Module lift 

Requires-lift and consumption-record primitives.

Blocks never emit Requires and never see a StreamsRoot. Processing the messaging inherent writes a ConsumptionRecord: which streams the block touched and the Interval consumed on each. The validate_block wrapper then synthesizes the candidate’s Requires set from the records plus PoV-carried lifts (RequiresLift), one per recorded stream, binding that stream’s consumption to a current committed StreamsRoot. The relay chain sees only entries it can match.

The invariant build_requires enforces, per stream and candidate: the recorded intervals form a proven forward chain (each block continues where the previous ended, or a PoV proof shows the gap is a forward extension, see stitch), and one lift binds the chain’s endpoint to a committed root, which binds everything consumed.

The record is STF output and trusted; the lifts are PoV data and verified here. Lifts are matched to a source’s StreamId-sorted record streams by position. A mispaired lift cannot verify, because the tree_proof walk binds the record’s key (crate::streams_root::streams_root_from_proof).

Structs

ConsumptionRecord

Written per block: the streams this block touched and the interval consumed on each, grouped by source. One interval per stream, keyed so the type enforces it; per-source order is the canonical StreamId order the lifts match against. The API view of a flat, host-append-only outbox vec. Encodes as the sorted vec of pairs would.

Interval

Per stream and block: consumption entered the block at start and left it at end.

LiftsBySource

The candidate’s lifts, grouped per source: the PoV transport form. Decode enforces strictly increasing ParaIds and bounds the source count at [MAX_COMMITMENT_ENTRIES], so more sources than a RequiresSet can hold are rejected before any lift is verified. TryFrom<BTreeMap> is canonical by construction. build_requires zips these against the record’s sources by position.

MMRExtensionProof

An append-only MMR extension proof: O(log n) connecting nodes that, with a frontier’s own peaks, reconstruct a newer root. The mmr_lib gen_ancestry_proof form of the design’s connecting_nodes. Verification computes the new root; it is never declared alongside the proof. It holds node hashes only, no message payloads.

MmrInclusionProof

A single-leaf MMR inclusion proof: mmr_lib’s [MerkleProof] items (the sibling path plus the other peaks) and the node count it was generated against. Used by the event and register head read. Where MMRExtensionProof moves a frontier forward, this places one leaf under a fixed MMR. The root is derived, never declared.

RequiresLift

One lift, carried in the PoV. Matched by position to a source’s StreamId-sorted record streams; a mispaired lift cannot verify because tree_proof binds the record’s key.

Enums

LiftError

Why requires synthesis failed. All are deterministic in the records and PoV, so every validator reaches the same verdict.

ProofError

Why an MMR proof verification rejected its input. Typed so callers can tell a malformed or forged proof from an out-of-range or non-forward one.

Constants

MAX_INCLUSION_PROOF_ITEMS

Upper bound on an MmrInclusionProof’s items. A single-leaf proof needs at most the subtree height plus the other peaks, each at most 63; this constant is a ceiling no valid proof reaches. Enforced at decode, which bounds calculate_root’s work on untrusted input.

Functions

build_requires

Synthesize the candidate’s [RequiresSet] from the per-block records, in bundle order, and the PoV lifts. Sources must match exactly; a recorded source without lifts, or lifts for an unrecorded source, invalidates the candidate.

build_requires_entry

Lift one source’s streams to a single committed StreamsRoot: stitch each stream’s intervals into an endpoint, extend it to the stream’s current root, walk the tree to the StreamsRoot, and require all of the source’s streams to reach the same root. streams iterates in StreamId order; lifts matches it by position.

stitch

Stitch one stream’s intervals, in bundle order, into its endpoint frontier. advances must hold exactly one extension per gap (a start that is not the previous end’s root), in gap order. Gaps are proven forward, so within a candidate verified states cannot regress; across candidates that is the STF’s to hold.

Type Aliases

SourceStreams

One source’s streams with their intervals across a bundle, in block order. build_requires merges the per-block records into this and build_requires_entry lifts it.

TreeInclusionProof

The keyed-tree proof a lift walks from a stream root to the StreamsRoot.