Cardano Updates

Flake lock file updates:

• Updated input 'CHaP':
    'github:intersectmbo/cardano-haskell-packages/e8a483522ee73c8c9493ea6055553e5c2532e66b?narHash=sha256-ZzXz2vOhqethlqPgBExPXEnKWvaTbidsIxh5MGv%2BpwE%3D' (2026-05-02)
  → 'github:intersectmbo/cardano-haskell-packages/0aa7afd943dbcf2dc51fe652c982da281f8cb621?narHash=sha256-lipiKNOJ/NIGO/pcwQT030%2BsSgbTkP3N0w/ck5jBJlw%3D' (2026-06-10)
• Updated input 'hackageNix':
    'github:input-output-hk/hackage.nix/ba6ab6f3b781c8f308cba4fa384eafa48033f3cc?narHash=sha256-cPUF8%2Bl1ej7x4UZcuuf6IDsxU1WWmGWC0vFBH%2B6jXZk%3D' (2026-05-06)
  → 'github:input-output-hk/hackage.nix/127f92d4026a032f11f316a5a8f643266825821f?narHash=sha256-bbph19IozPdUAMInJj7rCZZQ20qv5cI7nBzRCmvtryM%3D' (2026-06-13)

* Document the limitation on the implementation of the support
  of Ogmios as a target that limits the throughput to one request
  in flight per round trip (Ogmios supports pipelining by JSON-RPC id,
  but we are not supporting it for now.

* Document that only submission goes through Ogmios:
  protocol-parameter and era queries as well as protocol startup still
  require the local node socket and config file.

* Route per-transaction rejections through the benchmark tracer instead
  of putStrLn, so they reach the trace stream like every other
  submission event instead of interleaving arbitrarily with it. The
  failure detail payload reported by Ogmios ('error.data'), which
  carries the actual ledger failure and was previously discarded, is
  included in the message along with the error code.

* Add `ogmiosUrl` to the README's connection-settings table plus a
  'Submitting through Ogmios' section, add a changelog entry for the
  feature (including the clean-exit behavior change for scripts that
  never start the benchmark machinery), and bump the package version
  to 2.17.

  Replace the hardcoded 300s worker cooldown with an optional top-level
  "cooldown_seconds" JSON field, defaulting to 0 (no wait). The cooldown
  was added to give multi-node benchmark clusters time to stabilise
  before traffic begins; for single-node ops / iterative testing it's a
  5-minute tax with no benefit. Cluster runs opt back in explicitly.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

Adds a BuilderQueueDepth trace fired every 5 seconds per workload,
reporting three pipeline depths and five cumulative counters the
existing NewTx/Recycle events don't expose:

  Depths
    inputQueue        — inputs available to the builder
    payloadQueue      — 8192-bounded backpressure queue
    pendingRecycle    — in-flight txs awaiting confirmation/orphan

  Cumulative counters (deltas between ticks give per-5s rates)
    built             — successful bhBuildPayload returns
    recycledConfirmed — Right events that matched a pending entry
    recycledOrphan    — Left events that matched a pending entry
    dropped           — bhBuildPayload returns Nothing (dust)
    submitted         — payloads pulled from payload queue by a worker

Diagnostic for cases where TPS holds for a while then degrades. The
identity `built - (confirmed + orphan + dropped) ≈ pendingRecycle`
holds in steady state; drift between those numbers localises the
leak. Submitted lagging built points at worker-side stall; built
lagging submitted points at builder starvation.

TQueue has no length op, so pipeInputQueue size is tracked via a TVar
counter updated atomically alongside every read/write. Counters live
in a new `Counters` record on the `Pipe`; the snapshot is materialised
into a value-only `Stats` record passed through the callback. Stats
async is linked like the builder and recycler asyncs; output is muted
under --preflight and respects the existing trace severity config.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

  Adapts the local consumers to the shape of consensus /
  ouroboros-network on the Leios prototype SRPs pinned by the base
  branch (which differ from CHAP).

  bench/tx-centrifuge/lib/tx-centrifuge/.../Tracing/Orphans.hs
    - 'TraceSendMsg' / 'TraceRecvMsg' (from Ouroboros.Network.Driver.
      Simple / Stateful) gained a mux-bearer-time field. Discard it
      with '_' in the local LogFormatting and MetaTrace orphans; we
      don't surface mux timestamps from these instances.

  bench/tx-centrifuge/lib/tx-centrifuge/.../NodeToNode.hs
    - 'NetN2N.Codecs' gained two ByteString slots for the new Peras
      cert/vote diffusion mini-protocols (PerasCertDiffusion,
      PerasVoteDiffusion). Add the slots to the four module-level
      Codecs signatures and the one in 'connect''s where-clause; we
      pass 'BSL.ByteString' for them like every other slot.

    - 'byteLimitsKeepAlive' dropped its size-measurer argument. Drop
      '(const 0)' from the call site accordingly.

  Note: on the previous (leios-11.0.1 remake) base this commit also
  initialised RunNodeArgs.rnLeiosDb in cardano-node's Run.hs; the
  leios-prototype-bench base already wires rnLeiosDb from
  LeiosDbConfig, so no Run.hs change is needed here.

Co-Authored-By: Claude Opus <[email protected]>

  Run all initialization (config, protocol, signing key, UTxO discovery,
  runtime resolution, observer connection check, partition summary) and
  exit 0 before spawning workers — so the same production config can be
  verified end-to-end without producing traffic. Useful for ops health
  checks after a new skey, fresh funding, node-config tweak, etc.

  The 2-second observer-settle window catches a broken local node socket
  early; observer linked-thread failures during the wait are caught and
  reported as a clean preflight error rather than crashing the process.

  Triggered by `tx-centrifuge config.json --preflight` (flag accepted in
  either position).

  Also exports pull-fiction's partitionInputs so the preflight summary
  can render the same workload split that Runtime.resolve performs.

Co-Authored-By: Claude <[email protected]>

  Replace the funds.json / initial_inputs config pathway with on-chain UTxO
  discovery via N2C LocalStateQuery. At startup, tx-centrifuge derives the
  1000 recycle addresses from the seed prefix and queries the local node
  for every spendable UTxO across them, in a single QueryUTxOByAddress.
  This makes restarts stateless: there is no on-disk state to corrupt, and
  any UTxOs at any of the recycle addresses are picked up automatically
  (including leftovers from a previous larger workload configuration).

  Requires a 'nodetoclient' observer to be declared — its socket_path is
  reused for the LocalStateQuery. The first such observer (alphabetical by
  name) is selected; tx-centrifuge dies with a config example if none is
  declared.

  Removes funds.json / initial_inputs / network_magic / genesis_utxo_keys
  and the supporting Fund.loadFunds, Fund.genesisTxIn, FundEntry, etc.
  Raw.initialInputs becomes Maybe Aeson.Value so other pull-fiction
  callers can still pass JSON-driven seeds out of band.

Co-Authored-By: Claude <[email protected]>

  Previously the builder called `die` whenever TxAssembly.buildTx returned
  Left — most commonly because an input UTxO's value <= fee, leaving no
  change to produce a valid output. A single dust UTxO in the recycle
  pool would crash the whole service.

  Two layers of protection:

  - Runtime change: bhBuildPayload now returns Maybe (key, payload,
    [input]). On Nothing the runtime drops the consumed inputs (no
    enqueue, no recycle) and continues.

  - mkBuilder: on Left from buildTx, logs the txin + value + reason to
    stderr and returns Nothing. The inputs are abandoned on-chain but
    the centrifuge stays up.

  Also filters dust out at startup discovery: UTxOs with value at or
  below the max configured fee are flagged and skipped, with per-address
  counts reported in the discovery summary (e.g. "142 UTxOs, 18 dust
  skipped"). maxConfiguredFee walks every configured builder
  (top-level + per-workload) and takes the max; defaults to 1 ADA when
  no builder declares a fee, matching the integer-ADA convention.

  Test harness: bhBuildPayload return wrapped in Just; also fixes a
  pre-existing 2-arg-vs-4-arg lambda on the onRecycle callback so
  cabal build all goes further than before.

Co-Authored-By: Claude <[email protected]>

  Drop the strict "000" suffix requirement on the operator-supplied skey.
  Any cardano-cli-generated key now works as-is — its last 3 hex chars
  become the workload-0 base offset, and workload N's recycle key uses
  suffix (base + N) mod 0x1000. Workload 0 still reproduces the supplied
  key exactly.

  Suffix encoding switches from decimal %03d (1000 keys) to hex %03x (4096
  keys), and discovery scans the full address space. UTxOs that landed at
  any of the 4096 addresses are picked up regardless of which suffix —
  including legacy funding under the old strict-000 layout, or addresses
  funded via cardano-cli prior to the centrifuge run.

  loadSigningKeyPrefix now returns (prefix, base :: Int). The address-level
  derivation lives in keyForSuffixIndex; recycleKeyForWorkload wraps it
  for workload N. Discovery summary indices are printed in hex (%03x) to
  match.

Co-Authored-By: Claude <[email protected]>

- MempoolCapacityBytesOverride (See https://github.com/input-output-hk/ouroboros-leios/blob/ebc1f7c76b34e3d4f1b28485b720ed324633a6b3/demo/proto-devnet/config/config.yaml#L9)
- MempoolTimeoutCapacity

  Add required top-level "signing_key_file" config field. The skey is
  read as a standard cardano-cli text envelope (payment or genesis UTxO
  key); its raw 32-byte secret must end in 0x000, and the leading 61
  hex chars become the per-workload key derivation prefix. Workload 0
  reproduces the supplied key exactly; workloads 1..N derive distinct
  keys.

Co-Authored-By: Claude <[email protected]>

  Previously hardcoded the UTxO query to ConwayEra. On a Dijkstra-era
  chain, that triggers an EraMismatch on the consensus side ("anachrony")
  which closes the bearer and surfaces client-side as BearerClosed.

  Now query QueryCurrentEra first, then dispatch the QueryUTxOByAddress
  via caseByronOrShelleyBasedEra in whatever era the chain reports.
  Conway addresses we derive locally are projected to AddressAny for the
  set we pass to the query, and the result map is also keyed by AddressAny
  so the caller looks up via an era-agnostic key.

  Works against any Shelley-based era — Conway, Dijkstra, and anything
  caseByronOrShelleyBasedEra dispatches in the current cardano-api.

Co-Authored-By: Claude <[email protected]>

bench: remove cardano-recon-framework

The info banner sat inside the genesis() function body, so it fired once per `wb genesis <op>` dispatch