From 12649c3a0e98b85ba312d70b53053cf1449da8c4 Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Tue, 16 Jun 2026 09:32:04 -0400 Subject: [PATCH 1/4] Added don settings for the vault --- pkg/capabilities/actions/vault/messages.pb.go | 347 ++++++++++++++---- pkg/capabilities/actions/vault/messages.proto | 22 ++ pkg/settings/cresettings/README.md | 1 + pkg/settings/cresettings/defaults.json | 1 + pkg/settings/cresettings/defaults.toml | 1 + pkg/settings/cresettings/settings.go | 2 + 6 files changed, 296 insertions(+), 78 deletions(-) diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index 30092b11e8..700ec0e662 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.12 +// protoc-gen-go v1.36.11 // protoc v5.29.3 // source: capabilities/actions/vault/messages.proto @@ -1395,6 +1395,124 @@ func (x *ObservationError) GetMessage() string { return "" } +// DON-wide settings committed by per-field 2f+1 consensus. +// Add fields freely; never reuse field numbers (use reserved instead). +type NodeSettings struct { + state protoimpl.MessageState `protogen:"open.v1"` + VaultOptimizationsEnabled bool `protobuf:"varint,1,opt,name=vault_optimizations_enabled,json=vaultOptimizationsEnabled,proto3" json:"vault_optimizations_enabled,omitempty"` + VaultForceEmptyOcrRounds bool `protobuf:"varint,2,opt,name=vault_force_empty_ocr_rounds,json=vaultForceEmptyOcrRounds,proto3" json:"vault_force_empty_ocr_rounds,omitempty"` + MaxCiphertextLengthBytes uint64 `protobuf:"varint,3,opt,name=max_ciphertext_length_bytes,json=maxCiphertextLengthBytes,proto3" json:"max_ciphertext_length_bytes,omitempty"` + MaxIdentifierKeyLengthBytes uint64 `protobuf:"varint,4,opt,name=max_identifier_key_length_bytes,json=maxIdentifierKeyLengthBytes,proto3" json:"max_identifier_key_length_bytes,omitempty"` + MaxIdentifierOwnerLengthBytes uint64 `protobuf:"varint,5,opt,name=max_identifier_owner_length_bytes,json=maxIdentifierOwnerLengthBytes,proto3" json:"max_identifier_owner_length_bytes,omitempty"` + MaxIdentifierNamespaceLengthBytes uint64 `protobuf:"varint,6,opt,name=max_identifier_namespace_length_bytes,json=maxIdentifierNamespaceLengthBytes,proto3" json:"max_identifier_namespace_length_bytes,omitempty"` + MaxShareLengthBytes uint64 `protobuf:"varint,7,opt,name=max_share_length_bytes,json=maxShareLengthBytes,proto3" json:"max_share_length_bytes,omitempty"` + MaxBlobPayloadBytes uint64 `protobuf:"varint,8,opt,name=max_blob_payload_bytes,json=maxBlobPayloadBytes,proto3" json:"max_blob_payload_bytes,omitempty"` + MaxPendingQueueWriteSize uint64 `protobuf:"varint,9,opt,name=max_pending_queue_write_size,json=maxPendingQueueWriteSize,proto3" json:"max_pending_queue_write_size,omitempty"` + MaxRequestBatchSize uint64 `protobuf:"varint,10,opt,name=max_request_batch_size,json=maxRequestBatchSize,proto3" json:"max_request_batch_size,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *NodeSettings) Reset() { + *x = NodeSettings{} + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *NodeSettings) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*NodeSettings) ProtoMessage() {} + +func (x *NodeSettings) ProtoReflect() protoreflect.Message { + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use NodeSettings.ProtoReflect.Descriptor instead. +func (*NodeSettings) Descriptor() ([]byte, []int) { + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20} +} + +func (x *NodeSettings) GetVaultOptimizationsEnabled() bool { + if x != nil { + return x.VaultOptimizationsEnabled + } + return false +} + +func (x *NodeSettings) GetVaultForceEmptyOcrRounds() bool { + if x != nil { + return x.VaultForceEmptyOcrRounds + } + return false +} + +func (x *NodeSettings) GetMaxCiphertextLengthBytes() uint64 { + if x != nil { + return x.MaxCiphertextLengthBytes + } + return 0 +} + +func (x *NodeSettings) GetMaxIdentifierKeyLengthBytes() uint64 { + if x != nil { + return x.MaxIdentifierKeyLengthBytes + } + return 0 +} + +func (x *NodeSettings) GetMaxIdentifierOwnerLengthBytes() uint64 { + if x != nil { + return x.MaxIdentifierOwnerLengthBytes + } + return 0 +} + +func (x *NodeSettings) GetMaxIdentifierNamespaceLengthBytes() uint64 { + if x != nil { + return x.MaxIdentifierNamespaceLengthBytes + } + return 0 +} + +func (x *NodeSettings) GetMaxShareLengthBytes() uint64 { + if x != nil { + return x.MaxShareLengthBytes + } + return 0 +} + +func (x *NodeSettings) GetMaxBlobPayloadBytes() uint64 { + if x != nil { + return x.MaxBlobPayloadBytes + } + return 0 +} + +func (x *NodeSettings) GetMaxPendingQueueWriteSize() uint64 { + if x != nil { + return x.MaxPendingQueueWriteSize + } + return 0 +} + +func (x *NodeSettings) GetMaxRequestBatchSize() uint64 { + if x != nil { + return x.MaxRequestBatchSize + } + return 0 +} + type Observation struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -1422,7 +1540,7 @@ type Observation struct { func (x *Observation) Reset() { *x = Observation{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1434,7 +1552,7 @@ func (x *Observation) String() string { func (*Observation) ProtoMessage() {} func (x *Observation) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1447,7 +1565,7 @@ func (x *Observation) ProtoReflect() protoreflect.Message { // Deprecated: Use Observation.ProtoReflect.Descriptor instead. func (*Observation) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{21} } func (x *Observation) GetId() string { @@ -1649,13 +1767,14 @@ type Observations struct { PendingQueueItems [][]byte `protobuf:"bytes,2,rep,name=pending_queue_items,json=pendingQueueItems,proto3" json:"pending_queue_items,omitempty"` SortNonce []byte `protobuf:"bytes,3,opt,name=sortNonce,proto3" json:"sortNonce,omitempty"` PendingQueueStallSignal PendingQueueStallSignal `protobuf:"varint,4,opt,name=pending_queue_stall_signal,json=pendingQueueStallSignal,proto3,enum=vault.PendingQueueStallSignal" json:"pending_queue_stall_signal,omitempty"` + NodeSettings *NodeSettings `protobuf:"bytes,5,opt,name=node_settings,json=nodeSettings,proto3" json:"node_settings,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } func (x *Observations) Reset() { *x = Observations{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1667,7 +1786,7 @@ func (x *Observations) String() string { func (*Observations) ProtoMessage() {} func (x *Observations) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1680,7 +1799,7 @@ func (x *Observations) ProtoReflect() protoreflect.Message { // Deprecated: Use Observations.ProtoReflect.Descriptor instead. func (*Observations) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{21} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{22} } func (x *Observations) GetObservations() []*Observation { @@ -1711,6 +1830,13 @@ func (x *Observations) GetPendingQueueStallSignal() PendingQueueStallSignal { return PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE } +func (x *Observations) GetNodeSettings() *NodeSettings { + if x != nil { + return x.NodeSettings + } + return nil +} + type Outcome struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -1737,7 +1863,7 @@ type Outcome struct { func (x *Outcome) Reset() { *x = Outcome{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1749,7 +1875,7 @@ func (x *Outcome) String() string { func (*Outcome) ProtoMessage() {} func (x *Outcome) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1762,7 +1888,7 @@ func (x *Outcome) ProtoReflect() protoreflect.Message { // Deprecated: Use Outcome.ProtoReflect.Descriptor instead. func (*Outcome) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{22} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{23} } func (x *Outcome) GetId() string { @@ -1960,7 +2086,7 @@ type Outcomes struct { func (x *Outcomes) Reset() { *x = Outcomes{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1972,7 +2098,7 @@ func (x *Outcomes) String() string { func (*Outcomes) ProtoMessage() {} func (x *Outcomes) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1985,7 +2111,7 @@ func (x *Outcomes) ProtoReflect() protoreflect.Message { // Deprecated: Use Outcomes.ProtoReflect.Descriptor instead. func (*Outcomes) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{23} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{24} } func (x *Outcomes) GetOutcomes() []*Outcome { @@ -2006,7 +2132,7 @@ type ReportInfo struct { func (x *ReportInfo) Reset() { *x = ReportInfo{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2018,7 +2144,7 @@ func (x *ReportInfo) String() string { func (*ReportInfo) ProtoMessage() {} func (x *ReportInfo) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2031,7 +2157,7 @@ func (x *ReportInfo) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportInfo.ProtoReflect.Descriptor instead. func (*ReportInfo) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{24} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{25} } func (x *ReportInfo) GetId() string { @@ -2066,7 +2192,7 @@ type StoredSecret struct { func (x *StoredSecret) Reset() { *x = StoredSecret{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2078,7 +2204,7 @@ func (x *StoredSecret) String() string { func (*StoredSecret) ProtoMessage() {} func (x *StoredSecret) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2091,7 +2217,7 @@ func (x *StoredSecret) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredSecret.ProtoReflect.Descriptor instead. func (*StoredSecret) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{25} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{26} } func (x *StoredSecret) GetEncryptedSecret() []byte { @@ -2112,7 +2238,7 @@ type StoredMetadata struct { func (x *StoredMetadata) Reset() { *x = StoredMetadata{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2124,7 +2250,7 @@ func (x *StoredMetadata) String() string { func (*StoredMetadata) ProtoMessage() {} func (x *StoredMetadata) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2137,7 +2263,7 @@ func (x *StoredMetadata) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredMetadata.ProtoReflect.Descriptor instead. func (*StoredMetadata) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{26} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{27} } func (x *StoredMetadata) GetSecretIdentifiers() []*SecretIdentifier { @@ -2158,7 +2284,7 @@ type StoredPendingQueueIndex struct { func (x *StoredPendingQueueIndex) Reset() { *x = StoredPendingQueueIndex{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2170,7 +2296,7 @@ func (x *StoredPendingQueueIndex) String() string { func (*StoredPendingQueueIndex) ProtoMessage() {} func (x *StoredPendingQueueIndex) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2183,7 +2309,7 @@ func (x *StoredPendingQueueIndex) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredPendingQueueIndex.ProtoReflect.Descriptor instead. func (*StoredPendingQueueIndex) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{27} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{28} } func (x *StoredPendingQueueIndex) GetLength() int64 { @@ -2205,7 +2331,7 @@ type StoredPendingQueueItem struct { func (x *StoredPendingQueueItem) Reset() { *x = StoredPendingQueueItem{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2217,7 +2343,7 @@ func (x *StoredPendingQueueItem) String() string { func (*StoredPendingQueueItem) ProtoMessage() {} func (x *StoredPendingQueueItem) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2230,7 +2356,7 @@ func (x *StoredPendingQueueItem) ProtoReflect() protoreflect.Message { // Deprecated: Use StoredPendingQueueItem.ProtoReflect.Descriptor instead. func (*StoredPendingQueueItem) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{28} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{29} } func (x *StoredPendingQueueItem) GetItem() *anypb.Any { @@ -2247,6 +2373,52 @@ func (x *StoredPendingQueueItem) GetId() string { return "" } +// IMPORTANT: this record is persisted so any changes must be +// backwards compatible +type StoredDONSettings struct { + state protoimpl.MessageState `protogen:"open.v1"` + Settings *NodeSettings `protobuf:"bytes,1,opt,name=settings,proto3" json:"settings,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *StoredDONSettings) Reset() { + *x = StoredDONSettings{} + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *StoredDONSettings) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*StoredDONSettings) ProtoMessage() {} + +func (x *StoredDONSettings) ProtoReflect() protoreflect.Message { + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use StoredDONSettings.ProtoReflect.Descriptor instead. +func (*StoredDONSettings) Descriptor() ([]byte, []int) { + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{30} +} + +func (x *StoredDONSettings) GetSettings() *NodeSettings { + if x != nil { + return x.Settings + } + return nil +} + // Wire format for pending queue blobs. Not persisted. // When is_batch=false, wire-compatible with StoredPendingQueueItem (field 1 = Any, field 2 = string). type PendingQueueBlobItems struct { @@ -2260,7 +2432,7 @@ type PendingQueueBlobItems struct { func (x *PendingQueueBlobItems) Reset() { *x = PendingQueueBlobItems{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[31] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2272,7 +2444,7 @@ func (x *PendingQueueBlobItems) String() string { func (*PendingQueueBlobItems) ProtoMessage() {} func (x *PendingQueueBlobItems) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[31] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2285,7 +2457,7 @@ func (x *PendingQueueBlobItems) ProtoReflect() protoreflect.Message { // Deprecated: Use PendingQueueBlobItems.ProtoReflect.Descriptor instead. func (*PendingQueueBlobItems) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{29} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{31} } func (x *PendingQueueBlobItems) GetItems() []*anypb.Any { @@ -2336,7 +2508,7 @@ type ReportingPluginConfig struct { func (x *ReportingPluginConfig) Reset() { *x = ReportingPluginConfig{} - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2348,7 +2520,7 @@ func (x *ReportingPluginConfig) String() string { func (*ReportingPluginConfig) ProtoMessage() {} func (x *ReportingPluginConfig) ProtoReflect() protoreflect.Message { - mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30] + mi := &file_capabilities_actions_vault_messages_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2361,7 +2533,7 @@ func (x *ReportingPluginConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use ReportingPluginConfig.ProtoReflect.Descriptor instead. func (*ReportingPluginConfig) Descriptor() ([]byte, []int) { - return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{30} + return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{32} } func (x *ReportingPluginConfig) GetBatchSize() int32 { @@ -2573,7 +2745,19 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\n" + "request_id\x18\x04 \x01(\tR\trequestId\",\n" + "\x10ObservationError\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"\x9b\b\n" + + "\amessage\x18\x01 \x01(\tR\amessage\"\x8e\x05\n" + + "\fNodeSettings\x12>\n" + + "\x1bvault_optimizations_enabled\x18\x01 \x01(\bR\x19vaultOptimizationsEnabled\x12>\n" + + "\x1cvault_force_empty_ocr_rounds\x18\x02 \x01(\bR\x18vaultForceEmptyOcrRounds\x12=\n" + + "\x1bmax_ciphertext_length_bytes\x18\x03 \x01(\x04R\x18maxCiphertextLengthBytes\x12D\n" + + "\x1fmax_identifier_key_length_bytes\x18\x04 \x01(\x04R\x1bmaxIdentifierKeyLengthBytes\x12H\n" + + "!max_identifier_owner_length_bytes\x18\x05 \x01(\x04R\x1dmaxIdentifierOwnerLengthBytes\x12P\n" + + "%max_identifier_namespace_length_bytes\x18\x06 \x01(\x04R!maxIdentifierNamespaceLengthBytes\x123\n" + + "\x16max_share_length_bytes\x18\a \x01(\x04R\x13maxShareLengthBytes\x123\n" + + "\x16max_blob_payload_bytes\x18\b \x01(\x04R\x13maxBlobPayloadBytes\x12>\n" + + "\x1cmax_pending_queue_write_size\x18\t \x01(\x04R\x18maxPendingQueueWriteSize\x123\n" + + "\x16max_request_batch_size\x18\n" + + " \x01(\x04R\x13maxRequestBatchSize\"\x9b\b\n" + "\vObservation\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + @@ -2591,12 +2775,13 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x05error\x18\r \x01(\v2\x17.vault.ObservationErrorR\x05errorB\t\n" + "\arequestB\n" + "\n" + - "\bresponse\"\xf1\x01\n" + + "\bresponse\"\xab\x02\n" + "\fObservations\x126\n" + "\fobservations\x18\x01 \x03(\v2\x12.vault.ObservationR\fobservations\x12.\n" + "\x13pending_queue_items\x18\x02 \x03(\fR\x11pendingQueueItems\x12\x1c\n" + "\tsortNonce\x18\x03 \x01(\fR\tsortNonce\x12[\n" + - "\x1apending_queue_stall_signal\x18\x04 \x01(\x0e2\x1e.vault.PendingQueueStallSignalR\x17pendingQueueStallSignal\"\xe8\a\n" + + "\x1apending_queue_stall_signal\x18\x04 \x01(\x0e2\x1e.vault.PendingQueueStallSignalR\x17pendingQueueStallSignal\x128\n" + + "\rnode_settings\x18\x05 \x01(\v2\x13.vault.NodeSettingsR\fnodeSettings\"\xe8\a\n" + "\aOutcome\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + @@ -2629,7 +2814,9 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x06length\x18\x01 \x01(\x03R\x06length\"R\n" + "\x16StoredPendingQueueItem\x12(\n" + "\x04item\x18\x01 \x01(\v2\x14.google.protobuf.AnyR\x04item\x12\x0e\n" + - "\x02id\x18\x02 \x01(\tR\x02id\"n\n" + + "\x02id\x18\x02 \x01(\tR\x02id\"D\n" + + "\x11StoredDONSettings\x12/\n" + + "\bsettings\x18\x01 \x01(\v2\x13.vault.NodeSettingsR\bsettings\"n\n" + "\x15PendingQueueBlobItems\x12*\n" + "\x05items\x18\x01 \x03(\v2\x14.google.protobuf.AnyR\x05items\x12\x0e\n" + "\x02id\x18\x02 \x01(\tR\x02id\x12\x19\n" + @@ -2681,7 +2868,7 @@ func file_capabilities_actions_vault_messages_proto_rawDescGZIP() []byte { } var file_capabilities_actions_vault_messages_proto_enumTypes = make([]protoimpl.EnumInfo, 3) -var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 31) +var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 33) var file_capabilities_actions_vault_messages_proto_goTypes = []any{ (RequestType)(0), // 0: vault.RequestType (PendingQueueStallSignal)(0), // 1: vault.PendingQueueStallSignal @@ -2706,18 +2893,20 @@ var file_capabilities_actions_vault_messages_proto_goTypes = []any{ (*ListSecretIdentifiersRequest)(nil), // 20: vault.ListSecretIdentifiersRequest (*ListSecretIdentifiersResponse)(nil), // 21: vault.ListSecretIdentifiersResponse (*ObservationError)(nil), // 22: vault.ObservationError - (*Observation)(nil), // 23: vault.Observation - (*Observations)(nil), // 24: vault.Observations - (*Outcome)(nil), // 25: vault.Outcome - (*Outcomes)(nil), // 26: vault.Outcomes - (*ReportInfo)(nil), // 27: vault.ReportInfo - (*StoredSecret)(nil), // 28: vault.StoredSecret - (*StoredMetadata)(nil), // 29: vault.StoredMetadata - (*StoredPendingQueueIndex)(nil), // 30: vault.StoredPendingQueueIndex - (*StoredPendingQueueItem)(nil), // 31: vault.StoredPendingQueueItem - (*PendingQueueBlobItems)(nil), // 32: vault.PendingQueueBlobItems - (*ReportingPluginConfig)(nil), // 33: vault.ReportingPluginConfig - (*anypb.Any)(nil), // 34: google.protobuf.Any + (*NodeSettings)(nil), // 23: vault.NodeSettings + (*Observation)(nil), // 24: vault.Observation + (*Observations)(nil), // 25: vault.Observations + (*Outcome)(nil), // 26: vault.Outcome + (*Outcomes)(nil), // 27: vault.Outcomes + (*ReportInfo)(nil), // 28: vault.ReportInfo + (*StoredSecret)(nil), // 29: vault.StoredSecret + (*StoredMetadata)(nil), // 30: vault.StoredMetadata + (*StoredPendingQueueIndex)(nil), // 31: vault.StoredPendingQueueIndex + (*StoredPendingQueueItem)(nil), // 32: vault.StoredPendingQueueItem + (*StoredDONSettings)(nil), // 33: vault.StoredDONSettings + (*PendingQueueBlobItems)(nil), // 34: vault.PendingQueueBlobItems + (*ReportingPluginConfig)(nil), // 35: vault.ReportingPluginConfig + (*anypb.Any)(nil), // 36: google.protobuf.Any } var file_capabilities_actions_vault_messages_proto_depIdxs = []int32{ 3, // 0: vault.SecretRequest.id:type_name -> vault.SecretIdentifier @@ -2749,30 +2938,32 @@ var file_capabilities_actions_vault_messages_proto_depIdxs = []int32{ 19, // 26: vault.Observation.delete_secrets_response:type_name -> vault.DeleteSecretsResponse 21, // 27: vault.Observation.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse 22, // 28: vault.Observation.error:type_name -> vault.ObservationError - 23, // 29: vault.Observations.observations:type_name -> vault.Observation + 24, // 29: vault.Observations.observations:type_name -> vault.Observation 1, // 30: vault.Observations.pending_queue_stall_signal:type_name -> vault.PendingQueueStallSignal - 0, // 31: vault.Outcome.request_type:type_name -> vault.RequestType - 11, // 32: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest - 8, // 33: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest - 14, // 34: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest - 17, // 35: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest - 20, // 36: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest - 13, // 37: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse - 9, // 38: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse - 16, // 39: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse - 19, // 40: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse - 21, // 41: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse - 25, // 42: vault.Outcomes.outcomes:type_name -> vault.Outcome - 0, // 43: vault.ReportInfo.request_type:type_name -> vault.RequestType - 2, // 44: vault.ReportInfo.format:type_name -> vault.ReportFormat - 3, // 45: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier - 34, // 46: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any - 34, // 47: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any - 48, // [48:48] is the sub-list for method output_type - 48, // [48:48] is the sub-list for method input_type - 48, // [48:48] is the sub-list for extension type_name - 48, // [48:48] is the sub-list for extension extendee - 0, // [0:48] is the sub-list for field type_name + 23, // 31: vault.Observations.node_settings:type_name -> vault.NodeSettings + 0, // 32: vault.Outcome.request_type:type_name -> vault.RequestType + 11, // 33: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest + 8, // 34: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest + 14, // 35: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest + 17, // 36: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest + 20, // 37: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest + 13, // 38: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse + 9, // 39: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse + 16, // 40: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse + 19, // 41: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse + 21, // 42: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse + 26, // 43: vault.Outcomes.outcomes:type_name -> vault.Outcome + 0, // 44: vault.ReportInfo.request_type:type_name -> vault.RequestType + 2, // 45: vault.ReportInfo.format:type_name -> vault.ReportFormat + 3, // 46: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier + 36, // 47: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any + 23, // 48: vault.StoredDONSettings.settings:type_name -> vault.NodeSettings + 36, // 49: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any + 50, // [50:50] is the sub-list for method output_type + 50, // [50:50] is the sub-list for method input_type + 50, // [50:50] is the sub-list for extension type_name + 50, // [50:50] is the sub-list for extension extendee + 0, // [0:50] is the sub-list for field type_name } func init() { file_capabilities_actions_vault_messages_proto_init() } @@ -2784,7 +2975,7 @@ func file_capabilities_actions_vault_messages_proto_init() { (*SecretResponse_Data)(nil), (*SecretResponse_Error)(nil), } - file_capabilities_actions_vault_messages_proto_msgTypes[20].OneofWrappers = []any{ + file_capabilities_actions_vault_messages_proto_msgTypes[21].OneofWrappers = []any{ (*Observation_CreateSecretsRequest)(nil), (*Observation_GetSecretsRequest)(nil), (*Observation_UpdateSecretsRequest)(nil), @@ -2796,7 +2987,7 @@ func file_capabilities_actions_vault_messages_proto_init() { (*Observation_DeleteSecretsResponse)(nil), (*Observation_ListSecretIdentifiersResponse)(nil), } - file_capabilities_actions_vault_messages_proto_msgTypes[22].OneofWrappers = []any{ + file_capabilities_actions_vault_messages_proto_msgTypes[23].OneofWrappers = []any{ (*Outcome_CreateSecretsRequest)(nil), (*Outcome_GetSecretsRequest)(nil), (*Outcome_UpdateSecretsRequest)(nil), @@ -2808,14 +2999,14 @@ func file_capabilities_actions_vault_messages_proto_init() { (*Outcome_DeleteSecretsResponse)(nil), (*Outcome_ListSecretIdentifiersResponse)(nil), } - file_capabilities_actions_vault_messages_proto_msgTypes[30].OneofWrappers = []any{} + file_capabilities_actions_vault_messages_proto_msgTypes[32].OneofWrappers = []any{} type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_capabilities_actions_vault_messages_proto_rawDesc), len(file_capabilities_actions_vault_messages_proto_rawDesc)), NumEnums: 3, - NumMessages: 31, + NumMessages: 33, NumExtensions: 0, NumServices: 0, }, diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index b83f487ee3..fcbe6fe7cb 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -136,6 +136,21 @@ message ObservationError { string message = 1; } +// DON-wide settings committed by per-field 2f+1 consensus. +// Add fields freely; never reuse field numbers (use reserved instead). +message NodeSettings { + bool vault_optimizations_enabled = 1; + bool vault_force_empty_ocr_rounds = 2; + uint64 max_ciphertext_length_bytes = 3; + uint64 max_identifier_key_length_bytes = 4; + uint64 max_identifier_owner_length_bytes = 5; + uint64 max_identifier_namespace_length_bytes = 6; + uint64 max_share_length_bytes = 7; + uint64 max_blob_payload_bytes = 8; + uint64 max_pending_queue_write_size = 9; + uint64 max_request_batch_size = 10; +} + message Observation { string id = 1; RequestType request_type = 2; @@ -169,6 +184,7 @@ message Observations { repeated bytes pending_queue_items = 2; bytes sortNonce = 3; PendingQueueStallSignal pending_queue_stall_signal = 4; + NodeSettings node_settings = 5; } message Outcome { @@ -233,6 +249,12 @@ message StoredPendingQueueItem { string id = 2; } +// IMPORTANT: this record is persisted so any changes must be +// backwards compatible +message StoredDONSettings { + NodeSettings settings = 1; +} + // Wire format for pending queue blobs. Not persisted. // When is_batch=false, wire-compatible with StoredPendingQueueItem (field 1 = Any, field 2 = string). message PendingQueueBlobItems { diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md index 0ce55544d0..e4338ca9f3 100644 --- a/pkg/settings/cresettings/README.md +++ b/pkg/settings/cresettings/README.md @@ -50,6 +50,7 @@ flowchart VaultOptimizationsEnabled[/VaultOptimizationsEnabled\]:::gate %% Deprecated: feature flag has been retired; behavior is now always enabled. VaultGetSecretsShareAggregationIncludesPublicKeys[/VaultGetSecretsShareAggregationIncludesPublicKeys\]:::gate + VaultNodeSettingsConsensusEnabled[/VaultNodeSettingsConsensusEnabled\]:::gate VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate %% Deprecated: feature flag has been retired; behavior is now always enabled. VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json index 4e0505e8e1..1c200b107c 100644 --- a/pkg/settings/cresettings/defaults.json +++ b/pkg/settings/cresettings/defaults.json @@ -13,6 +13,7 @@ "VaultForceEmptyOCRRounds": "false", "VaultOptimizationsEnabled": "false", "VaultGetSecretsShareAggregationIncludesPublicKeys": "false", + "VaultNodeSettingsConsensusEnabled": "false", "VaultOwnerAddressCanonicalizationEnabled": "false", "VaultJSONOmitUnpopulatedEnabled": "false", "VaultGetSecretsRelaxedConsensusEnabled": "false", diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml index 3004605698..c19e7f93c1 100644 --- a/pkg/settings/cresettings/defaults.toml +++ b/pkg/settings/cresettings/defaults.toml @@ -12,6 +12,7 @@ VaultBase64EncodingEnabled = 'false' VaultForceEmptyOCRRounds = 'false' VaultOptimizationsEnabled = 'false' VaultGetSecretsShareAggregationIncludesPublicKeys = 'false' +VaultNodeSettingsConsensusEnabled = 'false' VaultOwnerAddressCanonicalizationEnabled = 'false' VaultJSONOmitUnpopulatedEnabled = 'false' VaultGetSecretsRelaxedConsensusEnabled = 'false' diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go index e07cfb558a..a5ea609f52 100644 --- a/pkg/settings/cresettings/settings.go +++ b/pkg/settings/cresettings/settings.go @@ -70,6 +70,7 @@ var Default = Schema{ VaultOptimizationsEnabled: Bool(false), // Deprecated: feature flag has been retired; behavior is now always enabled. VaultGetSecretsShareAggregationIncludesPublicKeys: Bool(false), + VaultNodeSettingsConsensusEnabled: Bool(false), VaultOwnerAddressCanonicalizationEnabled: Bool(false), // Deprecated: feature flag has been retired; behavior is now always enabled. VaultJSONOmitUnpopulatedEnabled: Bool(false), @@ -383,6 +384,7 @@ type Schema struct { VaultOptimizationsEnabled Setting[bool] // Deprecated: feature flag has been retired; behavior is now always enabled. VaultGetSecretsShareAggregationIncludesPublicKeys Setting[bool] + VaultNodeSettingsConsensusEnabled Setting[bool] VaultOwnerAddressCanonicalizationEnabled Setting[bool] // Deprecated: feature flag has been retired; behavior is now always enabled. VaultJSONOmitUnpopulatedEnabled Setting[bool] From 9594224f9d003ca30e523c1c030dcab5d5d3bd6a Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Tue, 16 Jun 2026 12:21:45 -0400 Subject: [PATCH 2/4] Removed max cipher text from don settings --- pkg/capabilities/actions/vault/messages.pb.go | 78 ++++++++----------- pkg/capabilities/actions/vault/messages.proto | 19 +++-- 2 files changed, 43 insertions(+), 54 deletions(-) diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index 700ec0e662..042e84321e 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -1399,16 +1399,15 @@ func (x *ObservationError) GetMessage() string { // Add fields freely; never reuse field numbers (use reserved instead). type NodeSettings struct { state protoimpl.MessageState `protogen:"open.v1"` - VaultOptimizationsEnabled bool `protobuf:"varint,1,opt,name=vault_optimizations_enabled,json=vaultOptimizationsEnabled,proto3" json:"vault_optimizations_enabled,omitempty"` - VaultForceEmptyOcrRounds bool `protobuf:"varint,2,opt,name=vault_force_empty_ocr_rounds,json=vaultForceEmptyOcrRounds,proto3" json:"vault_force_empty_ocr_rounds,omitempty"` - MaxCiphertextLengthBytes uint64 `protobuf:"varint,3,opt,name=max_ciphertext_length_bytes,json=maxCiphertextLengthBytes,proto3" json:"max_ciphertext_length_bytes,omitempty"` - MaxIdentifierKeyLengthBytes uint64 `protobuf:"varint,4,opt,name=max_identifier_key_length_bytes,json=maxIdentifierKeyLengthBytes,proto3" json:"max_identifier_key_length_bytes,omitempty"` - MaxIdentifierOwnerLengthBytes uint64 `protobuf:"varint,5,opt,name=max_identifier_owner_length_bytes,json=maxIdentifierOwnerLengthBytes,proto3" json:"max_identifier_owner_length_bytes,omitempty"` - MaxIdentifierNamespaceLengthBytes uint64 `protobuf:"varint,6,opt,name=max_identifier_namespace_length_bytes,json=maxIdentifierNamespaceLengthBytes,proto3" json:"max_identifier_namespace_length_bytes,omitempty"` - MaxShareLengthBytes uint64 `protobuf:"varint,7,opt,name=max_share_length_bytes,json=maxShareLengthBytes,proto3" json:"max_share_length_bytes,omitempty"` - MaxBlobPayloadBytes uint64 `protobuf:"varint,8,opt,name=max_blob_payload_bytes,json=maxBlobPayloadBytes,proto3" json:"max_blob_payload_bytes,omitempty"` - MaxPendingQueueWriteSize uint64 `protobuf:"varint,9,opt,name=max_pending_queue_write_size,json=maxPendingQueueWriteSize,proto3" json:"max_pending_queue_write_size,omitempty"` - MaxRequestBatchSize uint64 `protobuf:"varint,10,opt,name=max_request_batch_size,json=maxRequestBatchSize,proto3" json:"max_request_batch_size,omitempty"` + MaxIdentifierKeyLengthBytes uint64 `protobuf:"varint,1,opt,name=max_identifier_key_length_bytes,json=maxIdentifierKeyLengthBytes,proto3" json:"max_identifier_key_length_bytes,omitempty"` + MaxIdentifierOwnerLengthBytes uint64 `protobuf:"varint,2,opt,name=max_identifier_owner_length_bytes,json=maxIdentifierOwnerLengthBytes,proto3" json:"max_identifier_owner_length_bytes,omitempty"` + MaxIdentifierNamespaceLengthBytes uint64 `protobuf:"varint,3,opt,name=max_identifier_namespace_length_bytes,json=maxIdentifierNamespaceLengthBytes,proto3" json:"max_identifier_namespace_length_bytes,omitempty"` + MaxShareLengthBytes uint64 `protobuf:"varint,4,opt,name=max_share_length_bytes,json=maxShareLengthBytes,proto3" json:"max_share_length_bytes,omitempty"` + MaxBlobPayloadBytes uint64 `protobuf:"varint,5,opt,name=max_blob_payload_bytes,json=maxBlobPayloadBytes,proto3" json:"max_blob_payload_bytes,omitempty"` + MaxPendingQueueWriteSize uint64 `protobuf:"varint,6,opt,name=max_pending_queue_write_size,json=maxPendingQueueWriteSize,proto3" json:"max_pending_queue_write_size,omitempty"` + MaxRequestBatchSize uint64 `protobuf:"varint,7,opt,name=max_request_batch_size,json=maxRequestBatchSize,proto3" json:"max_request_batch_size,omitempty"` + VaultOptimizationsEnabled bool `protobuf:"varint,8,opt,name=vault_optimizations_enabled,json=vaultOptimizationsEnabled,proto3" json:"vault_optimizations_enabled,omitempty"` + VaultForceEmptyOcrRounds bool `protobuf:"varint,9,opt,name=vault_force_empty_ocr_rounds,json=vaultForceEmptyOcrRounds,proto3" json:"vault_force_empty_ocr_rounds,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -1443,27 +1442,6 @@ func (*NodeSettings) Descriptor() ([]byte, []int) { return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20} } -func (x *NodeSettings) GetVaultOptimizationsEnabled() bool { - if x != nil { - return x.VaultOptimizationsEnabled - } - return false -} - -func (x *NodeSettings) GetVaultForceEmptyOcrRounds() bool { - if x != nil { - return x.VaultForceEmptyOcrRounds - } - return false -} - -func (x *NodeSettings) GetMaxCiphertextLengthBytes() uint64 { - if x != nil { - return x.MaxCiphertextLengthBytes - } - return 0 -} - func (x *NodeSettings) GetMaxIdentifierKeyLengthBytes() uint64 { if x != nil { return x.MaxIdentifierKeyLengthBytes @@ -1513,6 +1491,20 @@ func (x *NodeSettings) GetMaxRequestBatchSize() uint64 { return 0 } +func (x *NodeSettings) GetVaultOptimizationsEnabled() bool { + if x != nil { + return x.VaultOptimizationsEnabled + } + return false +} + +func (x *NodeSettings) GetVaultForceEmptyOcrRounds() bool { + if x != nil { + return x.VaultForceEmptyOcrRounds + } + return false +} + type Observation struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -2745,19 +2737,17 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\n" + "request_id\x18\x04 \x01(\tR\trequestId\",\n" + "\x10ObservationError\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"\x8e\x05\n" + - "\fNodeSettings\x12>\n" + - "\x1bvault_optimizations_enabled\x18\x01 \x01(\bR\x19vaultOptimizationsEnabled\x12>\n" + - "\x1cvault_force_empty_ocr_rounds\x18\x02 \x01(\bR\x18vaultForceEmptyOcrRounds\x12=\n" + - "\x1bmax_ciphertext_length_bytes\x18\x03 \x01(\x04R\x18maxCiphertextLengthBytes\x12D\n" + - "\x1fmax_identifier_key_length_bytes\x18\x04 \x01(\x04R\x1bmaxIdentifierKeyLengthBytes\x12H\n" + - "!max_identifier_owner_length_bytes\x18\x05 \x01(\x04R\x1dmaxIdentifierOwnerLengthBytes\x12P\n" + - "%max_identifier_namespace_length_bytes\x18\x06 \x01(\x04R!maxIdentifierNamespaceLengthBytes\x123\n" + - "\x16max_share_length_bytes\x18\a \x01(\x04R\x13maxShareLengthBytes\x123\n" + - "\x16max_blob_payload_bytes\x18\b \x01(\x04R\x13maxBlobPayloadBytes\x12>\n" + - "\x1cmax_pending_queue_write_size\x18\t \x01(\x04R\x18maxPendingQueueWriteSize\x123\n" + - "\x16max_request_batch_size\x18\n" + - " \x01(\x04R\x13maxRequestBatchSize\"\x9b\b\n" + + "\amessage\x18\x01 \x01(\tR\amessage\"\xcf\x04\n" + + "\fNodeSettings\x12D\n" + + "\x1fmax_identifier_key_length_bytes\x18\x01 \x01(\x04R\x1bmaxIdentifierKeyLengthBytes\x12H\n" + + "!max_identifier_owner_length_bytes\x18\x02 \x01(\x04R\x1dmaxIdentifierOwnerLengthBytes\x12P\n" + + "%max_identifier_namespace_length_bytes\x18\x03 \x01(\x04R!maxIdentifierNamespaceLengthBytes\x123\n" + + "\x16max_share_length_bytes\x18\x04 \x01(\x04R\x13maxShareLengthBytes\x123\n" + + "\x16max_blob_payload_bytes\x18\x05 \x01(\x04R\x13maxBlobPayloadBytes\x12>\n" + + "\x1cmax_pending_queue_write_size\x18\x06 \x01(\x04R\x18maxPendingQueueWriteSize\x123\n" + + "\x16max_request_batch_size\x18\a \x01(\x04R\x13maxRequestBatchSize\x12>\n" + + "\x1bvault_optimizations_enabled\x18\b \x01(\bR\x19vaultOptimizationsEnabled\x12>\n" + + "\x1cvault_force_empty_ocr_rounds\x18\t \x01(\bR\x18vaultForceEmptyOcrRounds\"\x9b\b\n" + "\vObservation\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index fcbe6fe7cb..e69dcd14f9 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -139,16 +139,15 @@ message ObservationError { // DON-wide settings committed by per-field 2f+1 consensus. // Add fields freely; never reuse field numbers (use reserved instead). message NodeSettings { - bool vault_optimizations_enabled = 1; - bool vault_force_empty_ocr_rounds = 2; - uint64 max_ciphertext_length_bytes = 3; - uint64 max_identifier_key_length_bytes = 4; - uint64 max_identifier_owner_length_bytes = 5; - uint64 max_identifier_namespace_length_bytes = 6; - uint64 max_share_length_bytes = 7; - uint64 max_blob_payload_bytes = 8; - uint64 max_pending_queue_write_size = 9; - uint64 max_request_batch_size = 10; + uint64 max_identifier_key_length_bytes = 1; + uint64 max_identifier_owner_length_bytes = 2; + uint64 max_identifier_namespace_length_bytes = 3; + uint64 max_share_length_bytes = 4; + uint64 max_blob_payload_bytes = 5; + uint64 max_pending_queue_write_size = 6; + uint64 max_request_batch_size = 7; + bool vault_optimizations_enabled = 8; + bool vault_force_empty_ocr_rounds = 9; } message Observation { From efa34a227789eea250ca75b6dc5b5d393122e129 Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Thu, 3 Sep 2026 15:56:24 -0400 Subject: [PATCH 3/4] Removed unused flags --- pkg/capabilities/actions/vault/messages.pb.go | 25 +++---------------- pkg/capabilities/actions/vault/messages.proto | 6 +++-- 2 files changed, 8 insertions(+), 23 deletions(-) diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index 042e84321e..e6ddb85bc8 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -1,6 +1,6 @@ // Code generated by protoc-gen-go. DO NOT EDIT. // versions: -// protoc-gen-go v1.36.11 +// protoc-gen-go v1.36.12 // protoc v5.29.3 // source: capabilities/actions/vault/messages.proto @@ -1406,8 +1406,6 @@ type NodeSettings struct { MaxBlobPayloadBytes uint64 `protobuf:"varint,5,opt,name=max_blob_payload_bytes,json=maxBlobPayloadBytes,proto3" json:"max_blob_payload_bytes,omitempty"` MaxPendingQueueWriteSize uint64 `protobuf:"varint,6,opt,name=max_pending_queue_write_size,json=maxPendingQueueWriteSize,proto3" json:"max_pending_queue_write_size,omitempty"` MaxRequestBatchSize uint64 `protobuf:"varint,7,opt,name=max_request_batch_size,json=maxRequestBatchSize,proto3" json:"max_request_batch_size,omitempty"` - VaultOptimizationsEnabled bool `protobuf:"varint,8,opt,name=vault_optimizations_enabled,json=vaultOptimizationsEnabled,proto3" json:"vault_optimizations_enabled,omitempty"` - VaultForceEmptyOcrRounds bool `protobuf:"varint,9,opt,name=vault_force_empty_ocr_rounds,json=vaultForceEmptyOcrRounds,proto3" json:"vault_force_empty_ocr_rounds,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -1491,20 +1489,6 @@ func (x *NodeSettings) GetMaxRequestBatchSize() uint64 { return 0 } -func (x *NodeSettings) GetVaultOptimizationsEnabled() bool { - if x != nil { - return x.VaultOptimizationsEnabled - } - return false -} - -func (x *NodeSettings) GetVaultForceEmptyOcrRounds() bool { - if x != nil { - return x.VaultForceEmptyOcrRounds - } - return false -} - type Observation struct { state protoimpl.MessageState `protogen:"open.v1"` Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` @@ -2737,7 +2721,7 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\n" + "request_id\x18\x04 \x01(\tR\trequestId\",\n" + "\x10ObservationError\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"\xcf\x04\n" + + "\amessage\x18\x01 \x01(\tR\amessage\"\xd5\x03\n" + "\fNodeSettings\x12D\n" + "\x1fmax_identifier_key_length_bytes\x18\x01 \x01(\x04R\x1bmaxIdentifierKeyLengthBytes\x12H\n" + "!max_identifier_owner_length_bytes\x18\x02 \x01(\x04R\x1dmaxIdentifierOwnerLengthBytes\x12P\n" + @@ -2745,9 +2729,8 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x16max_share_length_bytes\x18\x04 \x01(\x04R\x13maxShareLengthBytes\x123\n" + "\x16max_blob_payload_bytes\x18\x05 \x01(\x04R\x13maxBlobPayloadBytes\x12>\n" + "\x1cmax_pending_queue_write_size\x18\x06 \x01(\x04R\x18maxPendingQueueWriteSize\x123\n" + - "\x16max_request_batch_size\x18\a \x01(\x04R\x13maxRequestBatchSize\x12>\n" + - "\x1bvault_optimizations_enabled\x18\b \x01(\bR\x19vaultOptimizationsEnabled\x12>\n" + - "\x1cvault_force_empty_ocr_rounds\x18\t \x01(\bR\x18vaultForceEmptyOcrRounds\"\x9b\b\n" + + "\x16max_request_batch_size\x18\a \x01(\x04R\x13maxRequestBatchSizeJ\x04\b\b\x10\n" + + "\"\x9b\b\n" + "\vObservation\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index e69dcd14f9..b2460e3e3b 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -146,8 +146,10 @@ message NodeSettings { uint64 max_blob_payload_bytes = 5; uint64 max_pending_queue_write_size = 6; uint64 max_request_batch_size = 7; - bool vault_optimizations_enabled = 8; - bool vault_force_empty_ocr_rounds = 9; + // 8-9 reserved: retired vault_optimizations_enabled and + // vault_force_empty_ocr_rounds; the former flag was retired and the latter is + // a per-node emergency lever that must not be consensus-governed. + reserved 8 to 9; } message Observation { From 27c6a4a2546c78c4a4def21bf432e92fd21f6223 Mon Sep 17 00:00:00 2001 From: Russell Stern Date: Thu, 3 Sep 2026 16:01:43 -0400 Subject: [PATCH 4/4] Removed reserved fields --- pkg/capabilities/actions/vault/messages.pb.go | 5 ++--- pkg/capabilities/actions/vault/messages.proto | 4 ---- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go index e6ddb85bc8..abeecce836 100644 --- a/pkg/capabilities/actions/vault/messages.pb.go +++ b/pkg/capabilities/actions/vault/messages.pb.go @@ -2721,7 +2721,7 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\n" + "request_id\x18\x04 \x01(\tR\trequestId\",\n" + "\x10ObservationError\x12\x18\n" + - "\amessage\x18\x01 \x01(\tR\amessage\"\xd5\x03\n" + + "\amessage\x18\x01 \x01(\tR\amessage\"\xcf\x03\n" + "\fNodeSettings\x12D\n" + "\x1fmax_identifier_key_length_bytes\x18\x01 \x01(\x04R\x1bmaxIdentifierKeyLengthBytes\x12H\n" + "!max_identifier_owner_length_bytes\x18\x02 \x01(\x04R\x1dmaxIdentifierOwnerLengthBytes\x12P\n" + @@ -2729,8 +2729,7 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" + "\x16max_share_length_bytes\x18\x04 \x01(\x04R\x13maxShareLengthBytes\x123\n" + "\x16max_blob_payload_bytes\x18\x05 \x01(\x04R\x13maxBlobPayloadBytes\x12>\n" + "\x1cmax_pending_queue_write_size\x18\x06 \x01(\x04R\x18maxPendingQueueWriteSize\x123\n" + - "\x16max_request_batch_size\x18\a \x01(\x04R\x13maxRequestBatchSizeJ\x04\b\b\x10\n" + - "\"\x9b\b\n" + + "\x16max_request_batch_size\x18\a \x01(\x04R\x13maxRequestBatchSize\"\x9b\b\n" + "\vObservation\x12\x0e\n" + "\x02id\x18\x01 \x01(\tR\x02id\x125\n" + "\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" + diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto index b2460e3e3b..6ca4624180 100644 --- a/pkg/capabilities/actions/vault/messages.proto +++ b/pkg/capabilities/actions/vault/messages.proto @@ -146,10 +146,6 @@ message NodeSettings { uint64 max_blob_payload_bytes = 5; uint64 max_pending_queue_write_size = 6; uint64 max_request_batch_size = 7; - // 8-9 reserved: retired vault_optimizations_enabled and - // vault_force_empty_ocr_rounds; the former flag was retired and the latter is - // a per-node emergency lever that must not be consensus-governed. - reserved 8 to 9; } message Observation {