VM "bulldozer" upgrade

[dckc]

What is the Problem Being Solved?

In the SwingSet VM started when the chain was upgraded to the pismoA release, many of the critical vats are not upgradeable (#5014 esp Zoe #4383 ). Its depth-first scheduler (#6210) is inadequate to support vaults / liquidation.

Description of the Design

Throw away all kernel and JS state; recover from a copy of JS state in the cosmos layer.

Tasks

Beta Give feedback

1. reinstantiate PSM with state from chainStorage #6645
   6 of 6
   Inter-protocol enhancement user-story vaults_triage +4
   
2. Sufficient durability / upgradability of Vat contracts for launch #5014
   Epic SwingSet enhancement vaults_triage +4
   
3. verify priceAggregatorChainlink.js is production-ready #6571
   enhancement oracle vaults_triage +3
   
4. make Smart Wallet contract durable #5894
   MUST-HAVE enhancement vaults_triage wallet +4
   
5. smart wallets for those who paid 10 BLD should be preserved #7537
   bug cosmic-swingset vaults_triage wallet +4
   
6. Upgrade handler for upgrade-10 (vaults) #7357
   agoric-cosmos +1
   

Security Considerations

?

Test Plan

TBD

cc @warner @ivanlei

[warner]

for estimation purposes: this ticket describes a task that we must do on the chain, so it's more about an event than any particular code PR. I think we should use this ticket to track our preparedness for the upgrade event, and our plan for executing it. We can close it once the bulldozer upgrade has happened.

As such, we need at least the following in place before we can perform the upgrade. Note that there are other features that we want in the release (Vaults in particular); this list is specifically only what we need to do in our final opportunity to abandon old JS state:

• all vats that will be deployed as part of the bulldozer must be upgradable, to be safe against the future
  • subtask: enumerate all those vats: all static vats, all early-governance-deployed vats, everything deployed to maintain existing services like PSM
  • subtask: have tickets for the upgradability of all those vats/services
  • subtask: all platform vats must be upgradable swingset's internal vats should be upgradable #5666 (vat-admin, timer, network Upgradable network vat #5973)
• the new vats must have a way to reestablish any precious state from the pismo chain (PSM total balances? smart-wallet accounts?)
• state-sync must work (agd does not support joining with state sync #3769), in particular the database schema and swing-store must support writing the correct validation hashes into the IAVL tree. The new-validator repopulating portion is a desireable (and perhaps mandatory) feature of the release, but we could defer it, as long as the state-sync-snapshot generation side works correctly as of the bulldozer event, so we don't lose the ability to validate alleged transcript/heap-snapshot/kvstore artifacts.
• kernel must be upgradable without changing worker behavior (define worker-v1 package #6596)
• we have improvements in mind that cross the kernel/vat boundary, which are much harder to do after the bulldozer. We can't do all of them, but the more we can accomplish now, the less pain we'll endure in the future
  • removing stopVat in favor of kernel-side data deletion (during vat upgrade) remove stopVat(): allow vat upgrade without participation of old vat version #6650

I'll add those tickets as dependencies of this one.

[turadg]

all vats that will be deployed as part of the bulldozer must be upgradable, to be safe against the future

I've expanded the scope of #6553 to be that. This ticket is now "Pismo can be bulldozed into a working state". That the resulting state is itself upgradable in-place is the other ticket.

[ivanlei]

All tracked issues are completed. Closing.