feat: gate allnodes zero-copy on mainnet

[POPPIN-FUMI]

Summary

• update mainnet Allnodes-Jito source version to 4.2.1 while leaving testnet unchanged
• add fail-closed mainnet-only Allnodes-Jito XDP zero-copy validation
• validate testnet selections before inventory persistence and add focused unit controls

Verification

• cd cli && deno test -A --config=deno.json test/unit/allnodes_xdp_config.test.ts
• deno check cli/src/validator/init/promptXdpConfig.ts (repository Deno rejects the packet's -A option for deno check)
• deno run -A scripts/check-version-sync.ts
• git diff --check
• published numbered template byte-identical to pinned base

Source-only change; no template/install/release materialization, ring selection, hidden runtime settings, or production action.

[POPPIN-FUMI]

auron gate claim / round 1 / 対象 16fa629 / auron-slv-pr408-a4210408

[POPPIN-FUMI]

auron / round 1 / 対象 16fa629

Verdict: FAIL — CHANGES_REQUIRED

Blocking finding

1. cli/test/unit/allnodes_xdp_config.test.ts:31 is not in canonical Deno format. deno fmt --check over the five changed TypeScript files exits 1 and reports only this new file, rewriting the multiline for (const config of [...]) header. Please run deno fmt cli/test/unit/allnodes_xdp_config.test.ts and commit the result. This is source introduced by this PR, not carried baseline debt.

Requirements fulfillment

Apart from the formatting failure, the exact diff implements the stated source-only boundary correctly: Allnodes-Jito joins the existing XDP prompt only for the newly supported path; testnet zero-copy validation executes before addInventory; mainnet zero-copy requires an enabled, nonblank explicit interface, an integer XDP CPU count greater than zero, and a PoH CPU index at or above the XDP count (disjoint from the implied 0..count-1 range). Agave/Jito zero-copy returns through the pre-existing compatibility path. The mainnet Allnodes version resolves to 4.2.1 and the existing template construction produces v4.2.1-allnodes; testnet remains 3.1.14. The public upstream tag exists.

Non-regression

Landing baseline is origin/main at fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b. The changed-path set is exactly the requested five files. Published template/**, sh/install, the numbered install, dist/**, and release-assets/** compare byte-identical between base and HEAD; the template tree and root install blob IDs are identical. Added-line inspection found no ring selection, QUIC/scheduler/BAM override, production-like coordinate/path/argv, CalVer/release/publish change, or runtime/native-progress claim.

Frame: exact Git objects fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b..16fa62937417a0077dd0d6325551a6aebbdc91d0, the five-file diff, and the current published template/install artifact trees consumed by the existing version/tag path.

Counterfactual: if the new test were canonically formatted, the same deno fmt --check command would exit 0; it exits 1 with a concrete rewrite. If forbidden release/runtime material or numbered-template drift existed in this exact diff, the changed-path/added-line scans or base-vs-HEAD tree/blob comparison would change rather than return the observed clean result.

Checks run

• cd cli && deno test -A --config=deno.json test/unit/allnodes_xdp_config.test.ts — 6 passed, 0 failed.
• deno check --config=cli/deno.json cli/src/validator/init/promptXdpConfig.ts cli/test/unit/allnodes_xdp_config.test.ts — passed.
• deno check over the three init modules — HEAD and exact base both report the same four pre-existing Cliffy region-selection type errors; no PR-introduced type drift was observed.
• deno run -A scripts/check-version-sync.ts — passed for existing SLV CalVer 2026.6.6.2026.
• deno eval through defaultVersionsObject() — mainnet 4.2.1, testnet 3.1.14, constructed tags v4.2.1-allnodes / v3.1.14-allnodes.
• git ls-remote --tags https://github.com/allnodes/solana-jito.git refs/tags/v4.2.1-allnodes — tag present.
• git diff --check — passed; exact changed paths verified; published artifact tree/blob comparison passed with a changed-constant positive control.
• deno fmt --check on the changed TypeScript files — failed on the new unit test as described above.

Unverified

• No interactive terminal prompt session or live validator execution was performed.
• No release, publish, deploy, host, or other production action was performed.
• GitHub Run Tests was still queued at review time; I did not wait on that unrelated broader suite after the focused test completed.

Cyan may not proceed on this head. Re-review the formatting-only follow-up at the new exact head.

[POPPIN-FUMI]

auron gate claim / round 2 / 対象 8f8290e / auron-slv-pr408-a4210408

[POPPIN-FUMI]

auron / round 2 / 対象 8f8290e

Verdict: PASS

Round-1 closure

Prior review 4957943967 requested canonical formatting of cli/test/unit/allnodes_xdp_config.test.ts. The only delta from prior head 16fa62937417a0077dd0d6325551a6aebbdc91d0 is that formatter rewrite in the same test file. deno fmt --check now passes across all five changed TypeScript files.

Semantic identity was independently checked by compiling both prior-head and current-head versions of the test with TypeScript 5.9.3 transpileModule, reportDiagnostics: true, ES2022/ESNext, and comment removal: both emitted 1,574 nonzero bytes and were byte-identical. A sentinel source change to the synthetic interface string produced different emit, confirming that the comparator detects a semantic change.

Requirements fulfillment

The exact-head source contract remains correct: Allnodes-Jito receives the XDP prompt on mainnet; zero-copy rejects non-mainnet before testnet addInventory; zero-copy requires XDP enabled, a trimmed explicit interface, a positive integer XDP CPU count, and a PoH pinned CPU index outside the implied 0..count-1 XDP range. Agave/Jito zero-copy preserves its prior compatibility path. Mainnet Allnodes resolves to 4.2.1 and the existing template path constructs v4.2.1-allnodes; testnet remains 3.1.14. Both public upstream tags resolve.

Requirements fulfillment: PASS against the PR acceptance criteria and the supplied exact-head contract.

Non-regression

Landing baseline is origin/main at fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b. The base-to-HEAD changed-path set remains exactly the requested five files. Published template/**, root and numbered install files, dist/**, and release-assets/** are byte-identical; base and HEAD have identical template tree and root-install blob IDs. Added-line inspection found no ring selection, QUIC/scheduler/BAM override, hidden runtime defaults, production-like coordinate/path/argv, CalVer/release/publish change, or runtime/native-progress claim.

Non-regression: PASS relative to origin/main fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b.

Frame: exact Git objects fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b..8f8290e970b727f1f664e5744857f97c2853769b, plus the prior-head closure frame 16fa62937417a0077dd0d6325551a6aebbdc91d0..8f8290e970b727f1f664e5744857f97c2853769b; reviewed containers are the five-file source diff and existing published template/install trees consumed by the version/tag path.

Counterfactual: if the follow-up changed behavior rather than formatting, compiler emit would differ (the sentinel proves the comparator detects such a change). If forbidden release/runtime material or numbered-template drift existed, the changed-path/added-line scans or base-vs-HEAD tree/blob comparisons would change rather than return the observed clean result.

Checks run

• deno fmt --check on all five changed TypeScript files — passed (Checked 5 files).
• cd cli && deno test -A --config=deno.json test/unit/allnodes_xdp_config.test.ts — 6 passed, 0 failed.
• deno check --config=cli/deno.json for promptXdpConfig.ts plus the focused test — passed.
• Broader check over both init modules — the same four pre-existing Cliffy region-selection errors seen on the exact base remain; no PR-introduced type error was observed.
• TypeScript compiler-emit no-op comparison with diagnostics, nonempty-output assertions, and semantic sentinel — passed.
• deno run -A scripts/check-version-sync.ts — passed for unchanged SLV CalVer 2026.6.6.2026.
• defaultVersionsObject() evaluation — mainnet 4.2.1, testnet 3.1.14, constructed tags v4.2.1-allnodes / v3.1.14-allnodes.
• git ls-remote --tags for the two Allnodes tags — both present.
• git diff --check, exact changed-path inspection, forbidden-added-line scan, and published artifact tree/blob comparison — passed.

Unverified / separate conditions

• GitHub Run Tests remains queued at review time. Local focused evidence is complete, but required CI completion remains a separate merge condition.
• No interactive terminal prompt session or live validator execution was performed.
• No release, publish, deploy, host, or other production action was performed.

Cyan may proceed on this exact-head infrastructure verdict. Merge must still respect the queued required CI result.

[POPPIN-FUMI]

cyan gate claim / round 1 / 対象 8f8290e / 70eaaae7

[POPPIN-FUMI]

cyan / round 1 / 対象 8f8290e

Frame: exact landing base fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b (origin/main) to exact head 8f8290e970b727f1f664e5744857f97c2853769b, with the requested source contract and the five changed files as the review population. The PR is OPEN at this head. Prior infrastructure gate receipt 4958048360 is bound to the same 40-character head and its first line is auron / round 2 / 対象 8f8290e970b727f1f664e5744857f97c2853769b.

CONTROL: forbidden-added-line predicate = ring|quic|scheduler|bam|calver|tag|release|publish|promot|livemode|production|deploy|coordinate|https?://|/home/|IPv4. The synthetic forbidden fixture produced one nonempty hit; the safe XDP sentinel produced zero; the exact PR added lines produced zero. Artifact comparator control: the known changed cmn/constants/version.ts produced 631 diff bytes; base-to-base published artifacts produced zero; base-to-HEAD template, sh, dist, and release-assets produced zero. Scope closure: local Git and GitHub each report five changed files, and the exact expected-path comparison is empty.

Counterfactual: if this head introduced a ring selection, QUIC/scheduler/BAM default, promotion/release material, or a live coordinate, the controlled added-line predicate would return a target hit rather than zero. If published template/install content changed, the base-to-HEAD artifact comparator would be nonzero and the tree/blob IDs would differ. If the PR introduced the broader init-module type errors, the same command on the exact base would not reproduce the same four diagnostics at the same source locations.

Verdict: PASS — exact-head final code gate.

Requirements fulfillment

The Allnodes-Jito source version resolves to mainnet 4.2.1 and testnet 3.1.14; the pre-existing template constructor therefore resolves v4.2.1-allnodes and v3.1.14-allnodes, and both upstream tags exist. Allnodes-Jito zero-copy now rejects non-mainnet, disabled or blank-interface configurations, absent/non-integer/non-positive XDP CPU allocations, and absent/non-integer/overlapping PoH CPU declarations. A valid explicit mainnet declaration is returned unchanged. The strict branch is after the existing Agave/Jito compatibility return, so those paths remain unchanged. In testnet init, validation is visibly ordered before addInventory, so a rejected zero-copy selection cannot persist testnet inventory state.

Requirements fulfillment: PASS against the supplied exact-head contract.

Non-regression and scope

The base-to-HEAD scope is exactly:

• cli/src/validator/init/initMainnetConfig.ts
• cli/src/validator/init/initTestnetConfig.ts
• cli/src/validator/init/promptXdpConfig.ts
• cli/test/unit/allnodes_xdp_config.test.ts
• cmn/constants/version.ts

Existing Agave and Jito zero-copy behavior is preserved, testnet Allnodes non-zero-copy configuration remains unchanged, and Allnodes testnet stays on 3.1.14. Added-line inspection and the controlled negative scan found no ring hardwire or promotion, no QUIC/scheduler/BAM default, and no CalVer, repository tag, release/publish, deploy, or live coordinate materialization. VERSION remains 2026.6.6.2026. Published template/**, root and numbered sh/** install content, dist/**, and release-assets/** are byte-identical; base and HEAD have identical template, sh, dist, release-assets tree IDs and identical root-install blob IDs.

Non-regression: PASS relative to exact landing base fb6d063d6835d2b1b0cf8abe39b9a6c9008cf37b.

Checks run

• deno fmt --check on the five changed TypeScript files — passed (Checked 5 files).
• cd cli && deno test -A --config=deno.json test/unit/allnodes_xdp_config.test.ts — 6 passed, 0 failed.
• deno check --config=cli/deno.json cli/src/validator/init/promptXdpConfig.ts cli/test/unit/allnodes_xdp_config.test.ts — passed.
• Validation matrix against the exact exported validator — all nine invalid Allnodes cases rejected; valid mainnet, Jito testnet, and Agave testnet controls remained unchanged.
• Broader deno check --config=cli/deno.json cli/src/validator/init/initMainnetConfig.ts cli/src/validator/init/initTestnetConfig.ts — HEAD reports four Cliffy region-selection diagnostics; the exact same command at base reports the same four diagnostics at the same lines. No PR-introduced broader diagnostic was observed.
• deno run -A scripts/check-version-sync.ts — passed for unchanged SLV CalVer 2026.6.6.2026.
• defaultVersionsObject() evaluation and existing template inspection — mainnet/testnet Allnodes versions and constructed tags resolve as stated.
• git ls-remote --tags https://github.com/allnodes/solana-jito.git for v4.2.1-allnodes and v3.1.14-allnodes — both tags resolved.
• git diff --check, exact local/GitHub path closure, controlled forbidden-added-line scan, and published-artifact tree/blob comparison — passed.
• Required prior Auron review 4958048360 — exact-head binding, gate-form first line, and substantive body read back successfully.

Unverified / unresolved merge condition

• GitHub Run Tests is still QUEUED at review time; the PR reports merge state UNSTABLE. This does not invalidate the completed exact-head code review, but it is an unresolved merge condition: do not merge unless that required CI job completes successfully at this same head.
• No interactive prompt session or live validator process was executed.
• No release, publish, merge, deploy, host, tag creation, or other production action was performed.

[POPPIN-FUMI]

auron gate claim / round 3 / 対象 20e15fd / auron-slv-pr408-c3bc1c3d

[POPPIN-FUMI]

auron / round 3 / 対象 20e15fd

Verdict: PASS

Frame: exact landing base 4753120c7da8380a8bbabf1d71dcb2e080a1d52b to exact head 20e15fd9e0d8088fd4b169d302de12f4d8fb6d6e; review population is the five-file base-to-head source diff plus the merge-provenance delta from prior reviewed source head 8f8290e970b727f1f664e5744857f97c2853769b. GitHub reports the PR OPEN/CLEAN.

Merge provenance and scope

The head is a two-parent merge whose parents are, in order, prior reviewed source head 8f8290e970b727f1f664e5744857f97c2853769b and current main 4753120c7da8380a8bbabf1d71dcb2e080a1d52b. Local Git and the GitHub commit API agree. Base-to-head contains exactly the requested five files: the three init modules, the focused unit test, and cmn/constants/version.ts. Prior-head-to-new-head contains only .github/workflows/slv-remote-build.yml; that workflow blob is byte-identical to current main. Each of the five source blobs is byte-identical between the prior reviewed head and this head. This is therefore a source-neutral main merge.

Requirements fulfillment

Requirements fulfillment: PASS against the dispatch-supplied source contract. Allnodes-Jito resolves to mainnet 4.2.1 and testnet 3.1.14; the existing constructor yields v4.2.1-allnodes and v3.1.14-allnodes, and both upstream tags resolve. Allnodes-Jito zero-copy is mainnet-only and requires XDP enabled, a nonblank explicit interface, a positive integer XDP CPU allocation, and an integer PoH CPU outside the implied XDP range. Testnet validation occurs before addInventory. Non-zero-copy Allnodes testnet and existing Agave/Jito zero-copy compatibility paths remain unchanged.

Non-regression and controls

Non-regression: PASS relative to exact landing base 4753120c7da8380a8bbabf1d71dcb2e080a1d52b. VERSION remains 2026.6.6.2026. The exact five-file closure excludes ring selection, QUIC/scheduler/BAM settings, live coordinates, runtime enablement claims, and release/publish/CalVer allocation. template, sh, dist, and release-assets tree IDs, plus root and numbered install blobs, are identical between base and head; the comparator simultaneously reports the deliberately changed version-constant blob as different.

CONTROL: the forbidden-added-line predicate finds the synthetic forbidden fixture (1 hit), finds the safe XDP fixture (0), and finds the exact PR added lines (0). The validation matrix rejected 12 invalid Allnodes cases, accepted the valid explicit mainnet case, preserved disabled testnet non-zero-copy, and preserved two Agave/Jito controls. The inventory-order detector reports validation at line 101 before mutation at line 108; a synthetic reversed fixture reports the opposite ordering.

Counterfactual: if the merge altered source, any of the five old-head/new-head blob comparisons would differ. If the workflow were not inherited byte-identically from main, the base/head workflow comparison would differ. If forbidden runtime/release material were present, the controlled predicate would return a nonzero exact-diff hit. If validation followed inventory persistence, the measured ordering predicate would reverse.

Checks run

• deno fmt --check on all five changed TypeScript files — passed (Checked 5 files).
• cd cli && deno test -A --config=deno.json test/unit/allnodes_xdp_config.test.ts — 6 passed, 0 failed.
• deno check --config=cli/deno.json for promptXdpConfig.ts and the focused test — passed.
• Exact exported-validator matrix — 12 invalid Allnodes cases rejected; valid/compatibility controls passed.
• deno run -A scripts/check-version-sync.ts — passed for 2026.6.6.2026.
• defaultVersionsObject() evaluation and upstream tag lookup — mainnet/testnet values and both tags resolved as stated.
• git diff --check, exact local/GitHub path closure, parent/blob identity checks, controlled forbidden scan, inventory-order check, and published-artifact tree/blob comparison — passed.
• Hosted run 32112746579 is bound to this exact head and completed successfully: Run Tests job 95635551434 SUCCESS on ubuntu-latest; Build macOS Binaries job 95635552508 SKIPPED; Remote Build and Release job 95635895552 SKIPPED.

Unverified

• No interactive prompt session or live validator process was executed.
• No release, publish, merge, deploy, host, tag creation, or other production action was performed.
• No unrelated broad local suite was rerun; the exact hosted CI run and focused local checks above are the verified test evidence.

[POPPIN-FUMI]

cyan gate claim / round 2 / 対象 20e15fd / cyan-slv-pr408-01a013de

[POPPIN-FUMI]

cyan / round 2 / 対象 20e15fd

Verdict: PASS

Frame: current landing base/main 4753120c7da8380a8bbabf1d71dcb2e080a1d52b; exact head 20e15fd9e0d8088fd4b169d302de12f4d8fb6d6e; prior reviewed source head 8f8290e970b727f1f664e5744857f97c2853769b. GitHub reports PR #408 OPEN/CLEAN. This is an independent final exact-head/current-base review after Auron.

Requirement fulfillment

PASS against the dispatch-defined source contract. defaultVersionsObject() evaluates Allnodes-Jito to mainnet 4.2.1 and testnet 3.1.14, constructing v4.2.1-allnodes and v3.1.14-allnodes; both refs currently resolve in allnodes/solana-jito. Allnodes zero-copy is accepted only on mainnet with XDP enabled, a nonblank explicit interface, a positive integer XDP CPU count, and an integer PoH core outside the implied XDP range. The testnet call validates before addInventory; non-zero-copy Allnodes testnet and existing Jito/Agave zero-copy behavior remain accepted.

Provenance, scope, and non-regression

The head is a two-parent merge with parents, in order, 8f8290e970b727f1f664e5744857f97c2853769b and 4753120c7da8380a8bbabf1d71dcb2e080a1d52b. Base-to-head is exactly five source files: the three init modules, focused unit test, and cmn/constants/version.ts. Old-source-head-to-head changes only .github/workflows/slv-remote-build.yml. All five source blob IDs are unchanged from the old source head; the workflow blob is identical to current main. VERSION remains 2026.6.6.2026.

Non-regression: PASS relative to exact landing base 4753120c7da8380a8bbabf1d71dcb2e080a1d52b. template, sh, dist, and release-assets tree IDs are unchanged. A controlled added-line predicate detected a synthetic tag_name fixture, did not fire on a safe XDP fixture, and found no CalVer/tag/release/publish/deploy/live-coordinate/runtime-command material in the exact PR additions. The exact workflow/run evidence also shows the release jobs skipped; no tag, release, publish, deploy, or live operation was performed by this review.

Independent checks

• deno fmt --check on all five changed TypeScript files: passed (Checked 5 files).
• Focused deno test -A --config=deno.json test/unit/allnodes_xdp_config.test.ts: 6 passed, 0 failed.
• deno check --config=cli/deno.json on promptXdpConfig.ts and its focused test: passed.
• Direct validator matrix: 9/9 invalid Allnodes zero-copy cases rejected; valid explicit mainnet, disabled testnet non-zero-copy, Jito, and Agave controls accepted.
• deno run -A scripts/check-version-sync.ts: passed for 2026.6.6.2026.
• Git/GitHub parent, path-closure, blob/tree identity, upstream tag, and current PR/base/head checks: passed.
• Auron review 4958591976: COMMENTED, exact commit_id 20e15fd9e0d8088fd4b169d302de12f4d8fb6d6e, proper round-3 header, 4,552-character substantive body, and explicit exact-base frame.
• Hosted run 32112746579: pull_request, exact head, completed success. Job 95635551434 (Run Tests) succeeded on ubuntu-latest; 95635552508 (macOS) skipped; 95635895552 (Remote Build and Release) skipped.

Counterfactual: if the merge changed source, at least one of the five old-head/head blob IDs would differ. If the workflow were not inherited byte-for-byte from current main, its base/head blob IDs would differ. If release/live material had entered the additions, the controlled predicate would return a target hit. If the zero-copy contract were inverted or validation occurred after persistence, the matrix or measured call ordering would differ; neither observation is compatible with the measured head.

Unverified

• No interactive prompt session or live validator process was exercised.
• No release, publish, merge, deploy, host, tag creation, or production operation was performed.
• No unrelated broad test suite was rerun; the exact hosted run and focused independent checks above are the verified evidence.