feat(test-utils): let a concurrency spec pick the deployer

The constructor ran on whichever instance `Object.values` yielded first,
so the deploying party was decided by the order names happened to be
written in. On a module whose initializer reads a witness, that seeds
the shared ledger with one party's secrets and the spec has no way to
see it: the choice is invisible at the call site and changes if someone
reorders the names.

Naming it makes the choice explicit where it matters and an error where
it is wrong. The default is unchanged, so nothing existing moves, and
the note core has no initializer, so nothing here needed it yet.

Dry only. The live backend deploys from the wallet pool's own deployer,
which is not a party, so the mapping is a question for whoever builds
that seam rather than something to guess at now.

Refs: #743 (comment)

Author: 0xisk

contracts/test-utils/concurrency/DryReplayHarness.ts

@@ -79,7 +79,7 @@ export class DryReplayHarness<P> implements ConcurrencyHarness<ChargedState> {
     this.privateState = options.privateState;
     this.address = options.contractAddress ?? dummyContractAddress();
     this.coinPublicKey = options.coinPublicKey ?? DEFAULT_COIN_PUBLIC_KEY;
-    this.current = this.deploy(options.constructorArgs ?? []);
+    this.current = this.deploy(options.deployer, options.constructorArgs ?? []);
   }
 
   /** The ledger as it stands, for a spec that wants to read it. */
@@ -176,9 +176,29 @@ export class DryReplayHarness<P> implements ConcurrencyHarness<ChargedState> {
     ).state;
   }
 
-  /** Every actor shares one deployed ledger; it lives here, not on them. */
-  private deploy(constructorArgs: readonly unknown[]): ChargedState {
-    const [deployer] = Object.values(this.contracts);
+  /**
+   * Every actor shares one deployed ledger; it lives here, not on them.
+   *
+   * The constructor runs on ONE party's instance, so its witnesses are that
+   * party's. `deployerName` names which, for a module whose initializer reads
+   * one.
+   */
+  private deploy(
+    deployerName: string | undefined,
+    constructorArgs: readonly unknown[],
+  ): ChargedState {
+    if (
+      deployerName !== undefined &&
+      this.contracts[deployerName] === undefined
+    ) {
+      throw new Error(
+        `concurrency harness: unknown deployer '${deployerName}'`,
+      );
+    }
+    const deployer =
+      deployerName === undefined
+        ? Object.values(this.contracts)[0]
+        : this.contracts[deployerName];
     if (deployer === undefined) {
       throw new Error('concurrency harness: no contracts given');
     }

contracts/test-utils/concurrency/test/DryReplayHarness.test.ts

@@ -28,6 +28,23 @@ const stubContract = (): ReplayableContract<Record<string, never>> =>
     },
   }) as unknown as ReplayableContract<Record<string, never>>;
 
+/** Like {@link stubContract}, but names itself when its constructor runs. */
+const recordingContract = (
+  deployed: string[],
+  name: string,
+): ReplayableContract<Record<string, never>> =>
+  ({
+    initialState: () => {
+      deployed.push(name);
+      return {
+        currentPrivateState: {},
+        currentContractState: new ContractState(),
+        currentZswapLocalState: {},
+      };
+    },
+    impureCircuits: {},
+  }) as unknown as ReplayableContract<Record<string, never>>;
+
 const options = () => ({
   contracts: { alice: stubContract() },
   privateState: {},
@@ -94,3 +111,51 @@ describe('createConcurrencyHarness', () => {
     );
   });
 });
+
+// ---------------------------------------------------------------------------
+// Which party's instance runs the constructor
+// ---------------------------------------------------------------------------
+
+/**
+ * The constructor's witnesses are the deploying party's, so on a module with an
+ * initializer this decides whose secrets seed the shared ledger.
+ */
+describe('DryReplayHarness deployer', () => {
+  const recording = () => {
+    const deployed: string[] = [];
+    return {
+      deployed,
+      contracts: {
+        alice: recordingContract(deployed, 'alice'),
+        bob: recordingContract(deployed, 'bob'),
+      },
+      privateState: {},
+    };
+  };
+
+  it('should deploy with the first party by default', () => {
+    const { deployed, ...options } = recording();
+
+    createDryHarness(options);
+
+    expect(deployed).toStrictEqual(['alice']);
+  });
+
+  it('should deploy with the named party', () => {
+    const { deployed, ...options } = recording();
+
+    createDryHarness({ ...options, deployer: 'bob' });
+
+    expect(deployed).toStrictEqual(['bob']);
+  });
+
+  it('should reject a deployer it does not know', () => {
+    const { deployed, ...options } = recording();
+
+    expect(() => createDryHarness({ ...options, deployer: 'carol' })).toThrow(
+      "concurrency harness: unknown deployer 'carol'",
+    );
+    // Nothing deployed: the name is checked before a constructor runs.
+    expect(deployed).toStrictEqual([]);
+  });
+});

contracts/test-utils/concurrency/types.ts

@@ -109,6 +109,15 @@ export interface HarnessOptions<P> {
   readonly contracts: Readonly<Record<string, ReplayableContract<P>>>;
   /** Private state handed to every circuit context. */
   readonly privateState: P;
+  /**
+   * Which party's instance runs the constructor. Defaults to the first named.
+   *
+   * The constructor's witnesses come from this party, so on a module with an
+   * initializer that reads one, the deployed ledger is seeded with that party's
+   * secrets. Only the dry backend honours it: the live backend deploys from the
+   * wallet pool's own deployer, which is not a party at all.
+   */
+  readonly deployer?: string;
   /** Constructor arguments, if the contract takes any. */
   readonly constructorArgs?: readonly unknown[];
   readonly contractAddress?: ContractAddress;