Cardano Updates

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

map_native_script was constructing u5c NativeScript::ScriptAll for the
babbage::NativeScript::ScriptAny arm, inverting the semantics ("any"
becomes "all"). The bug was pre-existing in the original lib.rs and got
copied into both v1alpha and v1beta during the dual-spec split.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Replaces v1alpha's "uncomment this fs::write block" pattern and v1beta's
ad-hoc REGEN_V1BETA_SNAPSHOT var with a single REGENERATE_SNAPSHOTS=1
toggle that overwrites both JSON snapshots in place. README documents it.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Bumps utxorpc-spec to 0.19 and exposes both `pallas_utxorpc::v1alpha`
and `pallas_utxorpc::v1beta` mappers. The crate root keeps re-exporting
v1alpha items (Mapper, spec) under the default `v1alpha` feature, so
existing call sites compile unchanged. v1beta is gated behind an
opt-in `v1beta` feature; both features are additive.

Shared mapping logic (~80% of the surface — all certificates, pparams,
plutus data, witnesses, scripts, blocks) lives in a single
`impl_cardano_mapper_shared!` macro instantiated once per version. Methods
that diverge between specs (map_native_script, map_tx_datum, map_tx_output,
map_asset, map_policy_assets, map_conway_gov_action, map_tx) are defined
per-version. v1beta-only mappers (BootstrapWitness, Vote, VotingProcedure,
VoterVotes) live next to the rest of the v1beta module.

Adds cross-version wire-compatibility tests (PParams, Certificate,
PoolRegistrationCert, Metadata, PlutusData) that act as a tripwire if
upstream diverges any shared message in a future release.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

The sidecar tag previously pinned in master (f889dbc) was built before
commit 65039df, which removed components/sidecar/composer/chain-sync-client/
parallel_driver_flaky_chain_sync.sh from the sidecar image. Adversary was
removed from cardano_node_master in #109, but the sidecar pin still carried
the stale probe — so on every master run the composer discovers the script,
runs it, fails to reach /state/adversary-control.sock (no adversary in
master), and exits 1 in 3 ms with empty stderr/stdout.

Bumping to sidecar:65039df rebuilds the image without the orphan probe.
Closes #115.

Drop the standalone bootstrap-producer service. Each amaru-relay-N now
mounts its paired producer's pN-state and pN-configs read-only and runs
the bootstrap retry loop in its own entrypoint, then exec /bin/amaru run.

Antithesis 'setup complete' fires as soon as every container is
service_started (seconds), instead of waiting for the unbounded
bootstrap to finish inside the 6-minute setup window. Bootstrap proceeds
during the test phase.

The inline script preserves the existing exit-code contract (0, transient
1/2/5/7, hard otherwise) and adds a .bootstrap-complete sentinel so
container restarts mid-promotion don't surface a half-written bundle to
amaru run.

Volumes amaru-bundle and bootstrap-state are gone; per-relay scratch
lives on the existing aN-state volumes.

scripts/smoke-test.sh: drop the bootstrap-producer wait gate; the
existing per-relay bundle gate is now the equivalent readiness check.

Spec/plan: specs/080-amaru-self-bootstrap/

Antithesis run on bfc1dd2 (https://cardano.antithesis.com/report/JjPofIAbSixtn9DexNDJLl9I)
showed tx_generator_population_did_not_grow examples at vtime
42-48s — before the eventually validator could possibly observe a
landed refill (refill_landed first lands at ~57s on the same run).

The previous gate only distinguished 'daemon unreachable'. Daemon
was up, snapshot returned {populationSize:0, lastTxId:null} simply
because no refill had been submitted yet — and we incorrectly
asserted 'did_not_grow'.

Add a third branch: when populationSize=0 AND lastTxId is null
('no tx attempted yet'), emit a Reachability event
'tx_generator_eventually_no_tx_yet' and exit 0. The Always
assertion 'did_not_grow' now fires only when at least one tx has
been attempted but the population is still empty — the genuine
failure mode.

Dijkstra era CDDL for `block`, add `block_body`

Adds testnets/asteria_game/no-op-finally.sh and bind-mounts it
over the sidecar:f889dbc image's
/opt/antithesis/test/v1/convergence/finally_tips_agree.sh.

That driver enforces "all producer tips at exact same slot at
end-of-run" via an SDK Always assertion. On 1h runs under fault
injection the tips drift recovers slowly after faults stop and
the check fires false purely on duration, not on a real
reconvergence bug. The check is also orthogonal to the asteria
game contract this testnet scores — asteria observes the chain
through relay1 and tolerates short-lived tip lag.

Other convergence drivers (eventually_converged,
parallel_driver_tip_agreement, serial_driver_tip_agreement) are
unaffected and continue to run from the unmodified sidecar
image. Their during-fault and probabilistic checks remain a
real cluster-health signal.

The sidecar:f889dbc image bakes
/opt/antithesis/test/v1/chain-sync-client/parallel_driver_flaky_chain_sync.sh
which expects the adversary daemon — a separate component absent
from this testnet. Without it the script fails (exit 1) on every
fire and trips Antithesis's "Always: zero exit" property.

Mounting tmpfs over the chain-sync-client/ path on the sidecar
container hides the script from the composer at start time
without modifying the upstream image. Newer sidecar tags have
the script removed at the source but introduce Amaru-specific
drivers that would fail on this Amaru-less testnet — net no
gain. The targeted shadow is the cleanest fix.

Bumps the asteria-game compose tag to d0d9531 (drivers exit 0
on transient not-yet-ready conditions).

The Antithesis 1h dispatch on testnets/asteria_game/ surfaced
two "Always: Commands finish with zero exit code" findings on
stub/serial_driver_asteria_bootstrap.sh and
stub/parallel_driver_asteria_player.sh. Decoded composer events:

  - bootstrap: t=62.76s rc=1 (6.14s), t=106.5s rc=1 (52s),
    t=110.5s rc=1 (55s), t=178.5s rc=0 (3s short-circuit)
  - player: t=54.4-54.6s rc=1 (3 fast failures, ~5-15ms each),
    t=249.9s rc=0 (3.04s)

The early bootstrap failures hit before the cluster forged its
first block (build/sign/submit fails on protocol-params or
validity-interval errors). The player failures are PlayerMain
calling `error` when seed.json is missing — the parallel driver
fires before bootstrap completes.

Antithesis treats every non-zero exit as an Always-violation,
regardless of subsequent successful fires. This commit makes
both drivers exit 0 on transient "not yet ready" conditions:

  - PlayerMain: when readSeed returns Nothing, fire
    asteria_player_seed_missing_<id> (sdkUnreachable, already
    present) and return cleanly. The next composer fire retries.
  - BootstrapMain.runDeploy: catch any exception from
    resolveSeed / createAsteria, fire
    asteria_bootstrap_create_asteria_deferred (sdkSometimes True)
    with the error string, and return cleanly. Subsequent fires
    re-derive the same seed (deterministic via seed.json) and
    retry — the seed UTxO is preserved when the failure is
    pre-submit, and consumed cleanly when the deploy actually
    landed (next fire short-circuits via isAlreadyDeployed).

The signals Antithesis cares about — whether the deploy ever
succeeded, whether the singleton invariant held — still flow
through the existing sdkSometimes / sdkAlways assertions. We
just stop using process exit code to encode "world not yet
ready", which Antithesis interprets as a real bug.

Move bootstrap-producer's work into the amaru-relay containers so
Antithesis setup completes within the 6-min deadline. Bootstrap proceeds
during the test phase. Spec, plan, research, data-model, quickstart.

Co-authored-by: Robert Phair <[email protected]>

The asteria-stub container's stub/finally_alive and stub/eventually_alive
composer assertions have been failing on every recent main run
(d78c7b1b try 1: 1 stub finding; try 2: 2 stub findings).
asteria-stub belongs in feature testnets, not master.

PR #115 merged. Picks up the refill duplicate-submit
recovery (await change-output on ConnectionLost /
'already been included' rejection). Stacks on
#105/#110/#114.

The asteria-stub container's stub/finally_alive and stub/eventually_alive
composer assertions have been failing on every recent main run
(d78c7b1b try 1: 1 stub finding; try 2: 2 stub findings).
asteria-stub belongs in feature testnets, not master.

Skip the electron-chromedriver binary download during node_modules install
(mirrors the existing Linux skip: v12 package downloads v12 chromedriver,
mismatching our electron v41; the binary is provided via darwinSpecificCaches).

Also fix SHASUMS256.txt, electron zip, and chromedriver zip hashes for
both x64 and arm64, derived from the official Electron 41.3.0 release.

Co-authored-by: Alexey Kuleshevich <[email protected]>