feat(pxe)!: Add AppTaggingSecret kinds to keys in tagging stores - #24604
Merged
vezenovm merged 8 commits intoJul 9, 2026
Conversation
Drop the legacy two-part unconstrained AppTaggingSecret key format (`secret:app`) so every persisted tagging-store key uses the uniform self-describing `kind:secret:app` form. `toString()` always emits the kind prefix and `fromString()` only accepts the three-part form, rejecting legacy keys. Because PXE tagging stores key their KV maps by `AppTaggingSecret` strings, this is a breaking on-disk change. Rather than a dual-read / self-healing path, bump `PXE_DATA_SCHEMA_VERSION` 12 -> 13; the version manager wipes any DB with a mismatched schema on open, so legacy keys never reach the new parser and legacy/prefixed keys cannot coexist. Note this wipe resets the entire PXE DB (notes, contracts, keys, tips, facts, tagging), so existing wallets re-sync from genesis on upgrade. Covers F-680.
vezenovm
added
ci-no-fail-fast
vezenovm
changed the title
Document the PXE data schema bump (12->13) and full PXE DB wipe in migration_notes.md. Rename PRE_F680_PXE_SCHEMA_VERSION -> PRE_KIND_PREFIXED_TAGGING_KEY_PXE_SCHEMA_VERSION and reword its comments to drop the Linear issue reference from source, mirroring the sibling constant.
This was referenced Jul 8, 2026
…tests (#24615) Stacked on #24604. Extracts the duplicated schema-mismatch DB-wipe ceremony in the PXE storage compatibility suite into one helper. The two "wipes rows written under schema vN" tests (the key-store removal at the schema-10 boundary, and the tagging-store key-format migration at the schema-12 boundary added earlier in this stack) were near-identical boilerplate: make a temp dir + `pxe_data` config, open the store at the old schema version, seed a legacy row, close, reopen at the current `PXE_DATA_SCHEMA_VERSION` (which makes `DatabaseVersionManager` wipe the mismatched DB on open), assert the row is gone, then remove the temp dir. `expectStoreWipedOnUpgradeFrom(oldSchemaVersion, tmpDirPrefix, seedLegacyRows, assertWiped)` now owns that lifecycle, so each test spells out only its own legacy write and post-wipe assertion, and the next schema-bump wipe test is a few lines rather than a copy of the whole dance. The shared "wipes on version mismatch" explanation moves into the helper's JSDoc; each test comment stays focused on its own assertion.
…-trip The unconstrained round-trip test pinned the literal kind:secret:app format, duplicating what the PXE schema-compat per-store snapshots already fingerprint for real stored keys. Leave format pinning to those snapshots; keep the round-trip test focused on serialize/deserialize identity and kind preservation.
vezenovm
marked this pull request as ready for review
July 8, 2026 21:47
mverzilli
approved these changes
Jul 9, 2026
mverzilli
left a comment
mverzilli
left a comment
Contributor
There was a problem hiding this comment.
Looks good! I'm now working on changing the behavior on version/rollup change, the wipe out is a bit excessive, so some of the assumptions here will be outdated soon. But we can deal with that once that's done.
vezenovm
enabled auto-merge (squash)
July 9, 2026 13:17
…e snapshots (#24614) Stacked on #24604. Adds a `constrained`-kind `AppTaggingSecret` to the Recipient and Sender tagging-store schema fixtures so the backwards-compatibility snapshots pin both the `constrained:` and `unconstrained:` key prefixes side by side. Previously the fixtures only used default (unconstrained) secrets. The constrained secret lands in all four persisted maps (recipient aged/finalized, sender pending/last-finalized).
PhilWindle
added
port-to-next
PhilWindle
pushed a commit
that referenced
this pull request
Jul 21, 2026
This was referenced Jul 21, 2026
Closed
Closed
nchamo
pushed a commit
that referenced
this pull request
Jul 23, 2026
) Fixes [F-680](https://linear.app/aztec-labs/issue/F-680/migrate-pxe-tagging-stores-to-prefixed-apptaggingsecret-keys) Migrates PXE tagging-store keys off the legacy two-part `AppTaggingSecret` string format (`secret:app`) so every persisted key uses the uniform self-describing `kind:secret:app` form. - `AppTaggingSecret.toString()` now always emits `kind:secret:app` (the unconstrained special case that emitted the legacy two-part key is gone). - `AppTaggingSecret.fromString()` only accepts the three-part form; a two-part legacy key now throws instead of parsing. - Bumped `PXE_DATA_SCHEMA_VERSION` 12 → 13. Since the general PXE migration framework does not exist, and per the issue discussion, this cuts over via the schema-version bump rather than a dual-read / self-healing path. `initStoreForRollupAndSchemaVersion` wipes any DB whose stored schema version differs from the current one on open, so a DB written with legacy keys is cleared before the new parser ever reads it. **Blast radius:** the wipe resets the *entire* PXE DB (addresses, notes, contracts, key store, L2 tips, facts, and tagging), not just tagging data, because they share one backing KV store. Existing wallets re-sync from genesis after upgrade. This is inherent to any `PXE_DATA_SCHEMA_VERSION` bump. - `app_tagging_secret.test.ts`: pins the new three-part unconstrained `toString()`, adds a "rejects the legacy two-part format" case, drops the now-redundant kind-prefixed-unconstrained test. - `pxe_db_compatibility.test.ts`: adds a pre-migration wipe test that writes a raw legacy two-part key at schema v12, reopens at v13, and asserts the raw map is empty (it asserts raw map contents rather than a high-level getter, which would false-pass since a new three-part `toString()` never reconstructs a legacy key). (cherry picked from commit 736f391)
rangozd
pushed a commit
to rangozd/aztec-packages
that referenced
this pull request
Aug 5, 2026
…ecProtocol#24932) Forward-ports the **pxe / client / txe** slice of the v5-next → next backlog (work merged to `v5-next` after the ~2026-07-08 cut that reshaped `next`). ## Applied (clean cherry-picks, chronological) - fix: tweak depositToAztec gas config (AztecProtocol#24607) - refactor: cache Aztec node reads per execution (AztecProtocol#24630) - fix: prevent access to secrets not in scope (AztecProtocol#24616) - docs: fee readme improvements (AztecProtocol#24666) - fix(pxe): widen tracked sender tagging ranges with onchain discovery evidence (AztecProtocol#24655) - fix: tagging secrets not being scoped by sender (AztecProtocol#24772) ## Conflict resolutions (cherry-picked with `-x`, resolved against reshaped `next`) - fix(txe): align tagging strategy oracle with PXE (AztecProtocol#24561) — TXE oracle version bumped to 4.0 (breaking rename `setTaggingSecretStrategy` -> `setTaggingSecretStrategies`; `next` was at 3.0 with its own hash), interface hash recomputed on the merged registry. Migration note dropped: already on `next` under 5.0.0. - feat(pxe)!: Add AppTaggingSecret kinds to keys in tagging stores (AztecProtocol#24604) — `PXE_DATA_SCHEMA_VERSION` 12 -> 13 applies cleanly on `next`. Migration note dropped: already on `next` under 5.0.0. - feat: add batch is block in archive oracle (AztecProtocol#24634) — applied cleanly on top of AztecProtocol#24561; contract oracle version 30.6 -> 30.7, v5 interface hash matched the merged registry. - feat: getTxEffects oracle (AztecProtocol#24636) — applied cleanly. - ~~feat: preserve stores on schema version or rollup address change (AztecProtocol#24631)~~ — ported separately via AztecProtocol#24947 together with the rest of the sqlite/OPFS line - feat(txe): add option to authorize all utility call targets (AztecProtocol#24662) — additive on our 4.0 -> TXE oracle version 4.1 (was 3.0 -> 3.1 on v5), hash recomputed. - refactor(pxe): compute oracle interface hash from wire-structural mapping labels (AztecProtocol#24752) — TXE hash recomputed under the new wire-structural scheme; PXE hash from the pick matched. Verified locally: full `yarn build`, `check_oracle_version` + `check_txe_oracle_version`, TXE unit suite (21), pxe tagging/type-mapping/utility-oracle suites, and 29 targeted aztec-nr + onchain_delivery_test_contract TXE tests — all green. Part of the manual v5-next → next backlog sweep. ## Added after review - AztecProtocol#24627 fix(aztec.js): give waitForNode a bounded default timeout — missed by the initial sweep (merge-commit wrapper + non-`(#N)` leaf); genuinely absent from `next`.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes F-680
What changed
Migrates PXE tagging-store keys off the legacy two-part
AppTaggingSecretstring format (secret:app) so every persisted key uses the uniform self-describingkind:secret:appform.AppTaggingSecret.toString()now always emitskind:secret:app(the unconstrained special case that emitted the legacy two-part key is gone).AppTaggingSecret.fromString()only accepts the three-part form; a two-part legacy key now throws instead of parsing.PXE_DATA_SCHEMA_VERSION12 → 13.Migration strategy (breaking)
Since the general PXE migration framework does not exist, and per the issue discussion, this cuts over via the schema-version bump rather than a dual-read / self-healing path.
initStoreForRollupAndSchemaVersionwipes any DB whose stored schema version differs from the current one on open, so a DB written with legacy keys is cleared before the new parser ever reads it.Blast radius: the wipe resets the entire PXE DB (addresses, notes, contracts, key store, L2 tips, facts, and tagging), not just tagging data, because they share one backing KV store. Existing wallets re-sync from genesis after upgrade. This is inherent to any
PXE_DATA_SCHEMA_VERSIONbump.Tests
app_tagging_secret.test.ts: pins the new three-part unconstrainedtoString(), adds a "rejects the legacy two-part format" case, drops the now-redundant kind-prefixed-unconstrained test.pxe_db_compatibility.test.ts: adds a pre-migration wipe test that writes a raw legacy two-part key at schema v12, reopens at v13, and asserts the raw map is empty (it asserts raw map contents rather than a high-level getter, which would false-pass since a new three-parttoString()never reconstructs a legacy key).