Repository navigation
vault: add raw_vault_public_key to Observations for pure StateTransition - #2427
Merged
Merged
Conversation
Contributor
|
👋 prashantkumar1982, thanks for creating this pull request! To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team. Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks! |
Contributor
✅ API Diff Results -
|
cedric-cordenier
approved these changes
Sep 29, 2026
prashantkumar1982
enabled auto-merge
September 29, 2026 16:39
jmank88
approved these changes
Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Follow-up to the Vault reshare zero-downtime PublicKey work. The
GetSecretsOCR response carriesraw_vault_public_keyso decrypt-side callers read the live DKG key from the response instead of static config. In the initial implementation the Vault plugin populated that field insideStateTransitionby reading node-local config (r.cfg.PublicKey+ the gate), which makesStateTransitiondepend on inputs outside(query, observations)and can diverge during a staggered gate rollout.Per review feedback, the public key should travel through the node's Observation and be aggregated in
StateTransition, keeping the transition a pure function of observations.Change
Add
bytes raw_vault_public_key = 5;to theObservationsmessage. Each node broadcasts its view of the DKG public key once per observation (when the include-public-key gate is open); the chainlink Vault plugin aggregates the quorum-agreed value ontoGetSecretsResponse.raw_vault_public_key.pkg/capabilities/actions/vault/messages.proto— new field onObservations.pkg/capabilities/actions/vault/messages.pb.go— regenerated viamake generate.Named to match the existing
GetSecretsResponse.raw_vault_public_key.Downstream
Prerequisite for the chainlink-side plugin change (smartcontractkit/chainlink#23834), which consumes
Observations.GetRawVaultPublicKey()and will bump to this version once published.