feat(deploy): support bypassing on chain assumptions for sequenced

tmigone · tmigone · commit 7054f73ccc4a · 2026-07-24T16:01:19.000-03:00
execution

Signed-off-by: Tomás Migone &lt;tomas@edgeandnode.com&gt;
diff --git a/packages/deployment/deploy/gip/0088/eligibility_integrate.ts b/packages/deployment/deploy/gip/0088/eligibility_integrate.ts
@@ -9,7 +9,7 @@ import {
 } from '@graphprotocol/deployment/lib/contract-registry.js'
 import { canSignAsGovernor } from '@graphprotocol/deployment/lib/controller-utils.js'
 import { getResolvedSettingsForEnv } from '@graphprotocol/deployment/lib/deployment-config.js'
-import { ComponentTags, GoalTags } from '@graphprotocol/deployment/lib/deployment-tags.js'
+import { assumeUpgraded, ComponentTags, GoalTags } from '@graphprotocol/deployment/lib/deployment-tags.js'
 import { requireContracts } from '@graphprotocol/deployment/lib/issuance-deploy-utils.js'
 import { createActionModule } from '@graphprotocol/deployment/lib/script-factories.js'
 import { syncComponentsFromRegistry } from '@graphprotocol/deployment/lib/sync-utils.js'
@@ -43,6 +43,23 @@ async function integrateOracle(
   await syncComponentsFromRegistry(env, [reoEntry, targetEntry])
   const [reo, target] = requireContracts(env, [reoEntry, targetEntry])
 
+  const { governor, canSign } = await canSignAsGovernor(env)
+
+  // Sequenced-bundle generation: the target proxy isn't upgraded yet, so the
+  // oracle getter would revert. Skip the probe/idempotency read and emit the
+  // set-oracle TX unconditionally. The resulting bundle is sequenced-only —
+  // execute it after the upgrade bundle (nonce order enforces this).
+  if (assumeUpgraded()) {
+    await applyConfiguration(env, client, [createRMIntegrationCondition(reo.address)], {
+      contractName: `${target.name}-REO`,
+      contractAddress: target.address,
+      canExecuteDirectly: canSign,
+      executor: governor,
+      assumeUndone: true,
+    })
+    return
+  }
+
   // Skip only if the target isn't upgraded yet (no oracle getter). Once it
   // supports the getter, config is the source of truth: applyConfiguration is
   // idempotent — it re-points the oracle to the configured REO when the current
@@ -59,8 +76,6 @@ async function integrateOracle(
     return
   }
 
-  const { governor, canSign } = await canSignAsGovernor(env)
-
   await applyConfiguration(env, client, [createRMIntegrationCondition(reo.address)], {
     contractName: `${target.name}-REO`,
     contractAddress: target.address,
diff --git a/packages/deployment/deploy/gip/0088/issuance_connect.ts b/packages/deployment/deploy/gip/0088/issuance_connect.ts
@@ -2,6 +2,7 @@ import {
   GRAPH_TOKEN_ABI,
   ISSUANCE_ALLOCATOR_ABI,
   ISSUANCE_TARGET_ABI,
+  REWARDS_MANAGER_DEPRECATED_ABI,
   SET_TARGET_ALLOCATION_ABI,
 } from '@graphprotocol/deployment/lib/abis.js'
 import { getTargetChainIdFromEnv } from '@graphprotocol/deployment/lib/address-book-utils.js'
@@ -11,7 +12,7 @@ import {
 } from '@graphprotocol/deployment/lib/contract-checks.js'
 import { Contracts } from '@graphprotocol/deployment/lib/contract-registry.js'
 import { canSignAsGovernor } from '@graphprotocol/deployment/lib/controller-utils.js'
-import { ComponentTags, GoalTags } from '@graphprotocol/deployment/lib/deployment-tags.js'
+import { assumeUpgraded, ComponentTags, GoalTags } from '@graphprotocol/deployment/lib/deployment-tags.js'
 import {
   createGovernanceTxBuilder,
   executeTxBatchDirect,
@@ -68,9 +69,18 @@ export default createActionModule(
     // Create viem client for direct contract calls
     const client = graph.getPublicClient(env) as PublicClient
 
-    // Check if RewardsManager supports IIssuanceTarget (has been upgraded)
-    // Throws error if not upgraded
-    await requireRewardsManagerUpgraded(client, rmAddress, env)
+    const sequenced = assumeUpgraded()
+
+    // Check if RewardsManager supports IIssuanceTarget (has been upgraded).
+    // Throws if not upgraded — skipped under sequenced generation, where this
+    // bundle is built to execute right after the upgrade bundle (nonce order).
+    if (!sequenced) {
+      await requireRewardsManagerUpgraded(client, rmAddress, env)
+    } else {
+      env.showMessage(
+        '\n⚠ Sequenced generation: RM upgrade assumed — this bundle is SEQUENCED-ONLY and valid only AFTER the upgrade bundle executes (nonce order).\n',
+      )
+    }
 
     const targetChainId = await getTargetChainIdFromEnv(env)
 
@@ -86,7 +96,35 @@ export default createActionModule(
     // Sub-flags drive both the per-line status display and which TXs the build-batch needs.
     env.showMessage('📋 Checking current activation state...\n')
 
-    const connect = await checkIssuanceConnectComplete(client, iaAddress, rmAddress, gtAddress)
+    // Sequenced generation: RM isn't upgraded yet, so RM.getIssuanceAllocator (the
+    // iaIntegrated read inside checkIssuanceConnectComplete) would revert. Assume the
+    // RM-side wiring is undone and emit it. The rate invariant below is still enforced
+    // — both rates are readable on the un-upgraded RM. IA-side reads (default target)
+    // stay live in the TX-build section downstream.
+    const connect = sequenced
+      ? {
+          complete: false,
+          iaIntegrated: false,
+          iaMinter: false,
+          rmAllocationShape: false,
+          fullyAllocated: false,
+          iaRate: (await client.readContract({
+            address: iaAddress as `0x${string}`,
+            abi: ISSUANCE_ALLOCATOR_ABI,
+            functionName: 'getIssuancePerBlock',
+          })) as bigint,
+          rmRate: (await client.readContract({
+            address: rmAddress as `0x${string}`,
+            abi: REWARDS_MANAGER_DEPRECATED_ABI,
+            functionName: 'issuancePerBlock',
+          })) as bigint,
+          get ratesAligned(): boolean {
+            return this.iaRate === this.rmRate
+          },
+          currentIssuanceAllocator: '(unknown — RM not upgraded)',
+          rmAllocation: { selfMintingRate: 0n, allocatorMintingRate: 0n },
+        }
+      : await checkIssuanceConnectComplete(client, iaAddress, rmAddress, gtAddress)
 
     env.showMessage(
       `  IA integrated: ${connect.iaIntegrated ? '✓' : '✗'} (current: ${connect.currentIssuanceAllocator})`,
diff --git a/packages/deployment/docs/Gip0088Runbook.md b/packages/deployment/docs/Gip0088Runbook.md
@@ -816,6 +816,57 @@ prior stage. Abort is clean before [G4](#gate-g4); after, recovery needs a
 follow-up governance batch — see
 [GovernanceWorkflow.md](GovernanceWorkflow.md).
 
+## Sequenced bundle generation (single council signing session)
+
+The default flow generates each governance bundle only _after_ the previous one
+executes on-chain — every activation goal reads live state and gates on the RM
+upgrade ([S6](#stage-s6)/[S8](#stage-s8) skip or exit until RM is upgraded). On
+mainnet, where the council signs M-of-N over days, that forces one signing round
+per stage. To hand the council **every** GIP-0088 bundle at once, set
+`GIP_0088_ASSUME_UPGRADED=1` when generating the activation bundles:
+
+```bash
+# Upgrade bundle — generated normally (already carries the RM-gated config:
+# setDefaultReclaimAddress + setRevertOnIneligible, ordered after the RM upgrade)
+pnpm hardhat deploy --tags GIP-0088:upgrade,upgrade --network arbitrumOne
+
+# Activation bundles — generated ahead of the upgrade executing
+GIP_0088_ASSUME_UPGRADED=1 pnpm hardhat deploy --tags GIP-0088:eligibility-integrate --network arbitrumOne
+GIP_0088_ASSUME_UPGRADED=1 pnpm hardhat deploy --tags GIP-0088:issuance-connect     --network arbitrumOne
+```
+
+With the flag, `eligibility-integrate` and `issuance-connect` skip the
+"is RM upgraded on-chain" guard and the post-upgrade idempotency reads (which
+would revert against the old implementation) and emit their full tx set.
+
+**Execution — nonce order is load-bearing.** These activation bundles are
+**sequenced-only**: valid only when executed _after_ the upgrade bundle. Queue
+them on the council Safe in order:
+
+| Safe nonce | Bundle                                          |
+| ---------- | ----------------------------------------------- |
+| N          | `gip-0088-upgrades.json` (upgrades + RM config) |
+| N+1        | `eligibility-integrate` bundle                  |
+| N+2        | `gip-0088-issuance-connect.json`                |
+
+The Safe executes in strict nonce order, so RM is upgraded by the time N+1/N+2
+run, and the council reviews + signs all three in one session. If bundle N fails,
+N+1/N+2 are blocked rather than executing against an un-upgraded RM.
+
+- **Kept:** the `issuance-connect` rate invariant
+  (`IA.issuancePerBlock == RM.issuancePerBlock`) is still enforced — it reads
+  `RM.issuancePerBlock`, which exists on the un-upgraded RM.
+- **Dropped:** idempotency. The flag blind-emits the full set, so use it only for
+  the initial sequenced generation — **not** for re-runs or recovery, where the
+  default (guarded) mode reads live state and emits only the remaining work.
+- **`issuance-allocate`** stays a no-op in the DIPs-dormant config (RM already
+  100% from `issuance-connect`), so it needs no bundle. On a DIPs-active config,
+  generate it too, with the flag, as an `N+3` sequenced bundle.
+
+This mode trades the staged per-goal review gates ([G7](#gate-g7)/[G9](#gate-g9))
+for a single up-front review of all bundles — a deliberate choice for the
+one-session council workflow, not the default.
+
 ## Activating DIPs later
 
 DIPs ship dormant (see [Phase C](#phase-c--activation)). Turning them on is the
diff --git a/packages/deployment/lib/apply-configuration.ts b/packages/deployment/lib/apply-configuration.ts
@@ -34,6 +34,16 @@ export interface ApplyConfigurationOptions {
 
   /** Account to execute from (if canExecuteDirectly) */
   executor?: string
+
+  /**
+   * Skip the on-chain state check and treat every condition as un-applied,
+   * emitting a TX for each. Used by sequenced-bundle generation
+   * (`GIP_0088_ASSUME_UPGRADED`) where the target proxy isn't upgraded yet, so
+   * the getter reads that drive the normal idempotency check would revert
+   * against the old implementation. The resulting batch is sequenced-only —
+   * valid only after the upgrade bundle executes.
+   */
+  assumeUndone?: boolean
 }
 
 /**
@@ -77,16 +87,34 @@ export async function applyConfiguration<T>(
   conditions: ConfigCondition<T>[],
   options: ApplyConfigurationOptions,
 ): Promise<ApplyConfigurationResult<T>> {
-  const { contractName, contractAddress, canExecuteDirectly, executor } = options
-
-  // 1. Check all conditions
-  env.showMessage(`📋 Checking ${contractName} configuration...\n`)
-
-  const status = await checkConditions(client, contractAddress, conditions)
+  const { contractName, contractAddress, canExecuteDirectly, executor, assumeUndone } = options
+
+  // 1. Check all conditions — or, in sequenced-generation mode, skip the read and
+  // treat every condition as un-applied (the target proxy isn't upgraded yet, so
+  // the getter reads would revert). The resulting batch is sequenced-only.
+  let status: ConfigurationStatus<T | boolean>
+  if (assumeUndone) {
+    env.showMessage(
+      `⚠ ${contractName}: sequenced generation — skipping on-chain check, emitting all configuration TXs\n`,
+    )
+    status = {
+      allOk: false,
+      conditions: conditions.map((c) => ({
+        name: c.name,
+        ok: false,
+        current: false,
+        target: false,
+        message: `  (assumed un-applied) ${c.name}`,
+      })),
+    }
+  } else {
+    env.showMessage(`📋 Checking ${contractName} configuration...\n`)
+    status = await checkConditions(client, contractAddress, conditions)
 
-  // Display results
-  for (const result of status.conditions) {
-    env.showMessage(`  ${result.message}`)
+    // Display results
+    for (const result of status.conditions) {
+      env.showMessage(`  ${result.message}`)
+    }
   }
 
   // 2. If all OK, no-op
diff --git a/packages/deployment/lib/deployment-tags.ts b/packages/deployment/lib/deployment-tags.ts
@@ -81,6 +81,28 @@ export const GoalTags = {
   GIP_0088_ISSUANCE_CLOSE_GUARD: 'GIP-0088:issuance-close-guard',
 } as const
 
+/**
+ * Sequenced-bundle generation flag (`GIP_0088_ASSUME_UPGRADED=1`).
+ *
+ * When set, the GIP-0088 activation goals (`eligibility-integrate`,
+ * `issuance-connect`) build their governance bundles as if the RewardsManager
+ * upgrade had already landed — skipping the "is RM upgraded on-chain" guard and
+ * the post-upgrade idempotency reads that would otherwise revert against the
+ * un-upgraded proxy.
+ *
+ * Purpose: generate the whole GIP-0088 governance sequence up front so a council
+ * multisig can review and sign every bundle in ONE session, executing them in
+ * nonce order (upgrade bundle first). The activation bundles produced this way
+ * are SEQUENCED-ONLY — valid only when executed after the upgrade bundle; the
+ * Safe's nonce ordering enforces that.
+ *
+ * Do NOT use for re-runs or recovery: it blind-emits the full tx set with no
+ * idempotency. Use the default (guarded) mode there. The rate-alignment
+ * invariant in `issuance-connect` is still enforced (it does not need the new
+ * implementation).
+ */
+export const assumeUpgraded = (): boolean => process.env.GIP_0088_ASSUME_UPGRADED === '1'
+
 /**
  * Special tags
  */
