls vote_tee_verifier_change", but deploy-tee-cluster.sh:1203 loops for i in $(seq 0 $((threshold-1))), i.e. only the first threshold accounts. Behavior is correct (threshold votes suffice), but the wording drifts. Suggest: "the first threshold node accounts call…".
localnet/tee/scripts/rust-launcher/how-to-test-tee-verifier-e2e.md:24-26 — "authenticate_update_vote allows voting in both Initializing and Running, so voting during Initializing is intentional…" is slightly off: vote_tee_verifier_change (crates/contract/src/lib.rs:1618-1651) does not call authenticate_update_vote; it uses threshold_parameters_or_panic() + AuthenticatedParticipantId::new() directly, which additionally works in Resharing and only panics on NotInitialized. Consider phrasing this in terms of the actual gate ("the vote only panics in NotInitialized, so Initializing is fine").
localnet/tee/scripts/rust-launcher/deploy-tee-cluster.sh:1185 — "5 NEAR" for the verifier account balance is hardcoded; the neighboring MPC_CONTRACT_ACCOUNT / node accounts use CONTRACT_INITIAL_BALANCE / NODE_INITIAL_BALANCE env overrides. A VERIFIER_INITIAL_BALANCE="${VERIFIER_INITIAL_BALANCE:-5 NEAR}" keeps the style consistent.
localnet/tee/scripts/rust-launcher/deploy-tee-cluster.sh:1113-1115 — If a user sets VERIFIER_TERA_GAS_OVERRIDE to a non-numeric string, int(_vtg) raises ValueError mid-heredoc and the error surfaces as a raw Python traceback under set -euo pipefail. Consider a shell-side check with a clearer message (e.g. [[ "$VERIFIER_TERA_GAS_OVERRIDE" =~ ^[0-9]+$ ]] || { err "VERIFIER_TERA_GAS_OVERRIDE must be numeric"; exit 1; }).
localnet/tee/scripts/rust-launcher/deploy-tee-cluster.sh:1163,1215 — The # --- TEE verifier … --- / matching # --- divider lines are noise; the function docstrings above each fn already delimit the section. Nit.

✅ Approved

Copilot

Pull request overview

Adds support for deploying and adopting the standalone tee-verifier contract in the localnet TDX cluster deploy flow, so developers can exercise the verifier-based attestation path on real hardware. This aligns the localnet tooling with the planned async verify_quote flow and documents the required gas budget override for real DCAP verification workloads.

Changes:

Extend deploy-tee-cluster.sh to build/deploy crates/tee-verifier and vote it in via vote_tee_verifier_change during Initializing.
Add an opt-in VERIFIER_TERA_GAS_OVERRIDE that injects init_config.verifier_tera_gas into the init args when set.
Add a how-to doc for running/verifying the verifier-enabled e2e flow on a localnet TDX cluster.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
localnet/tee/scripts/rust-launcher/deploy-tee-cluster.sh	Builds + deploys `tee-verifier`, votes it in at threshold, and supports an optional verifier gas override in init args.
localnet/tee/scripts/rust-launcher/how-to-test-tee-verifier-e2e.md	Documents the deploy/vote/verify workflow and the verifier gas budget note for the async attestation path.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+2. **`vote_tee_verifier_threshold`** (right after `init`, while the contract is
+   `Initializing`) — every node account calls `vote_tee_verifier_change`
+   committing to the wasm's sha256 as `expected_code_hash`, crossing threshold so
+   the verifier account is trusted before keygen finishes.


+_vtg = "${VERIFIER_TERA_GAS_OVERRIDE:-}"
+if _vtg:
+    init["init_config"] = {"verifier_tera_gas": int(_vtg)}


+  export TEE_VERIFIER_HASH="$(sha256sum "$TEE_VERIFIER_PATH" | awk '{print $1}')"
+  log "TEE_VERIFIER_PATH=$TEE_VERIFIER_PATH"
+  log "TEE verifier sha256 (expected_code_hash): $TEE_VERIFIER_HASH"


+  if [ -z "${TEE_VERIFIER_HASH:-}" ]; then
+    [ -n "${TEE_VERIFIER_PATH:-}" ] && [ -f "$TEE_VERIFIER_PATH" ] \
+      || { err "TEE_VERIFIER_HASH unset and no TEE_VERIFIER_PATH wasm to hash"; exit 1; }
+    export TEE_VERIFIER_HASH="$(sha256sum "$TEE_VERIFIER_PATH" | awk '{print $1}')"
+  fi


barakeinav1 · 2026-07-22T11:51:15Z

Superseded by the move to mpc-private instead of adding more script logic to the public repo. The verifier deploy+vote steps + opt-in gas override are now in near/mpc-private#495 (tracked by #3894); this PR's mpc-side removal is #3895. Closing.

Removes the TEE cluster deploy/test scripts (deploy-tee-cluster.sh, set-*-env.sh, create-and-sweep-to-treasury.sh, test-migration.sh, test-verify-and-upgrade.sh, test-hash-override.sh, how-to-run doc); they now live in near/mpc-private tools/tee-cluster and run against a local mpc checkout via MPC_REPO_ROOT. Keeps single-node.sh (+ readme), common.sh and the templates here (the moved scripts reference them via MPC_REPO_ROOT; single-node.sh generates the Rust test fixtures). Repoints the testnet setup guide and trims the rust-launcher README accordingly. Replaces #3888.

Copilot AI review requested due to automatic review settings July 21, 2026 17:19

Copilot started reviewing on behalf of barakeinav1 July 21, 2026 17:19 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

This was referenced Jul 22, 2026

Move TEE cluster deploy/test scripts from mpc to mpc-private #3894

Closed

chore(tee): move cluster deploy/test scripts to mpc-private #3895

Merged

barakeinav1 closed this Jul 22, 2026

barakeinav1 deleted the test/localnet-deploy-tee-verifier branch July 22, 2026 11:51

Navigation Menu

Uh oh!

test(localnet): deploy + vote the tee-verifier in the cluster script - #3888

test(localnet): deploy + vote the tee-verifier in the cluster script#3888
barakeinav1 wants to merge 1 commit into
mainfrom
test/localnet-deploy-tee-verifier

barakeinav1 commented Jul 21, 2026

Uh oh!

claude Bot commented Jul 21, 2026

Uh oh!

claude Bot commented Jul 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

barakeinav1 commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

barakeinav1 commented Jul 21, 2026

Uh oh!

claude Bot commented Jul 21, 2026

Uh oh!

claude Bot commented Jul 21, 2026

Pull request overview

Reviewed changes

Findings

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

barakeinav1 commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants