Implement atomic calls, delegation and ordered parallel execution

Parent: #4626 · Complete tracking register

Proposed target: 5.0-dev. This is a workstream tracking issue, not a claim that the release branch exists or the implementation is done. Owner: QuantumExplorer. Dates and effort remain unset.

Scope

Implement explicit caller/delegation, shared limits, no active-contract reentry, outer failure poisoning and native operation replay. Build the required GroveDB accepted-prefix branch work; prove serial/parallel roots, results and costs match.

Specification

DVM-01 · DVM-04 · DVM-06 · DVM-07

The current parent acceptance and module/capability appendices remain authoritative; these DIP drafts add proposed engineering detail without silently approving open allocations.

Completion criteria

Complete every listed task acceptance item, its applicable capability matrix, and the linked specification vectors. Record actual PR/test evidence; drafting is not production completion.

Task acceptance

R10-01

• Specify and implement contract-call transitions, method declarations, ABI, authentication/capabilities, structured errors and bounded host operations under allocated protocol generations; include cross-contract calls in the first scope.

Prerequisites: R09-01, R09-03.

Dependents: R10-02, R10-03, R10-04.

Modules: DPP, ABI, HOST. Original task context.

R10-02

• Implement call action conversion and separate contract sum balances/token buckets through existing Drive validation; test conservation, bucket permissions, deposit rules, multi-identity payouts and mutually permitted contract transfers.

Prerequisites: R10-01.

Dependents: R10-03, R10-04, R10-09, R11-04, R12-09.

Modules: NATIVE_VALIDATE, ASSETS, NATIVE. Original task context.

R10-04

• Integrate full live affordability, bounded operation estimation, actual single charging and atomic GroveDB effects for direct/nested calls; preserve native validation and explicitly specify nested failure/rollback semantics.

Q06 (confirmed): Actual permission, resource, native validation and host/nested failures poison the whole outer call; catching them cannot retain partial effects. Internal speculative retries are not paid failures. Expected business alternatives can be successful typed return values. Q08 (confirmed): Read current execution state at the transition position in agreed block order, including accepted earlier transitions and own writes. Never expose later or abandoned speculative writes. Parallel execution must match sequential roots, results, fees and receipts; internal retries are not charged.

Prerequisites: R10-01, R10-02, R10-03, R09-03.

Dependents: R10-05, R10-06, R10-07, R11-04, R12-08.

Modules: HOST, VIEW, FEES. Original task context. Refinements (not extra dependency edges): FIX-01.

R10-07

• Test all call outcome classes, authorization boundaries, exact live-balance/fee limits, uniqueness conflicts, protected documents, bucket conservation, refunds, receipt configuration/tampering and stored/guest-wire size bounds. Verify failure leaves only the specified fee/nonce/receipt effects.

Q06 (confirmed): Actual permission, resource, native validation and host/nested failures poison the whole outer call; catching them cannot retain partial effects. Internal speculative retries are not paid failures. Expected business alternatives can be successful typed return values. Q33 (confirmed): When enabled, reserve storage before execution and store bounded success and deterministic paid-failure receipts. Local node faults and internal speculative retries are not paid failure receipts. Engineering recommendation: Validate individual-bucket and full-contract credit proofs for the ordinary-SumTree proposal against the trusted Platform root; tampering with a parent sum, bucket amount or lifecycle/exclusion marker must fail. A retained wiped subtree sum is not spendable credit.

Prerequisites: R10-04, R10-03.

Dependents: R10-08, R04-07.

Modules: HOST, ASSETS, DRIVE_TESTS, HARNESS. Original task context.

R10-09

• Fuzz call and proposed-operation decoding/validation/application boundaries; test current-state proof/result converters and maximal signed call size using the final cap, without assuming 20 KiB or mandatory receipt retention.

Prerequisites: R10-02, R10-03, R14-01.

Dependents: None recorded.

Modules: ABI, HOST, PROOF_CLIENT, HARNESS. Original task context.

R10-10

• Implement explicit delegated rights, distinct signer/caller identity, no active-contract reentry and one shared atomic effect/resource scope. Actual nested failures poison the whole call; internal speculative retries are not failures.

Q05 (confirmed): Reject repeated contract IDs on the active contract call stack, including A to B to A. Ordinary Rust helper calls and local recursion remain allowed within stack limits. Q06 (confirmed): Actual permission, resource, native validation and host/nested failures poison the whole outer call; catching them cannot retain partial effects. Internal speculative retries are not paid failures. Expected business alternatives can be successful typed return values. Q07 (confirmed): Delegate only explicitly granted rights; retain original signer and immediate caller separately. Never automatically pass all signer rights to a callee. Named-module scope: Internal module calls remain inside the same contract authority, signer/caller context, budget and atomic scope; they are not cross-contract reentry. Actual module/host failures poison the outer call. Cross-contract leave-and-reenter remains forbidden.

Prerequisites: None recorded.

Dependents: CAP-14.

Modules: AUTH, CALLS, VIEW. Original task context. Refinements (not extra dependency edges): FIX-12.

R10-11

• Implement latest-visible method routing for cross-contract calls and schedules; direct users may select supported old code. Test current storage permissions, missing methods, frozen targets and atomic activation handover.

Q08 (confirmed): Read current execution state at the transition position in agreed block order, including accepted earlier transitions and own writes. Never expose later or abandoned speculative writes. Parallel execution must match sequential roots, results, fees and receipts; internal retries are not charged. Q17 (confirmed): Direct users may explicitly select a still-supported old executable version. Direct calls without a version, cross-contract calls and scheduled jobs resolve the latest visible executable version; no cross-contract or scheduled old-version pin/fallback. Current native storage/authorization rules still apply to old code. Named-module scope: Resolve a complete contract version at its execution position, then map public methods to the exact pinned module/export. Internal module dependencies never resolve floating latest versions; external latest-active routing and supported-old direct calls remain unchanged.

Prerequisites: None recorded.

Dependents: None recorded.

Modules: CALLS, EXEC_STORE, CLIENT. Original task context. Refinements (not extra dependency edges): FIX-11, SDK-04.

FIX-01

• Validate every observed dependency before accepting contract effects

Ordered current-state reads with host-owned point/absence/range/metadata dependencies. Any parallel execution must revalidate or reschedule stale speculation and match sequential roots/results/fees/receipts. Bound retries and memory; a scheduling conflict is not a paid contract failure. Exact executor design remains open. Q08 (confirmed): Read current execution state at the transition position in agreed block order, including accepted earlier transitions and own writes. Never expose later or abandoned speculative writes. Parallel execution must match sequential roots, results, fees and receipts; internal retries are not charged. Engineering architecture: Respect GroveDB single-writer semantics. Implement and validate proposed accepted-prefix execution branches using upstream Merk/storage algorithms before stateful speculation. Track native point/range/absence, cache and cost dependencies; replay accepted native operations in order, never merge physical Merk deltas.

Prerequisites: R05-01.

Dependents: FIX-02, FIX-12, SDK-02, INT-ACL.

Modules: VIEW, ORDERED, GROVE_BRANCH. Original task context.

FIX-12

• Define nested-call authority, reentry and all-or-nothing failure

Reject repeated active contract IDs; share budgets/dependencies/effects, explicitly delegate rights, distinguish signer and immediate caller, and poison the outer call on actual host/nested failure. Local helpers remain available and speculative retries are internal. Q05 (confirmed): Reject repeated contract IDs on the active contract call stack, including A to B to A. Ordinary Rust helper calls and local recursion remain allowed within stack limits. Q06 (confirmed): Actual permission, resource, native validation and host/nested failures poison the whole outer call; catching them cannot retain partial effects. Internal speculative retries are not paid failures. Expected business alternatives can be successful typed return values. Q07 (confirmed): Delegate only explicitly granted rights; retain original signer and immediate caller separately. Never automatically pass all signer rights to a callee.

Prerequisites: FIX-01.

Dependents: SDK-02.

Modules: CALLS, AUTH, VIEW. Original task context.

R12-08

• Reuse existing GroveDB validation and atomic writes for bounded proposed/nested effects; verify no unauthorized partial effect survives a failed call, with exact rollback semantics specified in section 10.

Q06 (confirmed): Actual permission, resource, native validation and host/nested failures poison the whole outer call; catching them cannot retain partial effects. Internal speculative retries are not paid failures. Expected business alternatives can be successful typed return values. Engineering architecture: Attempt rollback covers native state, Drive caches, validation cost journals, counters and buffered notifications; only accepted outcomes settle. Separate application rollback from accepted fee/nonce/receipt bookkeeping.

Prerequisites: R10-04.

Dependents: None recorded.

Modules: VIEW, BATCH, NATIVE_VALIDATE. Original task context.

R11-13

• Document and assess ordering exposure per value-moving capability using the existing ordering protocol; deferred native primitives and bridges are not current prerequisites.

Prerequisites: None recorded.

Dependents: None recorded.

Modules: DELIVERY, NATIVE, ASSETS. Original task context.

R04-07

• Test atomic rollback, native predicate/trigger validation, uniqueness conflicts, exact fee/nonce effects, storage refund ownership, zero balance buckets, frozen actions, and conservation across success and failure.

Engineering architecture: Attempt rollback covers native state, Drive caches, validation cost journals, counters and buffered notifications; only accepted outcomes settle. Separate application rollback from accepted fee/nonce/receipt bookkeeping.

Prerequisites: R10-07, R10-08.

Dependents: None recorded.

Modules: VIEW, RULES, FEES, DRIVE_TESTS. Original task context.

Coordination and dependencies

Task-level prerequisites above govern order. Workstreams contain multiple stages, so a cross-link is not a claim that the entire other issue must close first. These are Markdown relationships, not native GitHub blocked-by edges. The parent dependency register preserves all 234 links, reasons and explicit/inferred labels.

• R09-01 → R10-01 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R09-03 → R10-01 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-01 → R10-03 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-02 → R10-03 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-03 → R10-04 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R09-03 → R10-04 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-04 → R10-05 (inferred): Rebased source dependency; confirm the implementation ordering. Scheduled calls use the scheduling infrastructure, bounded host reads and the selected existing atomic-effect integration.
• R10-04 → R10-06 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-03 → R10-07 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-07 → R10-08 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-03 → R10-09 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R14-01 → R10-09 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-02 → R11-04 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-04 → R11-04 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-02 → R12-09 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-08 → R04-07 (inferred): Rebased source dependency; confirm the implementation ordering. Implementation prerequisite inferred from the described interfaces.
• R10-10 → CAP-14 (inferred): Nested-call semantics define rollback and shared-resource acceptance.
• R05-01 → FIX-01 (inferred): Specify visibility and conflict semantics in DIPs.
• FIX-01 → FIX-02 (inferred): Target equality is an implicit conflict dependency.
• FIX-01 → SDK-02 (inferred): Persistence surfaces expose conflict behavior accurately.
• FIX-12 → SDK-02 (inferred): Dispatch enforces call-tree authority and failure behavior.
• FIX-01 → INT-ACL (inferred): ACL reads join conflict tracking; live native authority is checked at acceptance.

PR and evidence tracking

Create focused PRs against the chosen development branch. Link this issue with Refs #<issue-number> for partial work. Do not use Fixes for the whole workstream until every listed full task and acceptance criterion is complete.

For a PR that completes an entire task, add a standalone line in its actual PR body: Dash-Tasks: <completed task IDs>. Replace the placeholder with only fully completed IDs. Preparation PRs use ordinary references and omit the completion marker for their broader parent tasks. The site reads this marker on PRs in dashpay/platform and dashpay/grovedb: draft = red, ready for review = yellow, merged with no linked open PR = green. Closed-unmerged is not completion. This does not automatically close issue checkboxes and does not prove acceptance tests passed; reviewers must record the evidence.