Skip to content

README.md

Latest commit

 

History

History
289 lines (164 loc) · 79.4 KB

README.md

File metadata and controls

289 lines (164 loc) · 79.4 KB
Raw

Scripts Layer

This directory is the deterministic operator/developer automation layer of the DEOS reference stack. It supports testing, validation, benchmarking, generation, build, deployment preparation, local-network operation, release work, and repeatable coordination across /docs, /template, and /web-client; it is not the primary conceptual control plane.

The pre-1.0 release line accepts only fresh-genesis candidates. Local full validation does not certify an upgrade from an earlier release, a deployed storage lineage, or a network launch.

This directory contains deterministic command surfaces, not agent strategy:

  • Numbered scripts are reusable atomic operations. They may depend on _common.sh, external tools, and artifacts on disk, but they do not orchestrate other numbered scripts.
  • Named implementations are deterministic operator utilities or compositions whose mode and outcome need no agent interpretation.
  • Shared implementations stay here whenever humans, GitHub Actions, CI, root compositions, or multiple skills invoke them.
  • Agent-owned workflows live under /.agents/skills/<domain> when they require scope selection, coordination, evidence interpretation, knowledge synchronization, or handoff judgment; they call public root scripts for shared execution.
  • Validation entrypoints distinguish focused domain/package tests, development profiles, CI checks, and release/full validation while retaining one comprehensive project-owned route. They compose only project-owned surfaces; a required check found inside a Skill must move here or to its package owner rather than be invoked across the boundary.
  • Full named/admin implementations follow usage -> parse_args -> check_prerequisites/plan -> main.
  • All entrypoints expose --help and keep declared environment/behavior contracts honest.

Language Boundary

Public root orchestration uses Bash for process lifecycle, environment and toolchain control, filesystem operations, signal-safe cleanup, and composition of existing commands. JavaScript ES modules are support leaves for deterministic structural transformation or validation when JSON, metadata, graph traversal, exact integer handling, or testable data semantics would be unsafe or obscure in shell. They remain behind an owning Bash or package entrypoint and must not grow into a parallel orchestration layer.

The split follows workload semantics rather than directory or product language: Bash controls actions, while JavaScript understands structured data. Do not replace a clear shell composition with Node merely to unify extensions, and do not encode structural programs as sed/awk/jq pipelines merely to keep a .sh suffix. A root JavaScript support leaf must have a concrete structural owner that cannot be represented safely by the runtime, package, or an existing native tool; 04-generate-chain-spec.sh, for example, consumes the complete runtime-owned preset directly instead of maintaining a second JavaScript genesis projection.

Do not add Python automation. One bootstrap exception exists: setup-environment.sh reads rust-toolchain.toml through python3 with tomllib, because Node has no built-in TOML parser and the Rust toolchain must be installable before any Node runtime is pinned. That exception covers TOML parsing only, and the script checks for tomllib as a named prerequisite. Every JSON read in that script uses Node, matching _common.sh.

Executable Ownership Inventory

Path classes provide the inventory without duplicating the per-command map below:

Path class Classification and owner Consumer contract
/scripts/[0-9][0-9]-*.sh Shared human-callable atoms; root scripts layer Humans, CI, workflows, and skills call the owning file directly
/scripts/<name>.sh Shared deterministic compositions/admin utilities; root scripts layer Shared consumers call one canonical implementation; _common.sh remains support-only
/.agents/skills/alignment/scripts/* Agent-only project audit and completion capability The Alignment Skill invokes its own leaves; project validation does not depend on them
/.agents/skills/domain-dag/scripts/* Independent graph-validator capability The Domain DAG Skill invokes its own validator; project packages and scripts do not depend on it
/web-client/scripts/*.mjs Client-package entrypoints or thin capability bridges; web client npm owns invocation; bridges contain no duplicated validator semantics

GitHub workflows invoke root shared implementations only. Skills never call sibling skill internals, support files are not public entrypoints, and a consumer references the canonical owner rather than maintaining a second executable copy.

Human-Callable Atomic Scripts

Each numbered command is independently callable by a human or CI from any working directory. Its --help declares inputs, outputs, side effects, and configurable environment. The command checks its own prerequisites and never invokes another numbered command. Numbers form the logical local-network evidence ladder—binary prerequisites, Cargo tools, runtime, ChainSpec, network, liveness, basic mutation, temporal consensus, then composed economics—without making an atom depend implicitly on earlier scripts.

  • pvf-assurance.sh Opt-in offline candidate acceptance through the workspace deos-pvf-validation host and actual pinned prepare/execute workers. Requires an existing runtime-owned PVF export plus caller-supplied para identity; verifies both required worker checksums and SDK versions without requiring unrelated node/bencher binaries or a full-bundle marker, binds complete expected outputs, tests corrupt Aura seals/parent roots/compact proofs and rejects timeout/infrastructure outcomes as negative evidence. Secure mode is default; --insecure-local is an explicit narrower trusted-code profile. Native prerequisites are Perl core modules, protoc and C/C++/OpenSSL build support. No runtime/node/Weight mutation or candidate-network/account operation; Cargo may fetch locked build dependencies. The SDK integration owner retains current identity and scope. Optional --cpu-trace FILE creates fail-closed diagnostic JSONL; the tool README owns its event, completion and non-calibration contract.

  • 01-download-binaries.sh Download the pinned Polkadot SDK stable2609 relay node, Omni Node, preparation/execution workers, and frame-omni-bencher for Linux x86_64 or macOS arm64, verify repository-recorded SHA-256 digests before publishing the complete bundle under ignored /bin, and reject unsupported platforms rather than selecting an approximate asset. --check verifies the existing release marker, checksums, executable bits, and binary identities without downloading. Repeat --only NAME to download/check just the pinned tools a caller needs; omitted selection still means all five. Partial mode never writes the full-bundle marker or verifies unselected/corrected-node artifacts, and rejects corrected-node selection environment variables. --self-test exercises offline selection, staged checksum refusal and partial/full publication; canonical validation composes it. The macOS bundle is checksum-pinned but local execution qualification is Linux-only. Its official Omni lacks the client transaction-depth correction. Supply an independently qualified source-built Omni through DEOS_OMNI_NODE_PATH and its expected DEOS_OMNI_NODE_SHA256 to install the separate polkadot-omni-node-deos command and selection receipt. The official bundle remains intact; receipt/checksum verification establishes artifact identity, while the SDK integration owner owns source and caller qualification.

  • 02-install-tools.sh Install exact versions of Zombienet and Chain Spec Builder plus Try Runtime from one immutable Git revision. Existing commands are reused only when their reported version matches the repository pin.

  • 03-build-runtime.sh Stage the template at one fixed fail-closed physical build root, build the current deos-runtime Wasm from the locked graph and pinned Rust toolchain with the existing fat-LTO/single-codegen-unit production profile, remap source/Cargo/Rustup roots to canonical virtual prefixes, atomically publish only the successful artifact, then report its size and SHA-256 digest. Default execution replaces canonical output. --output FILE instead exclusively creates a new artifact in an existing directory, excluding the canonical destination and refusing existing files/symlinks/directories and publication races without touching production output or identity pins. The same build/profile remains authoritative; this is not a second builder. --self-test checks output/argument contracts with temporary byte fixtures and no Rust/build/install; fast validation includes it.

  • 04-generate-chain-spec.sh Generate and verify raw-storage chain-spec output directly from the complete runtime-owned Development or Local preset in the selected DEOS runtime Wasm. Raw storage prevents Zombienet from replacing preset authorities or economic state. Isolated temporary generation prevents a failed candidate from overwriting template/chain_spec.json; the script supplies only outer ChainSpec metadata, rejects a para ID that disagrees with the reference preset, and exposes no pseudo-Live profile or second economic-policy projection. Collator names select the preset's Alice and Bob session keys; Zombienet gives them the distinct process names alice-1 and bob-1. Both relay validators may back the leased parachain core.

  • 05-spawn-zombienet.sh Spawn the local Zombienet network from a selected work directory, topology, and matching raw-storage chain spec. Verify the selected Omni command against its SDK marker and receipt before starting processes; the reference topology uses polkadot-omni-node-deos. Reject plain genesis input so Zombienet cannot replace runtime-owned state. Custom topologies own their node commands. Defaults remain the current template candidate; deployed downstream runtimes may select an explicit persisted work directory and matching upgrade artifact after 1.0.

  • 06-network-smoke.sh Observe bounded finalized progression from the relay chain and both configured collator RPC views without submitting state transitions. This smoke check never substitutes for collator-author participation or the open composed-path acceptance contract.

  • 07-network-e2e.sh Submit one signed Alice-to-Bob native transfer through a running node and verify finalized dispatch success, the live transfer event, and finalized recipient storage. This proves the network assertion path but not the open Router/Oracle/Actors composed scenario.

  • 08-session-transition.sh Observe one finalized session-index transition through both collator RPC views, requiring continued finalized progress and an equal non-empty validator set. The read-only proof may run for several hours.

  • 09-composed-economic-path.sh Prepare local pool state, execute one finalized Native-to-foreign Router swap, and reconcile Router and Oracle events, exact pool and balance deltas, one Burn Actor cycle, no duplicate execution, and native issuance reduction from finalized storage.

Deterministic Compositions

  • setup-environment.sh Prepare the repository-pinned Rust environment, or clear generated SvelteKit state and install the pinned Node/npm client from its lockfile; full mode prepares both environments. Wiki projection and OKF tooling remain owned and prepared by the wiki-sync Skill rather than project validation.

  • network-assurance-local.sh Default mode prepares pinned tools/artifacts, spawns the canonical two-validator/two-collator topology, verifies both collators prepare blocks, pause one collator while the other preserves finality, restart the second collator from its existing base path, and execute signed finalized transfers before and after restart. SESSION_TRANSITION=1 adds the multi-hour finalized session check, while COMPOSED_PATH=1 adds the mutating Router/Oracle/Burn Actor check. The command terminates and verifies every owned process unless --keep-network is selected. --prepared-smoke instead reuses an approved selected node and prepared raw ChainSpec/topology, runs only finalized RPC smoke and collator block-preparation evidence, and always cleans up. It rejects keep/session/composed options and excludes builds, regeneration, signing, failover/restart and all transaction proofs. --prepared-recovery adds owned primary pause/resume and secondary crash/restart with exact complete historical TOP/header comparison and stable database reopening, without signed calls. Prepared modes are mutually exclusive. NETWORK_WORK_DIR, ZOMBIENET_CONFIG and CHAIN_SPEC_PATH select their isolated inputs. --self-test proves smoke/recovery/full routing, excluded-mode guards and strict snapshot parsing with jq, without network or project mutation; fast validation includes it. All modes exclude tag-bound, runtime-upgrade and publication claims.

  • bootstrap-local-network.sh Run the local bootstrap chain: tools -> runtime build -> chain spec -> Zombienet, using Polkadot and Omni Node binaries already available in PATH or ./bin. Start the web client directly from web-client with npm run dev.

  • validate-local.sh Prepare pinned repository dependencies and directly run the selected fast, heavy, or full validation profile. Fast owns simulator tests and workspace CI; heavy adds client, Actors, and benchmark checks; full additionally prepares the checksum-verified binary bundle, then builds the production runtime and regenerates metadata and client artifacts with zero worktree drift. GitHub Actions runs heavy validation through the required pull-request validation-gate with SKIP_WASM_BUILD=1; this explicitly omits only Wasm identity while retaining Actors source, Weight, metadata, behavioral, and heavy-profile assurance. Local full validation owns pre-1.0 release acceptance. No Skill audit, cache, hidden authority, network run, or release action is involved.

  • actors-assurance.sh Shared current-tree Actors proof contract for semantic-manifest and fee-envelope-vector freshness, cross-language semantics, scheduler stress, capacity, and independent-runtime embedding. --exact-heavy-profile NAME runs one profile from the gate's declared runtime/package heavy inventory, verifies that it resolves exactly once, and preserves the same source/artifact identity boundary without replaying unrelated heavy predecessors. --production-reference-replay separately runs the one ignored full-block StorageProof replay against the currently pinned production Wasm rather than allowing an ordinary filtered test command to report a skipped test as evidence. By default the broad gate reports and preserves exact source, production Weight, production Wasm, and metadata identities. A caller that intentionally cannot build Wasm may set REQUIRE_WASM_IDENTITY=0; the script reports that narrower evidence boundary while retaining every non-Wasm check. Historical transition replay is release history rather than a routine validation dependency.

    --integrated-w0-w1 selects the bounded preparation gate instead of the broad suite. It authors complete W0 empty/one-Step blocks and a 128-Actor W1 falsifier through runtime-created inherents, full Executive hooks and finalization under Actor-only and continuously saturated valid user demand, then independently replays the accepted production Wasm with recorded StorageProof and CompactProof. This proves the measurement path and identity binding, not closure of the historical 10,000-Actor reference horizon. --integrated-w1-actor-only and --integrated-w1-continuous-user preserve the reference preset's 15 System Actor identities (three active and twelve dormant), fill the remaining identity capacity with 9,985 mixed Manual/Cadenced workload Actors, author 100 linked finalized blocks, and exact-Wasm proof-replay every block, reporting the retained historical 10,000-Cycle and 100-distinct-Actors-per-block reference horizon; shortfall inside that horizon is reported, not gated. The continuous-user cohort also fills every User base turn with valid signed remarks and carries the signer nonce monotonically across blocks. --integrated-w2-schedules runs separate Actor-only Manual-only and Cadenced-only populations through the same 100 linked full-Executive blocks and exact-Wasm proof contract, isolating execution from temporal scheduling cost without changing the accepted binding. --integrated-w3-opening-matrix runs 14 equal repetitions of every 0/2/4 Opening-predicate by 1/2/3-Step Manual-only cell through linked full-Executive blocks until all 126 Actors and 252 Steps complete, reporting Opening, strict-middle and final Steps separately and exact-Wasm proof-replaying every retained block. --integrated-w4-heterogeneous-effects preserves the reference preset's 15 identities and fills the remaining production capacity with a deterministic interleaving of 9,485 Transfer, 400 Router SwapOut, and 100 StopCycle Actors (the nominal 9,500 Transfer slots less the 15 retained production identities), then measures 100 linked blocks under both Actor-only and continuously saturated valid-user demand with exact-Wasm proof replay. --integrated-w5-lifecycle-retry-cleanup runs one five-Actor Manual matrix through zero-Step completion, successful Opening/middle/final Running, temporary retry and exhaustion, productive cleanup, minimal admission apoptosis, and uncompensated committed-prefix durability across linked native and exact-production-Wasm blocks.

    --integrated-w6-mixed-arrival-lifecycle runs deterministic dense Manual, sparse block-window/AtTime, and seeded Cadenced arrivals across both scheduler clocks with signed pause/resume and owner close. It checks Q1, window timing, retained readiness and absence of closed-Actor execution through native/full-Executive and exact-Wasm replay.

    --integrated-w7-due-only-active-frontier compares 100 due Actors against the same Service frontier at the 10,000-identity cap. The maximum profile adds 4,943 future-window and 4,942 unsignaled Actors plus 15 reference identities. Both profiles must complete the same due Actors with equal Steps per block; Control deltas are reported separately.

    --integrated-w8-tombstone-prefix-chunk-pressure retains its historical command name but closes 1/4/8/16/32/64/128 Actors during setup, verifies their canonical Service removal, then measures one block with 100 due Manual Actors. It checks the live Service prefix, Q1, cursor preservation and Control refusal; it does not measure runtime reclamation of a physical Ready tombstone prefix.

    --integrated-w9-resource-independence compares a 100-due-Actor Service frontier under Actor-only demand, proof-saturated signed remarks and RefTime-heavy signed Router swaps. Assertions require separate ProofSize/RefTime user refusal and nonempty canonical Actor prefixes, not identical throughput across demand profiles. The comparison summary names each user refusal component; per-profile frontier booleans and next-call weights retain the supporting evidence.

    --integrated-control-attribution compares 100-Actor Manual and cadence-one fixtures for nine linked blocks, records mandatory-Prepass and finalized Control separately, and checks deferred service after materialization. Deadline materialization may run in on_idle; B+1 eligibility, not a legacy FIFO cutoff, owns deferral. Its generated-Weight I/O check covers AtTime/Cadenced occurrence selectors and the rearm delta, not measured marginal accesses or complete block proof.

    --integrated-current-w7-deadlines prepares 1,024 real User retry sleepers across 64 owners through signed Manual readiness and ordinary funding-unavailable Attempts. Thirty-two C32 pages at 32 deadline keys become due at 32 Actors/block for 32 blocks, followed by a fixed 32-block drain. Native and exact-Wasm profiles verify due-key/slot extraction order, B+1 return service, same-cursor exhaustion and custody-neutral close, while recording incomplete Sleep/Service work, Actor-owned persistent bytes, actual key mutations and replay proofs. The 64 linked setup blocks are replayed but kept outside the measured horizon. A false completion target is retained; neither a passing harness nor partial traversal establishes complete W7 acceptance.

    Its built-in self-test mode checks source-content identity in temporary Git fixtures: committed, staged, unstaged, untracked, deleted and executable-mode changes, stable commit packaging, artifact exclusions and fail-closed symlink handling. The assurance gate runs the same self-test automatically; standalone self-test needs no Cargo, network access or build artifacts.

  • audit-asset-conversion-boundaries.sh Read-only fail-closed audit requiring exactly one production direct Asset Conversion pool-creation owner inside the atomic DEOS lifecycle and prohibiting LP-binding repair outside that owner. It accepts no arguments except --help and may run from any working directory.

  • try-runtime-local.sh Build deos-runtime with try-runtime and optionally execute live dry-runs against the local parachain RPC.

Use the owning tool's focused checks for changed-scope work and ./scripts/validate-local.sh fast|heavy|full for the corresponding project-validation boundary. These commands do not require agent skills; any agent-specific audits are optional additional review.

Before creating a release tag, run ./scripts/validate-local.sh full against the intended commit. After that commit is accepted as main and tagged, verify with Git that main, the peeled vX.Y.Z tag, and the validated commit/tree are identical and that no parallel plain version tag exists. Release verification must not depend on an agent skill, hidden validation state, or inferred GitHub authority.

Commands executed through the shared script harness use compact output by default: successful test, build, lint, documentation, metadata, and benchmark steps print only their label, duration, and result. A failed step prints the last 80 lines and retains its complete output in a temporary log whose path appears in the error. Set DEOS_VERBOSE=1 to restore live full output, or set DEOS_FAILURE_TAIL_LINES=N to change the failure excerpt without enabling verbose mode.

  • benchmarks.sh Run pallet benchmarking flows and weight generation helpers. --check runs isolated raw-sample/build/reuse routing self-tests, compiles benchmark surfaces and rejects generated Weight files that name Actors storage absent from the current pallet; --extra enables Actors diagnostics, and --skip-build reuses a freshly built benchmark runtime. Exact --extrinsic NAME generation requires an explicit --output FILE outside production Weight paths; path, symlink and existing binding-inode aliases are refused before building. JSON artifacts have the same protection. Selected output is a partial implementation, not an automatic merge into complete production weights. --merge-candidate SLICE --base BASE --extrinsic NAME --output CANDIDATE PALLET separately assembles one selected owner into an isolated copy of a complete normalized generated runtime implementation, without Cargo or a bencher. The inline Node transform in benchmarks.sh adds/replaces only that method, pins both input hashes, preserves all other methods and rejects multiple slices, owner/pallet/signature mismatch or unsupported syntax. It neither validates coefficients nor publishes production bindings; the old base header and stale owners remain old evidence. Add --json-file FILE to an exact extrinsic run to preserve raw component samples alongside its generated model; this requires frame-omni-bencher. --raw-only --json-file FILE excludes --output, skips regressions and Weight generation, and publishes staged JSON only after successful nonempty collection. Use it for categorical storage owners or fixed component corners that cannot support slope fits; --low/--high accept either explicit Weight output or raw-only collection. These samples are diagnostics, not certified coefficients. scheduler_service_zero_step_user_complete requires exact selection with --extra --raw-only --json-file; default generation, regression and candidate merge exclude this per-Actor diagnostic. Unbound User zero-Step and empty/large-head Pipeline collection profiles require exact --extrinsic selection and remain excluded from default production generation. The architecture-experiments skill owns case selection, controlled comparison, evidence interpretation, decision lineage, Weight handoff, and claim boundaries without duplicating this command surface.

    Select the intended measured caller explicitly with DEOS_BINARY_DIR=/path/to/pinned-bundle and verify it through 01-download-binaries.sh --check with the same environment. The default is the repository bin/, which can contain a different bencher; the benchmark prerequisite enforces only a minimum version, not SDK identity. Record the selected executable digest separately from the benchmark Wasm.

The selected frame-omni-bencher inherits storage help from the SDK CLI but rejects that command at execution; its supported dispatch is pallet and overhead. This script exposes pallet collection, not database calibration or deletion-aware deferred root/commit measurement. The Actors integration owner records the distinct timing domains and missing route; do not infer capability from inherited help or run a replacement against an operator database.

Fresh benchmark builds reject any set SKIP_WASM_BUILD, including 0 or an empty value, before Cargo: the underlying builder treats presence as a skip. Remove it with env -u SKIP_WASM_BUILD ./scripts/benchmarks.sh ...; use --skip-build only for an already applicable artifact. Compilation-only --check permits the variable. --self-test requires Node and proves output protection, exact-name selection, candidate addition/replacement/preservation/refusal, atomic failure publication, no-build merge routing, fresh-build refusal, explicit reuse, check-only routing and Cargo-failure propagation in isolated fixtures without Cargo, a bencher or repository artifact changes. Successful native compilation alone is not current-source Wasm evidence.

Use paired --low VALUES --high VALUES for selected component ranges, with comma-separated unsigned values in the benchmark's component order. Bounds require an exact extrinsic, explicit output file or --raw-only, and frame-omni-bencher; the bencher validates ranges and samples each axis with other components at their upper bounds. This does not exhaust a Cartesian grid. --min-duration 0 makes quick reachability probes use only the requested repeat count; omitted duration retains the bencher default. Restricted sampling cannot establish complete production coverage.

Governance service_pending_enactments_full_topology(f) prepares the full pending set and either leaves cleanup slots for every configured visit (0) or fills the destination (1). It verifies enacted receipts or complete refusal preservation apart from cursor rotation. Run --extra --extrinsic service_pending_enactments_full_topology --raw-only --json-file FILE --steps 2 --repeat 3 --min-duration 0 pallet_governance. Exact selection requires raw output and extras; all-pallet generation excludes this categorical diagnostic even with --extra. Seeded authority and shared preimage do not certify public history, other payload effects, physical maxima or production coefficients. The Governance package architecture owns its scope.

pipeline_admission_apoptosis is a comparative direct-finalizer fixture for an Idle User with one Manual Step and a prepared pending signal. Run --extra --extrinsic pipeline_admission_apoptosis --raw-only --json-file FILE pallet_deos_actors. It does not execute the affordability decision; complete admission refusal belongs to scheduler_service_minimal_apoptosis. Default/all-pallet generation excludes it even with --extra, and exact selection refuses Weight regression/candidate merge. The package Close partition owns production cleanup accounting and retirement of the unused Weight port.

close_load_wide_idle measures public Close authority loading and finalization reload for ordinary no-policy User (0) and System (1) Idle actors with twelve wide canonical Steps, full AddressEvent/funding filters and the configured balance-watch count. Use --extra --extrinsic close_load_wide_idle --raw-only --json-file /tmp/wide-idle-close.json --steps 2 --repeat 1 --min-duration 0 pallet_deos_actors. Root comparison and complete destruction occur only in verification. The class selector requires raw samples; generation and candidate merge are refused. The Close partition owns the component and qualification boundaries.

Full-public no-policy corners close_public_wide_header_prefix / _late_hold and close_public_wide_idle / _late_hold require --extra --raw-only --json-file FILE --extrinsic NAME pallet_deos_actors. Their class/residence/slot selectors are categorical, so exact selection refuses regression and candidate merge; bulk generation excludes them even with extras. The measured call includes authority, detachment, destruction, real hold release and FRAME completion, not SignedExtra/Executive. Late-hold fixtures deliberately inject host-currency inconsistency and prove rollback, not an admitted economic history. The package Close partition owns source and remaining-bound distinctions.

close_public_wide_idle(a) preserves fresh a0..2 and adds one-watch last-source 31-hole a3..5, each ordered User peers/User last slot/System. For the history slice use --extra --raw-only --extrinsic close_public_wide_idle --json-file FILE --low 3 --high 5 --steps 3 --repeat 3 --min-duration 0 pallet_deos_actors. Ordinary peer creation/completion/Close prepares the page outside timing; only complete public target Close is measured. Interior a6..8 uses the same role order with actual signed deactivate/reactivate and peer history; collect with --low 6 --high 8 --steps 3. Shared verification preserves 64 live peers and checks links/dense-hole repair. The late-hold companion remains fresh a0..1. New metadata needs an applicable newly built artifact; earlier observations retain their producer. Active-scan and complete host bounds remain separate.

Active-scan cases preserve a0..8: a9..11 interior without target Pending, a12..14 with Pending; a15..29 are five last-source selector cases in groups of three User peers/User last-slot/System roles (singleton; two target/other cursor; three target/other cursor). Only complete signed-owner Close is recorded; actual ledger/typed publication, bounded dispatch, peer setup and verification are excluded. A focused fresh-Wasm slice uses --low 9 --high 29 --steps 21 --repeat 3 --min-duration 0 with the same extra/raw-only JSON contract. Archive the current artifact byte-for-byte before rebuilding; do not reuse a predecessor for a new range or relabel older samples. The Actors integration document owns current source/artifact observations. Late-hold stays fresh a0..1.

Creation-time AtTime/history cases preserve a0..29: a30..32 last31-hole/target Pending, a33..35 interior63-hole/cursor32, a36..38 interior/cursor33/target Pending; triplets retain the same role order and own both clocks. Native/SDK source checks and source-bound reference collection pass; any new issuance still requires fresh guarded Wasm after byte-identical archival. Select only --low 30 --high 38 --steps 9 --repeat 3 --min-duration 0 under the existing extra/raw-only JSON contract. An older predecessor lacking these selectors must not be reused for this range; no benchmark family or regression slope is introduced, and late-hold remains a0..1.

Deep temporal/history cases preserve a0..38: a39..41 is the interior63-hole/cursor33/Pending/two-deep-clock join in the same role order. Shared native caller/SDK± verification and source-bound finite reference collection pass; source/Wasm applicability still governs reuse, never a full-domain upper. Use only --low 39 --high 41 --steps 3 --repeat 3 --min-duration 0 with extra/raw-only JSON after byte-identical archival and a fresh guarded benchmark Wasm. A predecessor lacking these selectors is not reusable. Both index geometries share actual remaining active/identity/allocated-System-slot capacity and retain actual positions; neither independent10k caps nor a shared split are a global upper.

Both-root history preserves a0..41: a42..44 adds the bounded earlier-peer negative review prefix before publication/scan in the same role order. Root-only source now authors80 ticks before creation/history and native/SDK guards preserve an existing earlier cadence. Native/genesis/SDK checks now qualify one owedTick0 anchor in the first existing paired review quantum and post-startup snapshots. Fresh9baa9a47 referencea42..44 collection now passes all3sources/9timing/3DB; storede329 remains its older diagnostic, not that cost producer. Root integration owns exact applicability, refusal limits and archived producers. Select only --low 42 --high 44 --steps 3 --repeat 3 --min-duration 0 under the existing extra/raw-only JSON contract. The prefix uses actual host tick/monotone prepared blocks/production B+1, never fabricated heap/process authority. Native449@0/545@0 and counts cannot label a reference run or prove a complete upper.

Slot-order cases preserve a0..44: new a45..47 selects full-wide non-temporal targetpage1/slot31 in the same three-role order. Native caller commit/rollback and SDK verify± source checks pass; creation-arm peers avoid a needless Cycle that would retire sole append pages. Only complete public Close is recorded. Fresh2d122ab2 actual-reference45..47 collection passes3sources/9timing/3DB; stored9baa lacks these selectors. After existing0444 archive/hash/cmp verification, build a fresh guarded Wasm and select only --low 45 --high 47 --steps 3 --repeat 3 --min-duration 0 under extra/raw-only JSON. Do not infer a both-root join, global upper or qualified price/backing from this finite source.

contract_optional_cleanup measures only the loaded Contract-removal owner with ordinary (0), policy/monitor (1), financial (2) or combined (3) components. Run env -u SKIP_WASM_BUILD ./scripts/benchmarks.sh --extrinsic contract_optional_cleanup --raw-only --json-file /tmp/optional-cleanup.json --steps 4 --repeat 3 --min-duration 0 pallet_deos_actors. It retains twelve wide canonical Steps and full AddressEvent/funding allowlists, requires four-by-four policy bounds for policy cases, stays excluded from default generation, and rejects Weight regression and candidate merge because its component is categorical. The package Close partition owns coverage limits; the samples do not qualify complete Close.

behavior_policy_cleanup(c) isolates additional policy read/delete/drop without ordinary head/tails, financial state, complete destruction or an enclosing transaction. Its five classes and staged-source limits belong to the package Close partition. Use env -u SKIP_WASM_BUILD ./scripts/benchmarks.sh --extra --extrinsic behavior_policy_cleanup --raw-only --json-file /tmp/policy-cleanup.json --low 0 --high 4 --steps 5 --repeat 3 --min-duration 0 pallet_deos_actors only with the required fresh applicable benchmark runtime; archive the previous Wasm before rebuilding. Setup, genuine prefix execution and matching-depth root oracles remain outside recording. The extra is excluded from default/bulk generation even with extras, and exact selection refuses regression/candidate merge. Raw observations are not coefficients, complete Close or fee backing; never subtract the broader cleanup profile.

financial_wait_record_binding reads a full-width financial companion, binds its original origin/debt/clock and classifies expired insolvency. Run env -u SKIP_WASM_BUILD ./scripts/benchmarks.sh --extra --extrinsic financial_wait_record_binding --raw-only --json-file /tmp/financial-binding.json --steps 1 --repeat 3 --min-duration 0 pallet_deos_actors. It installs no Actor/process; canonical source, current time/balance, admission and cleanup are excluded. The extra remains outside default generation and refuses Weight regression/candidate merge. The package Close partition owns its component limits.

financial_service_repark_unqualified(c) measures rejected stale Running (0) and Suspended (1) source repark with enclosing rollback. Run env -u SKIP_WASM_BUILD ./scripts/benchmarks.sh --extra --extrinsic financial_service_repark_unqualified --raw-only --json-file /tmp/financial-repark-refusal.json --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors. It retains a real paid prefix and all wide tail Steps, but stages the financial carrier without public entry or backing. Missing entry/close resource authority refuses full-body reconstruction and preserves the complete root/source/custody; qualified hosts skip. The extra requires raw JSON, rejects generation/merge and stays outside default generation. The package Close partition owns successful-repark and maximum-state exclusions.

task_mint prepares a public System AddressEvent Actor, obtains Running through a real Burn prefix, then measures ordinary prepared self-Mint with the actual Run nonce/cursor. It verifies exact credited custody and receipt, preserved Run/Service/identity, zero Fee Sink change and no future signal. Hosts with fewer than two Steps explicitly skip. Use --extrinsic task_mint --raw-only --json-file FILE; this replaces the former Idle-recipient ingress fixture and excludes surrounding Step completion/fee settlement and complete account/source/failure maxima.

manual_trigger and address_event_trigger_occurrence use maximum legal Mutable User headers and full Steps, including signed funding, balance watches and a live window. AddressEvent matches the last source/asset entries; publication stays outside its timer. Both verify exact Trigger payment, B+1 readiness and no opened Cycle. Manual keeps the signed-call whitelist allowance; automatic AddressEvent measures all economic roles. Select either main with --extrinsic NAME --raw-only --json-file FILE; the duplicate full-header extras are retired. These success profiles do not certify complete placement/failure/optional-state maxima or generated coefficients.

manual_trigger_future_deadline is a selected zero-Step User window diagnostic: the paid occurrence replaces the initial window-expiry Deadline with one window-start Deadline and retains the latch outside Service. Run --extra --extrinsic manual_trigger_future_deadline --raw-only --json-file FILE pallet_deos_actors. Exact selection refuses Weight regression/candidate merge; default generation excludes it even with extras. Its complete transient carrier writes are occurrence cost, but this fresh destination does not certify physical maxima, tariffs or other placements.

scheduler_inner_zero_step_passive_window measures a public User zero-Step completion into its independent window-expiry Deadline, with exact Pipeline payment, unchanged hold and no Service membership. Select it with --extra --extrinsic scheduler_inner_zero_step_passive_window --raw-only --json-file FILE pallet_deos_actors. It requires raw output and is excluded from production generation; the ordinary System/User zero-Step mains cover completion without a window. These branch points do not certify complete destination geometry, physical maxima or tariffs.

at_time_trigger_occurrence and cadenced_trigger_occurrence use maximum legal User headers over populated source vacancy geometry and a saturated admitted Tick index; Cadenced also exercises a populated destination. Checks bind exact Trigger payment and B+1 readiness without opening a Cycle. Use --extrinsic NAME --raw-only --json-file FILE for either main. Extras cadenced_underfunded_rearm_populated and cadenced_terminal_cleanup_populated retain the same legal Cadenced header and peers; select them with --extra and raw JSON. The extras reject regression/candidate merge and default generation excludes them. The terminal diagnostic prepares its classified nonce through a canonical fixture mutation; it does not prove a public terminal history or complete Close maximum. Classification, wait/policy branches and complete physical bounds retain separate owners.

Main set_global_circuit_breaker freezes a populated current-block resource state after public Mandatory Prepass. Extra set_user_creation_enabled changes its independent flag after a real public freeze and verifies that the complete halted record survives. Use --extrinsic set_global_circuit_breaker --raw-only --json-file FILE, then reuse the same fresh artifact with --skip-build --extra --extrinsic set_user_creation_enabled --raw-only --json-file FILE. Host clock/quiet ValidationData preparation stays outside measurement. These corrected branch points do not qualify complete public/Governance/host context or authorize changing the shared production declaration.

task_transfer, task_burn and task_donate_liquidity create public User Actors with matching authored Steps and measure the complete prepared Task executor. Transfer retains certified Actor-recipient ingress and checks exact source/recipient deltas; Burn checks its actual debit. All three check exact invocation receipts. Donation host fixtures return the input cap and both expected donated outputs; acquired staking receipts are distinct from pre-existing asset-B debit. Use exact --extrinsic NAME --raw-only --json-file FILE for source-bound diagnostics. These samples exclude surrounding Step control/fees and do not certify complete class/account/recipient/adapter maxima.

Each Transfer owns one recipient and complete ingress, including synchronous terminal cleanup and refusal rollback. Distribution uses separate snapshot-based Transfer Steps. Removed multi-recipient profiles have no current selector or coefficient; their prior results remain historical. Current maximum Task/Close bounds and generated binding require the retained contract and host watch configuration.

task_add_liquidity prepares a public User Actor with an authored AddLiquidity Step and measures its complete prepared Task effect, including host transaction, outcome checks and receipt. task_add_liquidity_user_refusal prepares an absent pool with two nonsufficient local assets, leaves exactly the protected native floor plus maximum Action fee, and verifies permanent FundsUnavailable with whole-root rollback. Hosts without this deposit fixture explicitly skip the extra. Run the reference extra with --extra --extrinsic task_add_liquidity_user_refusal --raw-only --json-file FILE --steps 2 --repeat 3 --min-duration 0; it rejects regression/candidate merge and remains excluded from default generation. These Task-local profiles exclude surrounding Step control and fee settlement; neither certifies complete maxima or tariffs.

System AddLiquidity extras task_add_liquidity_system, task_add_liquidity_system_refusal and task_add_liquidity_system_existing_pool publicly create and activate matching System Actors. Optional host fixtures supply three pool-account deposits with or without an extra ED, or an existing pool with zero Native and a third-party LP deposit. Successful profiles verify exact input debits and LP receipts; refusal restores the whole root. Use --extra --extrinsic NAME --raw-only --json-file FILE; all three reject Weight regression/candidate merge and remain excluded from default generation. They measure Task effects, excluding surrounding Step control and fee settlement.

task_stake and task_unstake measure complete prepared Task effects for publicly created User Actors and verify exact invocation receipts. The extras task_stake_user_refusal and task_unstake_user_refusal use optional first-consumer fixtures, retain only User floor plus maximum Action fee, and verify permanent FundsUnavailable with whole-root rollback. Unsupported hosts explicitly skip. Select each extra with --extra --extrinsic NAME --raw-only --json-file FILE; both reject regression/candidate merge and stay excluded from default generation. These profiles exclude surrounding Step control and fee settlement; complete maxima and tariffs remain independent.

task_remove_liquidity measures the complete prepared Task effect for a public User Actor, including stable LP binding, capacity guard and exact output receipt. The raw-only task_remove_liquidity_user_refusal uses optional absent nonsufficient outputs with third-party-deposited LP custody, retains only User floor plus maximum Action fee, and verifies permanent FundsUnavailable with whole-root rollback. Unsupported hosts explicitly skip. Select it with --extra --extrinsic NAME --raw-only --json-file FILE; regression/candidate merge is rejected and default generation excludes it. Task-local samples do not certify surrounding Step control/fees or complete maxima.

task_dex_exact_in and task_dex_exact_out measure complete prepared System Task effects with exact receipts and reference-deviation checks. Raw-only extras task_dex_exact_in_user / task_dex_exact_out_user cover public User effects; their _refusal counterparts use optional first-nonsufficient-output fixtures and check whole-root rollback with complete Native input funded. Unsupported hosts skip refusal fixtures. All four User extras reject regression/candidate merge and stay excluded from default generation. Use --extra --extrinsic NAME --raw-only --json-file FILE; surrounding Step control/fee settlement and complete maxima remain separate.

scheduler_actor_state_probe_wide_header uses the existing full AddressEvent/funding/window/one-watch committed-prefix fixtures for User/System × Running/Suspended. Run --extra --extrinsic scheduler_actor_state_probe_wide_header --raw-only --json-file FILE --low 0 --high 3 --steps 4 --repeat 3 --min-duration 0 pallet_deos_actors with the intended bundle. Suspended setup uses the shared due-return handler; the timer encloses only the current-Step loader. Full root/header/Run/Step checks stay outside timing, and all four native cases run with verification on/off. This no-policy categorical profile is excluded from generation/merge/defaults and does not qualify policy-bearing or arbitrary-header maxima.

behavior_service_policy_context measures cold policy authentication and resource-context derivation with the caller's loaded header. Use --extrinsic behavior_service_policy_context --raw-only --json-file FILE --steps 6 --repeat 3 --min-duration 0 pallet_deos_actors with the intended DEOS_BINARY_DIR. The six reused source shapes record no storage for absent policy and only policy/semantic records for present policy; no head, monitor or Run read is included. Host prices and complete Service admission remain excluded. Generation/merge is refused, and default production generation excludes this profile.

behavior_source_snapshot loads bound policy/monitor state using six cases: absent, current outcome, sparse accumulation, and maximum Idle/Running/Suspended. behavior_candidate_publish measures reduction and publication for those sources with r=0 commit or r=1 rollback. Both require raw-only mode and remain excluded from production generation; the package architecture owns component limits. Use --steps 6 for the one-axis source profile. Sample candidate commit with --low 0,0 --high 5,0 and rollback with --low 0,1 --high 5,1; explicitly reuse the same applicable Wasm with --skip-build. The bencher may repeat the upper c corner while sampling a fixed second axis, so verify unique component values rather than treating row count as Cartesian coverage.

admission_certificate_authority measures one configured host-authority construction, with expected authority outside measurement and no Actor operation. Run env -u SKIP_WASM_BUILD ./scripts/benchmarks.sh --extra --extrinsic admission_certificate_authority --raw-only --json-file /tmp/admission-authority.json --steps 2 --repeat 6 --min-duration 0 pallet_deos_actors. The provider must return authority. This extra is excluded from default generation and rejects regression and candidate merge. Its samples cover construction CPU; referenced Weight values and complete callers retain independent qualification.

  • ci-local.sh Reproduce local CI or select one compact check with --only; narrow Cargo work further with --package NAME, --test-filter NAME, and explicit feature mode. Use --only tests --package NAME --test-target TARGET for one integration test target without traversing a failing library first; this establishes that target only, never a full-package pass. --self-test checks argument/command contracts without running Cargo and is included in the canonical validation profiles. Use --only tests --release for optimized large-fixture tests; other checks reject --release. Apply Rust formatting with --only format --fix. Agents should prefer this entrypoint over raw Cargo commands.

actors-assurance.sh --integrated-funded-user-action executes both the native monetary/resource witness and its ignored exact-production-Wasm replay under one pinned identity gate. It proves the selected funded User Transfer's Trigger, Pipeline and Action fee separation; it is not broader User Task or retry coverage.

actors-assurance.sh --backpressure-audit executes the focused runtime and package falsifiers for DEX/Router, XCM, observation, funding/resource, scheduler-capacity and adapter rollback ownership. It validates existing atomicity and sole Actor retry authority without introducing a new queue, registry or production-Wasm claim.

ci-local.sh --only tests --package deos-runtime --test-filter actors_design_comparison runs native isolated preparation with 128 one-Step System Transfer Actors and no background Actors or ordinary user dispatch. A test-only, block-bound host input supplies the fixed 2e12/10 MiB zero-system budget through the shared allocator. It checks phase order, frozen limits, deferred-head recovery and economic outcomes. A separate adversarial Drain matrix shares the runtime's conservative-budget assertions but injects explicit prior usage to isolate both resource domains and dimensions; this is not natural zero-user saturation. Auxiliary natural AddLiquidity/Transfer witnesses check base refusal and useful Drain borrowing, while a blocked-asset User witness distinguishes charged business failure from capacity refusal. These tests report neither throughput nor production-Wasm acceptance.

The W5 lifecycle test runs through ci-local.sh --only tests --package deos-runtime --test-filter full_executive_w5_lifecycle_retry_cleanup_fixture. It also checks charged Control/effect ownership for zero-Step, Running, retry, terminal cleanup and User admission apoptosis. Optional DEOS_PRODUCTION_WASM pins accepted genesis code for retained-header comparison without executing Wasm; unset it for the standalone native fixture.

ci-local.sh --only tests --package deos-runtime --test-filter full_executive_funded_pipeline_collection_witness compares funded System/User StopCycle fee ledgers and reports charged Control. It explicitly enables User admission through public Root preparation, keeps User admission disabled in the System row, and verifies monetary deltas, receipts and an independent native complete-block import; it is not signed Governance history or complete User Weight coverage. The companion filter full_executive_user_completion_header_domain_witness checks ordinary admission and execution of OwnerOnly/maximum-allowlist heads sharing a source-derived completion context; it is a domain-alias witness, not a numeric Weight bound.

behavior_policy_installation is an extra raw-only Actors profile for the first-installation policy owner: canonical compile/binding, episode creation and optional-record publication, with commit/rollback categories. It uses the production helper without supplying missing host resource prices. The caller's certificate/admission, ordinary head/body publication, holds, public dispatch and complete Creation backing remain excluded. Use benchmarks.sh --extra --raw-only --json-file PATH --extrinsic behavior_policy_installation pallet_deos_actors; generation/merge is refused.

The extra scheduler_inner_opening_user_complete_single and scheduler_inner_opening_user_complete_tail Actors benchmarks measure User StopCycle after real source consumption, including Pipeline collection and hold reconciliation but not complete outer Service work. Zero tails and positive tails use separate models because funding-hold release changes I/O. Native construction uses ci-local.sh --only tests --package pallet-deos-actors --all-features --test-filter scheduler_inner_opening_user_complete_. Reference measurement requires fresh benchmark Wasm and benchmarks.sh --extra --extrinsic NAME --output /tmp/user-completion.rs pallet_deos_actors; both diagnostics remain outside default production generation and do not qualify arbitrary User Contract geometry.

close_finalize_policy is an extra raw-only profile of the shared intrinsic finalizer, with unavailable production resource ports left unchanged. Detached c0..8 cover User peers/last-slot and System × Idle/Running/Suspended; retained-Service c9 separately joins consumed-state finalization and ordinary Service retirement atomically after a genuine pre-Opening paid prefix. Collect commit with --extra --raw-only --extrinsic close_finalize_policy --json-file PATH --low 0,0 --high 8,0 --steps 9 --repeat 3 --min-duration 0 pallet_deos_actors; collect rollback at --low 0,1 --high 8,1, reusing only the identified unchanged Wasm with --skip-build. Verify actual coordinates; per-axis duplicates do not add cases. Generation/merge is refused and default production generation excludes the profile. For c9, use --low 9,0 --high 9,1 --steps 2; this joint must not be summed with the detached fragment or its overlapping components. Loading, detachment, host resource checks and complete public Close remain outside measurement.

user_contract_installation(c,r) covers the existing Pipeline fee compiler inside full public Mutable User activation (c=0) or Idle-source replacement (c=1). Both retain the joint maximum-count/header/predicate/Task-width payload. r=0 authors the configured local retry ceiling; r=1 authors retry two, giving unit repeat capacities without reducing configured bounds. With reference N=12/G=10, unit capacities select nine choices instead of one at retry ten; native checked-operation counts do not establish optimized timing or sort maxima.

Use --extra --raw-only --extrinsic user_contract_installation --json-file PATH --low C,R --high C,R --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors. Author the target before public source creation/admission. Source setup, slot prefill, snapshots and final checks stay outside timing; the public call's existing transaction stays inside. Creation retains separate Mutable corners in user_creation_admission_payload; no duplicate creation microprofile is introduced. Full replacement-source, sort/Task-order and Executive/nested maxima remain open. Generation and candidate merge stay refused. This added selector changes benchmark source/ABI: preceding one-selector Wasm observations remain historical, not current timing. Archive the retained Wasm and bind fresh source/tool/Wasm identities before collection.

contract_behavior_context(c,p) measures exactly one existing Contract-side compiler invocation with absent policy (P=0), wide false policy (P=1) or late-completion policy (P=2) on eight class/Trigger full-header sources. Use --extra --raw-only --extrinsic contract_behavior_context --json-file PATH --low 0,P --high 7,P --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors. Authoritative expected context, setup and root/custody snapshots are outside timing; no policy store load, fee, host price lookup, transaction or mutation is measured. c8 separately supplies a full configured body (--low 8,P --high 8,P --steps 2), without installation/admission normalization. Neither source domain proves a reachable maximum or complete wrapper tariff; repeated compiler calls remain distinct work. Generation/merge is refused; any collection requires exact source/tool/Wasm binding.

zero_step_policy_placement_finish(c,r,t) measures finishing plus an explicit caller FRAME transaction with commit/rollback. Use --extra --raw-only --extrinsic zero_step_policy_placement_finish --json-file PATH --low 0,R,T --high 7,R,T --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors, pinning R=0/1 and T=0 singleton, T=1 pair or T=2 original distinct-peer source on the same identified Wasm. Smaller sources close ordinary followers through public lifecycle calls before policy staging; no ring state is fabricated. Earlier two-axis observations retain their three-member artifact scope and are not repeated automatically. Genuine control/publication/preparation and actual Deadline transfer are setup; Disabled finishing owns unlink/process publication, otherwise only the process stamp changes. Matched-depth independent ring/process oracle, phase rollback, peers, custody and holds are checked outside timing. This is a setup-flushed partial phase with a measured transaction envelope, not full-attempt rollback, nested-caller maxima or an additive host tariff. No subtraction removes transaction overhead; generation/merge is refused.

zero_step_policy_placement_preparation(c) measures only read-only placement preparation on eight wide-policy full-header User/System/Trigger sources after genuine control and semantic publication. Use --extra --raw-only --extrinsic zero_step_policy_placement_preparation --json-file PATH --low 0 --high 7 --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors. Setup is a flushed intra-attempt phase, not a separately committed Cycle. Typed destination assertions, exact-root and phase-custody checks stay outside timing. The wrapper transaction guard, Deadline planning/transfer, Disabled mutation, Park transfer and attempt stamp are excluded; zero-Step cannot author Park. No complete host/window bound or additive tariff follows; generation/merge is refused.

zero_step_policy_semantic_publication(c) measures the existing semantic writer and identity/hot input clones on eight wide-policy User/System/Trigger sources. Use --extra --raw-only --extrinsic zero_step_policy_semantic_publication --json-file PATH --low 0 --high 7 --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors. Genuine control/payment and Cadenced rearm prepare the phase before timing; FRAME flushes that intermediate image, not a separately committed production Cycle. The measured call owns its local transaction with no enclosing FRAME attempt transaction. Matched-depth one-key root verification and ledger checks are outside timing. Placement, attempt stamping, price settlement and enclosing transaction costs remain excluded; no timing subtraction or automatic composition follows. Generation/merge is refused.

zero_step_policy_source_authentication(c) isolates the shared read-only caller prelude on wide-policy User/System × Manual, AddressEvent, AtTime and Cadenced full-header sources. Use --extra --raw-only --extrinsic zero_step_policy_source_authentication --json-file PATH --low 0 --high 7 --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors. Setup and snapshots are outside timing; verification checks exact root/semantic authority and custody without collection. This is not complete admission or Control pricing: shape/policy qualification, price guards, transitions, publication, placement, destruction and caller transaction completion remain separate. Generation/merge is refused; reuse requires matching source/tool/Wasm identities.

zero_step_policy_control measures authenticated intrinsic Opening/completion and candidate publication, including actual collection from the retained envelope. Use --extra --raw-only --extrinsic zero_step_policy_control --json-file PATH --low 0,Q,R --high 7,Q,R --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors, pinning R=0/1 and categorical Q: 0/1 retain wide accumulated clean false/late-completion; 2/3 select CurrentOutcome without monitor false/true; 4/5 select CurrentOutcome zero-slot clean monitor false/true; 6/7 select Accumulated without clean false/true. c=0..7 selects User/System × four Trigger families. Only newly required classes should be collected; changing the categorical range does not refresh historical wide-policy evidence. Reuse only identified unchanged Wasm with --skip-build, and verify actual coordinates rather than per-axis row counts. Generation/merge is refused. Resource qualification, Service placement, fixture destruction, late settlement and complete policy fee backing remain outside this profile.

zero_step_policy_publication joins intrinsic zero-Step control with nonterminal Service publication and passive/Deadline placement. Use --extra --raw-only --extrinsic zero_step_policy_publication --json-file PATH --low 0,R --high 7,R --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors, substituting R=0 for commit and R=1 for rollback. Collect both on one identified fresh Wasm, using --skip-build only for applicable reuse. Its eight sources reuse the installed-envelope funding fixture; the policy stays false. This includes zero_step_policy_control work, not an additive surcharge. Host-price settlement, admission, destruction and complete topology maxima remain excluded; generation/merge is refused.

zero_step_policy_terminal joins intrinsic empty-cycle control, consumed-state destruction and exact Service retirement. Use --extra --raw-only --extrinsic zero_step_policy_terminal --json-file PATH --low 0,R --high 7,R --steps 8 --repeat 3 --min-duration 0 pallet_deos_actors, with R=0/1 for commit/rollback on one applicable Wasm. The eight sources reuse real retained-envelope User payment/System exemption and a late CycleCompletedTotal clause; assertions preserve custody, holds, peers, temporal cleanup and exact rollback roots. It includes earlier control/finalizer work and is not additive. Admission/resource qualification, late actual-Weight settlement, complete domain maxima and Creation/Pipeline backing remain separate; generation/merge is refused.

liquidity_policy_control is extra/raw-only with c User/System, s Running failure/Suspended recovery and r commit/rollback. Pin s/r and vary c, using the same three-component ranges as the Running predicate profile. Setup includes the real Transfer prefix and, for recovery, a committed failure plus incoming capital. Recorded work joins real liquidity effects, policy control/publication and Action fees; it is not a standalone control tariff. Economic snapshots outside timing verify inputs, LP/reserves and native deposits for the selected zero-setup-fee host. An unsupported snapshot explicitly skips the profile; native mock Skip is not economic evidence. Other observer failures stop; generation/merge is refused.

liquidity_failure_policy_control(c,a,r,p) is extra/raw-only: c selects User/System, r commit/rollback, and p=0/1 Temporary/Permanent source. a=0 is ContinueNextStep; a=1 selects AbortCycle for Temporary and RetryLater for Permanent (which must fail Idle without retry/Deadline). Run --extra --raw-only --extrinsic liquidity_failure_policy_control --json-file PATH --low 0,A,R,P --high 1,A,R,P --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning A/R/P on one applicable Wasm. Older three-axis observations retain their original artifact; do not replay them merely for the new axis.

Source policy/bounds are authored before creation; the paid Transfer prefix is setup. Recorded work joins the actual invoked failure, Run or surviving Failed Idle publication and Action fees. Mandatory snapshots verify failed pool/input/native atomicity outside timing. Each unsupported mock Skip requires fresh fixture externalities and is not economic evidence. Generation/merge is refused; Task-inclusive observations are not additive control tariffs.

running_policy_service_fee(f,r) is extra/raw-only for the first Close-only User Running shortfall: f=0/1 selects ContinueNextStep/RetryLater and r=0/1 commit/rollback. Use --extra --raw-only --extrinsic running_policy_service_fee --json-file PATH --low 0,R --high 1,R --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning R on one Wasm. A pre-authored native Percent(100%) prefix pays Pipeline/Action in setup and leaves MinUserBalance; the funded successor cannot pay its Action. Only shared control/publication is recorded; custody/receipts/holds/certificate/root checks stay outside timing. No Task, Action suffix, wait or destruction is included. Subsequent unfunded Suspended retry admission is a distinct pre-invocation Close owner. Generation/merge is refused.

funding_policy_control(t,r,c) is extra/raw-only for minimal-header advancing TaskInput skip (t=0) and configured-bound Close (t=1), with c=0/1 User/System. Use --extra --raw-only --extrinsic funding_policy_control --json-file PATH --low 0,R,C --high 1,R,C --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning commit/rollback R and class C on one Wasm. Terminal prior failures/Pipeline payment and due-return/B+1 are committed setup; actual limits select the terminal attempt/reason. User checks separate Pipeline debit/sink credit from owner hold release/slot cleanup and sovereign custody. Old two-axis System samples retain their artifact. There is no Task effect or Action suffix, but terminal measurement includes creation-backed destruction and is not an additional Pipeline tariff. Generation/merge is refused; actual-price and domain maxima remain separate.

opening_policy_no_action_control(f,r,c) is extra/raw-only for minimal-header resolution skip (f=0) and TaskInput retry (f=1), with r=0/1 commit/rollback and c=0/1 User/System. Use --extra --raw-only --extrinsic opening_policy_no_action_control --json-file PATH --low 0,R,C --high 1,R,C --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning R/C on one applicable Wasm. User includes a nonzero Pipeline fee with custody debit/sink credit/receipt checks. Older two-axis System samples retain their original artifact and need not repeat. Shared native/raw execution joins policy control and Service/Deadline publication without Task effects, destruction or an Action suffix. Custody, holds, Contract/certificate, nonces and rollback are verified outside timing. Actual host-price settlement, User financial waiting and domain maxima remain excluded; generation/merge is refused.

opening_policy_pre_effect_continue(r,c) uses the same commit/rollback and class command shape as the pre-effect Abort profile below. Substitute its name to measure minimal-header Permanent preparation failure under ContinueNextStep, with Run/cursor 1 publication and no Task/Action/destruction. Source error policy is authored before creation; exact failure, custody/holds/body/certificate and rollback are checked. Generation/merge is refused, and unchanged Abort samples need not be repeated.

opening_policy_pre_effect_control(r,c) is extra/raw-only with r=0/1 commit/rollback and c=0/1 User/System, minimal header/full Step count. Run --extra --raw-only --extrinsic opening_policy_pre_effect_control --json-file PATH --low 0,C --high 1,C --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning C. User includes a nonzero Pipeline fee and custody/sink/receipt checks. Older System samples retain their original single-r artifact and need not be repeated. The real empty-receipt loss leads to permanent preparation failure without Task invocation; recorded work joins policy control and surviving Failed Idle publication. No Task effect, destruction or Action suffix is included. Actual host-price settlement and other domains remain excluded; generation/merge is refused.

liquidity_policy_late_control is extra/raw-only with c User/System, e later Deadline/exhausted Close and r commit/rollback. Use --extra --raw-only --extrinsic liquidity_policy_late_control --json-file PATH --low 0,E,R --high 1,E,R --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning each (E,R) pair on one applicable Wasm. Authored limit 3 stays inside the configured ceiling; the paid Transfer, earlier failures and due-return/B+1 admission are setup. The shared native/raw body joins real Task/control, placement or consumed destruction and Action fees. Mandatory snapshots verify failed pool/input atomicity; mock Skip is not measurement. Generation/merge is refused, and the join is not an additive control tariff.

running_policy_predicate is extra/raw-only with axes c (User/System), p (absent/present predicate-account records) and r (commit/rollback). Pin p and r per collection and vary c: --low 0,0,0 --high 1,0,0, then the corresponding p=1/r=1 ranges on the same Wasm. Setup includes policy installation and the first Transfer; only Running rejection, publication and Service advance are recorded. Presence probes and verification stay outside timing. This is selected ordinary-width geometry, not complete control pricing; generation/merge is refused.

transfer_policy_progression(c,r,h) is extra/raw-only: c=0/1 selects User/System, r=0/1 commit/rollback, and h=0/1 funding-wide Manual/full AddressEvent header. Pin R,H with --low 0,R,H --high 1,R,H --steps 2 --repeat 3 --min-duration 0; use --extra --raw-only --extrinsic transfer_policy_progression --json-file PATH pallet_deos_actors. Full headers author filters/funding/window/future nonce before creation and obtain real ingress readiness outside timing. The join records Transfer, false-policy reduction, retained Run/Service publication and Action fees, with custody/receipt/hold and exact rollback checks. Earlier two-axis samples retain their original artifact scope. No actual-control pricing, universal bound or independent backing is supplied; generation/merge is refused.

running_policy_stop_cycle(c,t,r) is extra/raw-only with User/System c=0/1, surviving Idle/policy Close t=0/1 and commit/rollback r=0/1. Use --extra --raw-only --extrinsic running_policy_stop_cycle --json-file PATH --low 0,T,R --high 1,T,R --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning each T,R pair on one applicable Wasm. Paid Transfer prefix and B+1 are setup; recorded completion publishes Idle or completed clean-Cycle authority plus consumed destruction. Checks preserve prefix/custody, two executed Steps/one effectful Task, holds/slots, unique fees and exact rollback. No new Pipeline or Action fee is collected. Destruction-inclusive observations are not additional Pipeline tariffs; prices/backing remain unqualified and generation/merge is refused.

running_policy_transfer(c,r) is extra/raw-only with User/System c=0/1 and commit/rollback r=0/1. Use --extra --raw-only --extrinsic running_policy_transfer --json-file PATH --low 0,R --high 1,R --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, pinning R on one applicable Wasm. Full-header creation, the authored successor, paid Opening prefix and B+1 round are setup. Only the cursor-1 Transfer/control/publication/Action join is measured; verification preserves prefix, custody, certificate, holds, one Pipeline fee and exact rollback. Actual-control selection/containment and independent backing remain excluded. Generation/merge is refused.

transfer_policy_terminal is extra/raw-only and uses the same two-source/rollback CLI axes as the StopCycle profiles, with real positive Transfer and a late ActionSuccess policy Close. It includes clean-Cycle publication, destruction, retirement and the actual Action-fee collector/receipt, but excludes unavailable actual-control price selection. Its strict native custody rollback check passes after moving mock balances into externalities storage; broader mock-regression validation remains separate from reference evidence. Do not skip custody assertions or infer fee/resource qualification from the native result. Generation and merge are refused.

stop_cycle_policy_publication uses the same full-source constructor with a wide false policy, joining genuine StopCycle control and surviving Idle publication rather than destruction. Use the terminal command below with --extrinsic stop_cycle_policy_publication; the same source/rollback axes and raw-only/refusal rules apply. Checks cover unchanged Contract/holds/counts/custody, one User Pipeline receipt/System exemption, published monitor and exact rollback. These staged unpriced sources do not establish globally repriced policy admission or economic backing.

stop_cycle_policy_terminal reuses User complete-header (c=0) and System complete-max (c=1) Opening fixtures at the full configured Step count. It joins real StopCycle control, policy destruction and Service retirement, retaining actual provider effect Weight and zero Action fee. Use --extra --raw-only --extrinsic stop_cycle_policy_terminal --json-file PATH --low 0,R --high 1,R --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors, with commit/rollback R=0/1 on identical applicable Wasm. The source selector is categorical; System includes the existing true-predicate geometry, not an otherwise identical class comparison. Generation/merge is refused. These selected compositions are not additive with prior control/finalizer samples or qualified pricing/fee backing.

service_member_to_deadline_new_key_peers is an extra raw-only alternative to the singleton new-key placement profile. It uses two publicly created Service neighbors, canonical B+1 consideration and the unchanged remaining-population fill. Use --extra --raw-only --extrinsic service_member_to_deadline_new_key_peers --json-file PATH --steps 2 --repeat 3 --min-duration 0 pallet_deos_actors. Compare both complete placements on one applicable Wasm; do not add their costs. Peers consume real identity capacity, so equal heap depth is not assumed across host configurations. Generation/merge is refused and default generation excludes this alternative.

service_member_to_deadline_existing covers the complete planner/transfer boundary for existing-key destinations. Use --extra --raw-only --extrinsic service_member_to_deadline_existing --json-file PATH --low 0 --high 3 --steps 4 --repeat 3 --min-duration 0 pallet_deos_actors: c=0/1 appends a page after a full page, and c=2/3 fills the vacancy head's last slot and repairs its successor; odd cases retain two real Service peers. All cases preserve B+1 and fill remaining admitted population. Verify all four coordinates; the selector is categorical, not a regression slope. Generation/merge and default generation exclude this profile. These branch witnesses are not universal topology maxima or additive prices.

The raw-only close_dormant_event_root(c) measures one complete fragment: Events reset, 63 ordinary remark calls with Signed origin, a materializing root, public Dormant Close and the resulting root. c=0 selects a last-slot User and c=1 a System Actor. Both roots are inside the timer; prefix construction and the first root must not be subtracted to invent a pure Close coefficient. Native verification covers enabled/disabled SDK assertions. Use fresh benchmark Wasm with benchmarks.sh --extra --extrinsic close_dormant_event_root --raw-only --json-file /tmp/close-event-root.json --steps 2 --repeat 2 --min-duration 0 pallet_deos_actors; regression, candidate merge and default Weight generation exclude this owner. Its fixed prefix is not a maximum over block events, and backend commit remains outside the measured fragment. Its root uses the benchmark's native host backend; a Wasm benchmark does not turn it into proof-backed Cumulus PVF root execution. Use the integration owner's caller-domain assessment before selecting a CPU measurement route.

Admin Utilities

  • seed-web-client-state.sh Idempotently prepare the composite live-chain state needed for local wallet, swap, and native-staking UI testing: verify genesis prerequisites, fund Alice, and create or top up the Native/foreign and NTVE/stNTVE pools. This is a named admin workflow rather than an atomic numbered leaf because it coordinates several state checks and transactions.

  • export-papi-metadata.sh Export runtime metadata through the committed deos-runtime example in an isolated Cargo target and regenerate PAPI descriptors. Default export requires exact native-byte equality with the selected production-profile Wasm's actual Metadata API, with native fallback forbidden, before writing metadata. --wasm PATH selects explicit code; --native-only is a labelled source-preparation export, not Wasm qualification. Canonical ParaId initialization preserves storage-backed metadata constants. Isolation prevents compilation from replacing production Wasm. Domain ABI, ingress and other generated evidence retain their own package generators/checks; descriptor generation alone does not refresh them.

  • bootstrap-native-staking-local.sh Consolidated native staking bootstrap helper. check reads the mode-shaped canonical NativeSecurityView, pool readiness and bounded ActorEligibilityApi state at one finalized block. JSON stakingLiquidityActor contains the Active activation projection, or null for Dormant/NotRegistered; classification errors fail closed. Matching runtime metadata/descriptors are required. prepare-calls emits plan-only registration, pool and liquidity calls without mode-inactive LP-security actions. It never signs or submits transactions; the staking specification and package architecture own sequencing and authority boundaries.

  • authorized-upgrade-local.sh Consolidated authorized runtime-upgrade helper. check pins one finalized block, compares live and local runtime code, inspects protocol L1RootAction submission authority and $VETO issuance, verifies the pending authorized hash, and can emit offline relay call data. prepare-authorization emits candidate-bound stake, preimage, and signed proposal call data only after reporting finalized item, balance, fee, and authority checks; it withholds the protection Pass call unless the lifecycle is ready. apply stays plan-only unless explicit --submit relays matching code bytes through System.apply_authorized_upgrade { code }. snapshot captures finalized non-empty Router/Oracle/Actors baseline state, and verify checks runtime identity, selected-state preservation, and live code equality with the candidate Wasm.

  • teardown-local-network.sh Stop local zombienet / polkadot* / vite dev-server processes and remove Zombienet temp directories.

  • clean-local-artifacts.sh Remove generated local artifacts (chain_spec.json, optionally target/ and bin/).

  • _common.sh Shared path, logging, timed-step, and background-process helpers used by deterministic root commands and project-skill script leaves. A co-located skill script supplies DEOS_PROJECT_ROOT before sourcing it.