deps: re-pin jito restaking by rev + bump ncn-program-core to Phase 1 main; freeze VerifyCertificate seams

- jito-foundation/restaking deps pinned by rev=358fbc3c (dead v2.1-upgrade
  branch no longer referenced anywhere; fresh clones resolve by SHA), adding
  the sdk/core crates the counter-solana deployer uses
- ncn-program-core bumped to main#9013404 (post phase1-dmsg merge)
- VERIFY_CERTIFICATE_DISCRIMINATOR frozen at the generated client's value
  (byte 10); pinning test now differentially asserts the FULL instruction
  data against ncn_program_core::instruction::NCNProgramInstruction
- JitoQuorum.generation now reads Snapshot.generation (was hardcoded 0)
- consensus_threshold_bps now read from the on-chain NCN Config PDA in
  get_quorum (deployment JSON demoted to fallback when the PDA is missing)
- counter-solana-deployer crate stub (workspace member, not default-members)

Gates: fmt, clippy -D warnings (jito+examples+deployer), 41 jito tests,
8 example tests, EVM 43 tests, cargo check --workspace --all-targets.

Author: Ron Turetzky

Cargo.lock

@@ -8,6 +8,7 @@ members = [
     "examples/counter/node",
     "examples/counter/router",
     "examples/counter-solana/common",
+    "examples/counter-solana/deployer",
     "examples/counter-solana/node",
     "examples/counter-solana/router",
     "jito",
@@ -83,12 +84,19 @@ url = { version = "2.5.4", features = ["serde"] }
 # workspace pins solana-program to the jito-solana fork below, so the solana
 # runtime crates here use the SAME git source to keep types unified.
 ncn-program-core = { git = "https://github.com/BreadchainCoop/jito-ncn-program", branch = "main" }
-# NOTE: branch v2.1-upgrade was DELETED upstream; its head 358fbc3 is what
-# jito-ncn-program pins and remains fetchable by SHA. The checked-in
-# Cargo.lock pins that rev, which is the ONLY thing keeping this source
-# resolvable — do not run a full `cargo update` for this source (see
-# jito/README section in the PR description).
-jito-bytemuck = { git = "https://github.com/jito-foundation/restaking", branch = "v2.1-upgrade" }
+# NOTE: branch v2.1-upgrade was DELETED upstream; its head 358fbc3c remains
+# fetchable by SHA, so these deps are pinned by `rev` (mirrors jito-ncn-program
+# main's own re-pin). This removes the fresh-clone dependency on the dead
+# branch ref that the previous `branch = "v2.1-upgrade"` + seeded-Cargo.lock
+# arrangement carried. The sdk/core crates are the programs' own instruction
+# builders + PDA derivations, used by the counter-solana deployer.
+jito-bytemuck = { git = "https://github.com/jito-foundation/restaking", rev = "358fbc3c20d947c977a136808f9fbf7f070e478b" }
+jito-restaking-core = { git = "https://github.com/jito-foundation/restaking", rev = "358fbc3c20d947c977a136808f9fbf7f070e478b" }
+jito-restaking-sdk = { git = "https://github.com/jito-foundation/restaking", rev = "358fbc3c20d947c977a136808f9fbf7f070e478b" }
+jito-vault-core = { git = "https://github.com/jito-foundation/restaking", rev = "358fbc3c20d947c977a136808f9fbf7f070e478b" }
+jito-vault-sdk = { git = "https://github.com/jito-foundation/restaking", rev = "358fbc3c20d947c977a136808f9fbf7f070e478b" }
+spl-token = "6.0.0"
+spl-associated-token-account = "6.0.0"
 solana-account-decoder = { git = "https://github.com/jito-foundation/jito-solana.git", rev = "87dcd086af931d81a0a71ad49cbea38e9655f166" }
 solana-client = { git = "https://github.com/jito-foundation/jito-solana.git", rev = "87dcd086af931d81a0a71ad49cbea38e9655f166" }
 solana-program = { git = "https://github.com/jito-foundation/jito-solana.git", rev = "87dcd086af931d81a0a71ad49cbea38e9655f166" }

Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "counter-solana-deployer"
+version = { workspace = true }
+edition = "2021"
+publish = false
+
+[[bin]]
+name = "counter-solana-deployer"
+path = "src/main.rs"
+
+[dependencies]
+anyhow = { workspace = true }
+borsh = "0.10.3"
+clap = { workspace = true }
+hex = { workspace = true }
+jito-restaking-core = { workspace = true }
+jito-restaking-sdk = { workspace = true }
+jito-vault-core = { workspace = true }
+jito-vault-sdk = { workspace = true }
+ncn-program-core = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+solana-client = { workspace = true }
+solana-program = { workspace = true }
+solana-sdk = { workspace = true }
+spl-associated-token-account = { workspace = true }
+spl-token = { workspace = true }

examples/counter-solana/deployer/Cargo.toml

@@ -0,0 +1,3 @@
+//! Placeholder — the real deployer lands with the solana e2e driver.
+
+fn main() {}

examples/counter-solana/deployer/src/main.rs

@@ -229,8 +229,8 @@ pub fn main() {
             scheme.clone(),
             quorum.operator_indices(),
             quorum.operators_registered,
-            // Captured at quorum-assembly time (TODO-FREEZE: reads
-            // snapshot.generation() once Phase 1 lands — see JitoQuorum docs).
+            // Captured at quorum-assembly time from the on-chain
+            // Snapshot.generation (bumped on register/remove/rotation).
             quorum.generation,
             handler,
             assignments.clone(),

examples/counter-solana/router/src/app.rs

@@ -16,7 +16,7 @@ Built against the cross-track interface contract in
 | `config` | `NcnDeployment` — the NCN deployment JSON (`NCN_DEPLOYMENT_PATH`), analog of the EVM `avs_deploy.json`, plus PDA derivations. |
 | `network` | `JitoStakingClient` — operators via `getProgramAccounts` memcmp on `NCNOperatorAccount` (ncn field; ip+port sockets), stake/APK from the `Snapshot` PDA, all reads at `confirmed` minimum. Produces `JitoQuorum`: index-aligned participant set / G1 keys / on-chain operator indices / stakes. |
 | `quorum` | Startup reconciliation (§5): the minimum total stake over all `(N−f)`-sized signer subsets must clear `consensus_threshold_bps`, else refuse to start. |
-| `instruction` | Manual `VerifyCertificate` instruction construction (frozen §2 shape; borsh cross-checked). Discriminator is a TODO-FREEZE const until the `phase1-dmsg` branch pushes the generated client. |
+| `instruction` | Manual `VerifyCertificate` instruction construction (frozen §2 shape; borsh cross-checked). Discriminator (byte `10`) is FROZEN and differentially pinned against `ncn_program_core::instruction::NCNProgramInstruction` — the enum the generated client derives from (Phase 1, merged to `main`). |
 | `submitter` | `JitoSubmitter` + the `SolanaCertificateHandler` trait (peer of the EVM `BlsSignatureVerificationHandler`). `VerifyCertificateHandler` sends the tx with a compute budget; `Resolution{Executed}` only at `finalized`; blockhash expiry → rebuild and resend. A settlement-program handler (INTERFACES §4, Track C `settlement_core`) plugs into the same seam. |
 
 Participant indices (sorted G2 positions in the chassis `ordered::Set`) are
@@ -33,11 +33,14 @@ on-chain bitmap (padding bits set, byte-exact with
   jito-ncn-program patch set so ONE set of solana types flows through the
   whole graph. The patch is inert for the EVM path.
 - jito-foundation/restaking branch `v2.1-upgrade` was DELETED upstream; its
-  head `358fbc3` (what jito-ncn-program pins) remains fetchable by SHA and is
-  pinned in the checked-in `Cargo.lock`. A full `cargo update` (or
-  `cargo update` of the restaking source) will fail against the dead branch —
-  update surgically (`cargo update -p <pkg> --precise <ver>`) until upstream
-  re-pins by rev.
+  head `358fbc3c` (what jito-ncn-program pins) remains fetchable by SHA. The
+  workspace therefore pins every restaking crate by
+  `rev = "358fbc3c20d947c977a136808f9fbf7f070e478b"` (mirroring
+  jito-ncn-program main's own re-pin), so fresh clones and `cargo update`
+  never touch the dead branch ref. Update surgically
+  (`cargo update -p <pkg> --precise <ver>`) all the same — the jito-solana
+  fork rev and the restaking rev must move together with the
+  `ncn-program-core` pin.
 
 ## Example
 

jito/README.md

@@ -61,10 +61,11 @@ pub struct NcnDeployment {
     pub restaking_program_id: String,
     /// Stake-weighted consensus threshold in bps.
     ///
-    /// TODO-FREEZE(phase1-dmsg): Phase 1 adds `consensus_threshold_bps` to the
-    /// NCN `Config` PDA (admin-settable, default 6667). Once the git dep on
-    /// `ncn-program-core` picks that up, the on-chain value becomes the source
-    /// of truth and this field is only a fallback.
+    /// Phase 1 put `consensus_threshold_bps` on the NCN `Config` PDA
+    /// (admin-settable, default 6667) and `get_quorum` reads THAT value — the
+    /// one `VerifyCertificate` enforces. This field is only the fallback for
+    /// the window where the Config PDA does not exist yet; a mismatch is
+    /// logged and resolved in favor of the chain.
     #[serde(default = "default_threshold_bps")]
     pub consensus_threshold_bps: u64,
     /// Compute-unit limit for submitted transactions.

jito/src/config.rs

@@ -12,16 +12,17 @@ use solana_sdk::pubkey::Pubkey;
 
 /// The instruction discriminator prefix for `VerifyCertificate`.
 ///
-/// TODO-FREEZE(phase1-dmsg): Phase 1 is built in parallel on the
-/// `jito-ncn-program` branch `phase1-dmsg`, which is NOT pushed yet, so the
-/// shank/kinobi-generated discriminator is not knowable. The program's
-/// existing instructions use 1-byte borsh enum indices (kinobi
-/// `CastVoteInstructionData { discriminator: u8 } = 10`), NOT 8-byte
-/// anchor-style discriminators; `VerifyCertificate` replaces `CastVote`
-/// (INTERFACES.md §2), so index 10 is the best-known placeholder. The
-/// `discriminator_matches_generated_client` test below MUST be pointed at the
-/// generated `ncn-program-client` value (and this const frozen) before any
-/// live submission.
+/// FROZEN against Phase 1 (merged to jito-ncn-program `main`): the program
+/// uses 1-byte borsh enum indices (NOT 8-byte anchor-style discriminators)
+/// and `VerifyCertificate` sits at index 10 of `NCNProgramInstruction` — the
+/// `CastVote` slot it replaced. The generated client
+/// (`clients/rust/ncn_program/.../verify_certificate.rs`) emits the same
+/// `VerifyCertificateInstructionData { discriminator: 10 }`. The
+/// `discriminator_matches_generated_client` test below pins the FULL
+/// instruction-data encoding (discriminator ‖ borsh(args)) byte-for-byte
+/// against `ncn_program_core::instruction::NCNProgramInstruction`, the enum
+/// shank generates that client from, so any upstream reordering fails loudly
+/// on the next dep bump.
 pub const VERIFY_CERTIFICATE_DISCRIMINATOR: &[u8] = &[10];
 
 /// The `VerifyCertificate` argument block (post-discriminator instruction
@@ -180,18 +181,33 @@ mod tests {
         assert_eq!(args.instruction_data(), expected);
     }
 
-    /// TODO-FREEZE(phase1-dmsg): once the `phase1-dmsg` branch pushes the
-    /// generated `ncn-program-client`, replace the right-hand side with the
-    /// client's `VerifyCertificateInstructionData` discriminator and delete
-    /// this comment. Until then this pins the documented placeholder (the
-    /// CastVote slot it replaces) so any silent change is caught.
+    /// FROZEN: pins the const AND the complete instruction-data encoding to
+    /// `ncn_program_core::instruction::NCNProgramInstruction` — the enum the
+    /// shank/kinobi client generation reads, whose borsh serialization IS
+    /// `discriminator ‖ args`. The generated client's
+    /// `VerifyCertificateInstructionData` carries the same byte (10). If a
+    /// dep bump reorders the enum, this fails before anything reaches a
+    /// validator.
     #[test]
     fn discriminator_matches_generated_client() {
+        let args = sample_args();
+        let program_enum =
+            ncn_program_core::instruction::NCNProgramInstruction::VerifyCertificate {
+                digest: args.digest,
+                aggregated_g2: args.aggregated_g2,
+                aggregated_signature: args.aggregated_signature,
+                operators_signature_bitmap: args.operators_signature_bitmap.clone(),
+                expected_generation: args.expected_generation,
+            };
+        let canonical = program_enum.try_to_vec().expect("enum serializes");
+        // First byte(s): the discriminator const, frozen at the generated
+        // client's value (1-byte kinobi/borsh enum index, value 10).
+        assert_eq!(VERIFY_CERTIFICATE_DISCRIMINATOR, &canonical[..1]);
         assert_eq!(VERIFY_CERTIFICATE_DISCRIMINATOR, &[10]);
-        // The program uses 1-byte kinobi/borsh enum discriminators today; if
-        // the frozen shape switches to 8-byte shank discriminators this length
-        // assertion must be updated together with the const.
         assert_eq!(VERIFY_CERTIFICATE_DISCRIMINATOR.len(), 1);
+        // Full differential: our hand-rolled encoding == the program enum's
+        // borsh encoding, byte for byte.
+        assert_eq!(args.instruction_data(), canonical);
     }
 
     #[test]

jito/src/instruction.rs

@@ -14,7 +14,8 @@
 //! - [`quorum`]: startup reconciliation between the engine's count-based N3f1
 //!   quorum and the program's stake-weighted threshold.
 //! - [`instruction`]: manual `VerifyCertificate` instruction construction
-//!   (frozen §2 shape; discriminator TODO-FREEZE until `phase1-dmsg` pushes).
+//!   (frozen §2 shape; discriminator pinned byte-for-byte against the Phase 1
+//!   `NCNProgramInstruction` enum on `main`).
 //! - [`submitter`]: [`submitter::JitoSubmitter`] + the
 //!   [`submitter::SolanaCertificateHandler`] seam (peer of the EVM
 //!   `BlsSignatureVerificationHandler`), with finalized-only resolutions and