feat: add authenticated Zone benchmarking and scenarios

[Rjected]

Adds authenticated Zone benchmarking and a reusable multi-chain scenario runner on top of the existing workload/template system.

Authenticated RPC traffic

Generated and extracted transaction records now carry the logical on-chain sender. bench send can map that address to a configurable HTTP header, reload atomically replaced maps, and route aggregate block and txpool queries through a separate --query-rpc-url. The selected credential follows submissions, retries, setup and inclusion receipt polling, reconciliation, and receipt collection while aggregate queries remain unauthenticated. Missing sender metadata or mappings fail before dispatch; malformed replacements leave the last valid map active. Legacy NDJSON remains accepted when sender authentication is disabled.

Tempo keychain transactions use the authorized root user for authentication, while sponsored transactions use the transaction sender rather than the sponsor. txgen-tempo auth-token-map derives protocol-compatible tokens for an exact workload account pool, supports one-shot and watched refresh modes, and writes a sorted secret map through mode-0600 atomic replacement without contacting the Zone RPC.

Scenario execution and composition

Both chain binaries gain versioned scenario run, scenario validate, and scenario render commands. Named chains reuse ordinary workload files and split rpc_url submission traffic from optional query_rpc_url chain, nonce, checkpoint, confirmation, log, and adapter-query traffic. Per-chain request_auth applies the same sender-header map to submissions and sender-scoped receipt or transaction lookups.

Scenarios compose checkpoint, adapter invoke, template submit, wait_receipt, and decoded wait_log steps through immutable typed saves, ABI encoding, and hash expressions. The runner preflights chain IDs, pending nonce state, templates, and setup materialization before mutating a chain, then submits and confirms setup in order. Runtime controls cover journey and transaction pacing, bounded concurrency, account leases, confirmations, step timeouts, and continue or fail-fast policies. Ambiguous post-dispatch outcomes disable further submissions on that chain to avoid unsafe nonce reuse. Failed or timed-out journeys are reported before the command exits nonzero.

Reusable fragments support relative includes, typed parameters and outputs, nested aliases, namespaced saves, recursion and cycle detection, and source provenance in reports. Validation expands and checks composition, workloads, templates, ABIs, events, filters, and references without RPC access; rendering emits deterministic flattened YAML. Long-running generation, benchmark setup, scenario initialization, and active steps report progress on stderr.

Zone actions and receipt reporting

Tempo scenarios expose prepare_encrypted_deposit, a query-only action that reads a stable ZonePortal encryption key and creates a fresh OS-random secp256k1/AES-GCM payload compatible with viem’s encrypted-deposit tuple format.

Confirmed outer-transaction receipts feed distributions for gas_used, effective_gas_price, and fee_paid = gas_used * effective_gas_price. Bench results group them by workload input; scenarios group them by chain, template, and expanded step. Each distribution includes count, min, mean, p50, p95, and p99. Missing fee fields do not discard gas usage, and collection remains receipt-based without tracing or internal-call attribution.

Scenario JSON reports also include one client-generated run_id, execution configuration, journey and step outcomes, latency distributions, sanitized failures, optional lifecycle samples, and fragment provenance.

ClickHouse rollout and library impact

Migrations 006_txgen_scenario_runs.sql and 007_txgen_scenario_steps.sql must be deployed before enabling scenario ClickHouse reporting. Publication writes JSON first, then synchronously inserts step rows, the scenario aggregate, and finally txgen_runs as the visibility marker. Complete-run queries should begin at txgen_runs and join by run_id. Receipt metrics are not persisted by the ClickHouse reporters in this change.

The public Rust surface adds sender metadata, request-auth and authenticated RPC primitives, receipt aggregation, scenario schema/runtime/report types, online materialization helpers, nonce reservation rollback, and adapter scenario hooks. txgen-cli::run now requires NetworkAdapter + Default, and fixed-size ABI byte values must match their declared length instead of being padded or truncated.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	aes-gcm@​0.10.3
	axum@​0.8.9
	hkdf@​0.12.4

View full report