nv16 development checklist

[raulk]

Required for feature freeze

🎉 Feature freeze is complete!

These are issues that affect code running in production.

• Refactor go-based state accessors (@arajasek)
  • 🟢  Not consensus breaking
  • Agree on the new design: Discussion: State Types refactor lotus#8607
  • Land:
    • Use new go-state-types state accessors lotus#8534
    • Use new go-state-types state accessors go-state-types#36 (needed by all other PRs)
    • Use new go-state-types state accessors specs-storage#25
    • Use new go-state-types state accessors specs-actors#1590
    • Use new go-state-types state accessors filecoin-ffi#269
    • Use new go-state-types state accessors go-fil-markets#705 (also needs FFI)
• Catch panics (@Stebalien)
  • 🔴  Consensus breaking
  • catch panics inside Wasm and lower to fatal errors. #557
  • catch additional panics #574
  • Anything arising from crypto calls
  • verify_post assumes that passed-in randomness is exactly 32 bytes in length.
  • catch panics anywhere that assumes that the passed-in buffer is exactly 32 bytes in length #651
    • verify_post
    • verify_aggregate_seals
    • verify_seal
• Merge breaking syscall changes to master (@raulk)
  • 🔴  Consensus breaking
  • Feature branch: https://github.com/filecoin-project/ref-fvm/tree/feat/syscall-changes
  • merge syscall changes to master #533
  • A series of syscall-related cleanups #555, which includes:
    • ipld::read does not use offset properly #542
      • 🟢  Not consensus breaking (for M1; non-zero offsets aren't used)
• Clarify documentation / fix IPLD syscall errors #543
  • 🟡 Could be consensus breaking
• Determine stack size limit approach #552
  • 🟡 Could be consensus breaking
• Lotus: final bundling strategy (@vyzo + @raulk + @arajasek)
  • 🟢  Not consensus breaking
  • [nv16] dynamic loading of builtin actor bundles lotus#8642
  • Sever ffi dependency on built-in actors
  • Get rid of environment variable dance
  • Static and dynamic bundle loading
• Second pass of wasmtime configuration review
  • 🟡 Probably not consensus breaking, but depends on config flags ultimately adjusted
  • chore: Second pass on wasmtime config #547.
• Propagate gas outputs (@vyzo)
  • 🟢  Not consensus breaking
  • propagate all gas outputs in ApplyRet filecoin-ffi#275
  • propagate all gas outputs in ApplyRet #526
  • [nv16] propagate gas outputs from fvm + integrate safer ffi lotus#8593
• Fatal error handling as generic exit code (@raulk)
  • 🔴  Consensus breaking
  • transmute fatal errors into SYS_ASSERTION_FAILED exit code. #548.
  • produce a consensus outcome for fatal errors #508
• Implement parameters for FIP-0032 (@raulk)
  • 🔴  Consensus breaking
• feat: optimize static message information into a single syscall #509
  • 🔴  Consensus breaking
• Audit third party dependencies (@dignifiedquire)
  • 🔴  Consensus breaking for changes in actors (changes Code CID)
  • fix: remove unused chrono dep #532
  • fix: remove unused ahash dep builtin-actors#329
• Switch CBOR library
  • 🔴  Consensus breaking (changes Code CID)
  • ipld/encoding: switch to cbor4ii #472
• Wasm bytecode instrumentation (@magik6k)
  • 🔴  Consensus breaking
  • feat: fvm-wasm-instrument stack limiter and gas #494
  • Gas accounting (closes Wasmtime fuel accounting edge cases)
  • Stack accounting (closes Wasmtime stack accounting)
• Lotus: Gas estimation around upgrade (@arajasek + @Kubuxu)
  • 🟢  Not consensus breaking
  • Gas Estimation around NV16 lotus#8417
• Improve FFI safety (@dignifiedquire)
  • 🟢  Not consensus breaking
  • fix: improve ffi safety filecoin-ffi#247
• 🔴 Update serde_ipld_dagcbor to include ipld/serde_ipld_dagcbor@cf04a87.
• 🔴 ipld::block_read bug fix: fix read syscall and sdk method #584

Releases

• Actors v8 release
• Actors v7 release
• fvm crates release
• ffi release
• Lotus release

Not required for feature freeze

Fixes from these efforts will be included in bugfix releases.

• Size limits on actors data structures (user-input and tree) (needs new owner)
  • Naturally limited by message params.
  • 🔴  Consensus breaking
  • CBOR gen applies imipicits limits to everything, we don't. is it an issue?
• Getting itests passing (@vyzo)
  • 🟡 Consensus breaking if changes made in actors
• Test integration framework
  • 🟢  Not consensus breaking
  • Integration test framework: Initial PR #471
• Correctness tests using test integration framework
  • 🟢  Not consensus breaking
  • A initial set of integration tests have been contributed, targeting various Areas of Concern.
• Fuzzing CBOR and IPLD targets (@Kubuxu)
  • 🟢  Not consensus breaking
• builtin-actors (Rust): 1:1 unit test parity with specs-actors (Go) (@ZenGround0 + @lemmih)
  • 🟢  Not consensus breaking
• builtin-actors (Rust): 1:1 integration test parity with specs-actors (Go) (@ZenGround0)
  • 🟢  Not consensus breaking
• Internal audit.
  • 🟢  Not consensus breaking
• External audit.
  • 🟢  Not consensus breaking
• Ensure syscall cbor-unmarshal errors are highly visible to implementers #544
  • 🟢  Not consensus breaking
• Write down the FVM <-> client expectations #737
  • 🟢  Not consensus breaking
• compute-state --html error
  • 🟢  Not consensus breaking
• Fully-featured development bundles
• 🟡 Double-check panic catching, especially with respect to cbor decoding and crypto (inside the FVM, not inside wasm).
• 🟡 Double-check wasmtime error handling, possibly treating all errors as illegal instruction (instead of fatal).
• Dual execution for debugging actors
  • 🟢 Not consensus breaking

[ZenGround0]

Actors bugs that need to be fixed/investigated/merged by feature freeze:

• Map delete behavior issu
• Paych limits PR
• Record faults bug fix PR
• Remove partitions bug fix PR

While its fine to discover and fix new bugs after freeze I think we should not call feature freeze when known actors bugs exist.