docs: TEE verifier deploy + vote-in runbook by pbeza · Pull Request #3882 · near/mpc

pbeza · 2026-07-21T15:22:52Z

claude · 2026-07-21T15:23:53Z

PR title type suggestion: This PR includes a reproducible build configuration fix in Cargo.toml, so the type prefix should be build: instead of docs:.

Suggested title: build: TEE verifier reproducible build + deploy runbook

claude · 2026-07-21T15:25:26Z

Pull request overview

Adds docs/deploy-tee-verifier.md, a network-agnostic runbook for building, deploying, locking, and voting-in the stateless tee-verifier contract; also inherits repository from the workspace in crates/tee-verifier/Cargo.toml so cargo near build reproducible-wasm no longer fails the NEP-330 metadata check.

Changes:

crates/tee-verifier/Cargo.toml: add repository = { workspace = true } — the workspace [workspace.package] already sets repository = "https://github.com/near/mpc", so this unblocks the reproducible (docker) build.
docs/deploy-tee-verifier.md: new 7-step runbook (mainnet/testnet parameterised) covering reproducible build, account creation, deploy, audit, key-deletion lock, vote via vote_tee_verifier_change, and confirmation via tee_verifier_votes.

Reviewed changes

Per-file summary

File	Description
crates/tee-verifier/Cargo.toml	Inherit `repository` from `[workspace.package]` so NEP-330 metadata is populated for `cargo-near` reproducible builds.
docs/deploy-tee-verifier.md	New operator runbook for deploying the `tee-verifier` contract and voting it in as trusted verifier.

Findings

I verified the referenced contract entry points against the current source:

vote_tee_verifier_change(candidate_account_id, expected_code_hash) — crates/contract/src/lib.rs:1618
tee_verifier_votes() view — crates/contract/src/lib.rs:2123
state() view — crates/contract/src/lib.rs:2082
verify_quote on the verifier — crates/tee-verifier/src/lib.rs:49
The log line the runbook grep-relies on (vote_tee_verifier_change: new verifier = {}) is emitted at crates/contract/src/lib.rs:1647.

expected_code_hash serde format is hex (see serialize_hash at crates/primitives/src/hash.rs:21 and the macro at hash.rs:78), so the runbook's "SHA-256 hex from step 1" instruction is correct.

Non-blocking (nits / suggestions):

docs/deploy-tee-verifier.md:117 — the optional verify_quote sanity-check references crates/tee-verifier/tests/fixtures/verify_quote_args.borsh, which does not exist on this branch (fixtures dir is empty; see crates/tee-verifier/tests/). PR description notes this resolves once test(localnet): deploy and vote in the TEE verifier contract #3855 merges, but an operator following the doc between the two merges will hit a missing-file error. Consider either (a) an inline callout in the doc ("Requires the fixture from test(localnet): deploy and vote in the TEE verifier contract #3855; skip until that PR lands"), or (b) rebasing this PR on top of test(localnet): deploy and vote in the TEE verifier contract #3855.
crates/tee-verifier/Cargo.toml:6 — for consistency with the other workspace-inheriting crates in the repo (near-contract-transport, near-mpc-contract-interface, near-mpc-sdk, near-mpc-crypto-types, near-mpc-bounded-collections, near-mpc-signature-verifier, all use repository.workspace = true), consider the shorthand repository.workspace = true instead of repository = { workspace = true }. Purely cosmetic; both forms are equivalent.
PR description mentions the fix mirrors what mpc-contract "already does", but crates/contract/Cargo.toml:6 uses a literal string (repository = \"https://github.com/near/mpc\"), not workspace inheritance. Description-only nit — the change itself is correct and produces the same URL.
docs/deploy-tee-verifier.md:130 — suggesting state json-args {} for reading the threshold returns the full ProtocolContractState, which is verbose. If a narrower view exists (or is worth adding), operators would appreciate it; not required.

✅ Approved

Network-agnostic guide (mainnet or testnet) covering the reproducible build, deploy to a locked account, the operator audit checklist, locking, and the vote_tee_verifier_change flow.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

netrome

There seems to be some fixtures missing, but the gudie otherwise looks good.

netrome · 2026-07-21T19:40:08Z

+`near-cli`, and toolchain versions. A running Docker daemon is required for the
+reproducible build. Both `mainnet` and `testnet` are built-in `near-cli` network configs,


Still sad that we require a dunning Docker daemon for reproducible builds. Long for the day when I can do this with Podman as well. Don't think it's super complicated but we've never had time to prioritize it.

In this case I am not sure if it depends on us, as that reproducible build is managed by cargo-near not us

gilcu3

Thank you!

gilcu3 · 2026-07-22T05:42:13Z

+`near-cli`, and toolchain versions. A running Docker daemon is required for the
+reproducible build. Both `mainnet` and `testnet` are built-in `near-cli` network configs,


In this case I am not sure if it depends on us, as that reproducible build is managed by cargo-near not us

barakeinav1

thanks, approved with one comment.

Note - I haven't tried to run those steps myself.

…oducible-build

pbeza · 2026-07-22T09:25:26Z

Addressed all the comments. Could you please re-approve, @barakeinav1 @netrome @gilcu3?

Copilot AI review requested due to automatic review settings July 21, 2026 15:22

pbeza mentioned this pull request Jul 21, 2026

Document TEE verifier deploy + vote-in #3883

Closed

1 task

docs: add TEE verifier deploy + vote-in runbook

4b555cb

Network-agnostic guide (mainnet or testnet) covering the reproducible build, deploy to a locked account, the operator audit checklist, locking, and the vote_tee_verifier_change flow.

pbeza force-pushed the fix-tee-verifier-reproducible-build branch from 328bd7b to 4b555cb Compare July 21, 2026 15:48

pbeza changed the title ~~docs: TEE verifier deploy runbook + reproducible-build fix~~ docs: TEE verifier deploy + vote-in runbook Jul 21, 2026

Copilot AI reviewed Jul 21, 2026

pbeza requested review from barakeinav1, Copilot, gilcu3, kevindeforth and netrome July 21, 2026 16:01

Copilot started reviewing on behalf of pbeza July 21, 2026 16:02 View session

Copilot AI reviewed Jul 21, 2026

View reviewed changes

Comment thread docs/deploy-tee-verifier.md

netrome previously approved these changes Jul 21, 2026

View reviewed changes

gilcu3 previously approved these changes Jul 22, 2026

View reviewed changes

barakeinav1 reviewed Jul 22, 2026

View reviewed changes

Comment thread docs/deploy-tee-verifier.md

barakeinav1 previously approved these changes Jul 22, 2026

View reviewed changes

barakeinav1 reviewed Jul 22, 2026

View reviewed changes

Comment thread docs/deploy-tee-verifier.md Outdated

pbeza added 2 commits July 22, 2026 10:36

docs: trim redundant intro sentence in tee-verifier runbook

d9e2632

docs: clarify the Overview in the tee-verifier runbook

3bacf4c

pbeza dismissed stale reviews from barakeinav1, gilcu3, and netrome via 3bacf4c July 22, 2026 08:47

docs: drop redundant sentence in tee-verifier build step

9c70a5e

gilcu3 previously approved these changes Jul 22, 2026

View reviewed changes

pbeza mentioned this pull request Jul 22, 2026

Add a view method for the current TEE verifier account #3889

Closed

2 tasks

docs: have voters confirm the verifier account is locked

b76c6e2

pbeza dismissed gilcu3’s stale review via b76c6e2 July 22, 2026 09:14

Merge remote-tracking branch 'origin/main' into fix-tee-verifier-repr…

b059192

…oducible-build

pbeza enabled auto-merge July 22, 2026 09:17

pbeza requested review from barakeinav1, gilcu3 and netrome July 22, 2026 09:20

pbeza mentioned this pull request Jul 22, 2026

Test each deployed TEE verifier with a valid attestation in the release process #3891

Open

1 task

gilcu3 approved these changes Jul 22, 2026

View reviewed changes

barakeinav1 approved these changes Jul 22, 2026

View reviewed changes

pbeza added this pull request to the merge queue Jul 22, 2026

Merged via the queue into main with commit 66f40e1 Jul 22, 2026
16 checks passed

pbeza deleted the fix-tee-verifier-reproducible-build branch July 22, 2026 10:13

		`near-cli`, and toolchain versions. A running Docker daemon is required for the
		reproducible build. Both `mainnet` and `testnet` are built-in `near-cli` network configs,

Uh oh!

Conversation

pbeza commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

claude Bot commented Jul 21, 2026

Uh oh!

claude Bot commented Jul 21, 2026

Pull request overview

Reviewed changes

Findings

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

netrome left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

netrome Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

gilcu3 Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gilcu3 left a comment

Choose a reason for hiding this comment

Uh oh!

gilcu3 Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

barakeinav1 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pbeza commented Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

pbeza commented Jul 21, 2026 •

edited

Loading