Committee expiration, validation and modification

[teodanciu]

Description

Closes #3443

• In Gov rule, check the NewCommittee action failing if :
  • the members to be removed are not part of the current committee (for this, the current committee from EnactState had to be added to GovEnv)
  • the expiration epoch of the new members are not exceeding the ppCommitteeTermLimitL, given the current epoch
• Rename NewCommittee to UpdateCommittee and change its semantics to "update committee", rather than "replace committee". This means: in Enact rule: adding and removing members correctly, and in Gov rule: checking correctly the minimum committee size, considering the current committee.
• Update CommitteeState when members get removed

Checklist

• Commit sequence broadly makes sense and commits have useful messages
• New tests are added if needed and existing tests are updated
• When applicable, versions are updated in .cabal and CHANGELOG.md files according to the
  versioning process.
• The version bounds in .cabal files for all affected packages are updated. If you change the bounds in a cabal file, that package itself must have a version increase. (See RELEASING.md)
• All visible changes are prepended to the latest section of a CHANGELOG.md for the affected packages. New section is never added with the code changes. (See RELEASING.md)
• Code is formatted with fourmolu (use scripts/fourmolize.sh)
• Cabal files are formatted (use scripts/cabal-format.sh)
• hie.yaml has been updated (use scripts/gen-hie.sh)
• Self-reviewed the diff

[lehins]

This is a very nice piece of work. Some fixes are needed, but overall looks great.

Also needs a rebase on master.

[WhatisRT]

NewCommittee shouldn't fail in GOV if the removed members aren't in the CC. The reason for this is simple: you only know the current EnactState, but not necessarily the one that this GA is actually supposed to apply to. You could argue that this logic should then go into ENACT, and I originally wanted to put it there, but I've removed it again. The reasoning is here: IntersectMBO/formal-ledger-specifications#206 (comment)

Long story short, I think we should only do this check if we keep track of in-flight GAs & validate new ones against the current state and the ones in the queue.

[lehins]

NewCommittee shouldn't fail in GOV if the removed members aren't in the CC. The reason for this is simple: you only know the current EnactState, but not necessarily the one that this GA is actually supposed to apply to.

@WhatisRT Yes, I brought up the same point here: #3721 (comment)

One more reason in favor of #3655

[teodanciu]

@lehins I think the latest covers the items that came up after the meeting yesterday, if you would like to take another look.

• Prevent expiry epochNo less or equal to current epochNo in GOV
• Accept expiry from the past on Enactment
• Delay expiry that is too long
• Prevent intersection of removed and added/updated in GOV

[lehins]

Beautiful! 👍