Default template: owner-only deploy calls, RISC Zero mode proves the bundled CRISP program, ctrl_port collision

[hmzakhalid]

Summary

Default template issues found while verifying the docs.

1. Owner-only calls. templates/default/deploy/default.ts:60,73 calls setCiphertextVerifier and registerE3Program, which are onlyOwner (Interfold.sol:612, 678). On Sepolia, both revert with OwnableUnauthorizedAccount for any caller except the owner 0x8837e47c4Bb520ADE83AAB761C3B60679443af1B. A developer cannot deploy the template program to the shared deployment.
2. RISC Zero mode proves the bundled program. crates/support-scripts/ctl/container mounts the project's generated contracts, tests, and caches, but not program/. The support image copies crates/support to /app, and /app/program/src/lib.rs in ghcr.io/theinterfold/e3-support:6de9117f1 is the CRISP processor (policy::crisp()). With program.dev: false, the guest is not the project's program.
3. Control port collision. templates/default/interfold.config.yaml sets ctrl_port 50501 to 50505 for cn1 to cn5 and has no active top-level node: block. The default node uses the built-in 50505. interfold config get ctrl_port and interfold --name cn5 config get ctrl_port both print 50505, so commands that the CLI forwards to a running node (main.rs connect_daemon) reach cn5.

[hmzakhalid]

Rechecked against main at 29fbd7152 on 2026-09-30. All three problems remain:

• Owner-only calls: templates/default/deploy/default.ts:60 and :73 call owner-only functions. That guard is intended, so the template needs an ownership preflight and a documented onboarding path, not a contract change.
• Wrong guest: with RISC Zero enabled, the support container mounts no project program (crates/support-scripts/ctl/container:79) and runs the bundled one (crates/support/program/src/lib.rs:16). Dev mode, the template default, and an explicit remote guest are not affected.
• Port collision: ctrl_port 50505 in templates/default/interfold.config.yaml:83 collides with cn5 (crates/config/src/app_config.rs:124) when cn5 is running.