Add EVM support

.github/workflows/build&release.yml

@@ -72,6 +72,17 @@ jobs:
             echo "GHOEOF"
           } >> "$GITHUB_OUTPUT"
 
+      - name: Check deploy intent
+        id: deploy_check
+        run: |
+          TAG_MSG="${{ steps.tag_info.outputs.tag_message }}"
+          if echo "$TAG_MSG" | grep -qi '\[no-deploy\]'; then
+            echo "draft=true" >> $GITHUB_OUTPUT
+            echo "⚠️  [no-deploy] detected — release will be created as DRAFT"
+          else
+            echo "draft=false" >> $GITHUB_OUTPUT
+          fi
+
       - name: Setup Go and dependencies
         uses: ./.github/actions/setup-env
         with:
@@ -205,6 +216,7 @@ jobs:
         if: success() && steps.rel_check.outputs.exists != 'true'
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}
+          draft: ${{ steps.deploy_check.outputs.draft == 'true' }}
           files: |
             release/${{ steps.vars.outputs.binary_name }}.tar.gz
             release/${{ steps.vars.outputs.binary_name }}
@@ -216,6 +228,7 @@ jobs:
         if: success() && steps.rel_check.outputs.exists == 'true'
         with:
           tag_name: ${{ steps.tag_info.outputs.tag_name }}
+          draft: ${{ steps.deploy_check.outputs.draft == 'true' }}
           files: |
             release/${{ steps.vars.outputs.binary_name }}.tar.gz
             release/${{ steps.vars.outputs.binary_name }}

.gitignore

@@ -26,6 +26,7 @@ tests/system/supernode-lep6-data*/
 .lep6-wip-backup/
 tests/system/data
 tests/system/1
+supernode/__debug*
 # env file
 .env
 /data
@@ -36,5 +37,6 @@ analysis
 .claude/
 .codex/
 AGENTS.md
+.claude/settings.json
 CLAUDE.md
 .bridge-version

CHANGELOG.md

@@ -1,6 +1,44 @@
 # Changelog
 
 
+## Upcoming EVM Release
+
+This release adds end-to-end support for Lumera's EVM-enabled chain (Cosmos EVM integration, `evmigration` module, ERC-20 policy, unified migration proofs):
+
+- **EVM account migration on startup.** SuperNode and SDK can now migrate a legacy `secp256k1` account to a new `eth_secp256k1` (EVM) account on the chain. The flow:
+  - Detects whether the configured legacy key still exists in the keyring and whether on-chain migration has already happened (`QueryMigrationRecord`).
+  - Submits `MsgClaimLegacyAccount` for plain accounts and `MsgMigrateValidator` when the account is a validator operator, using a unified `MigrationProof` (single-key or multisig) for both the legacy and new sides.
+  - Estimates fees via `QueryMigrationEstimate`, signs with both legacy and new keys (CLI sig format), and broadcasts the migration tx.
+  - On success, deletes the legacy key from the keyring and rewrites the operator's SuperNode config to use the new EVM address.
+  - **Refuses automatic migration** when the legacy account is a multisig — these must be migrated manually because they require an offline multi-party signing ceremony. See `docs/evm-migration.md` for the full operator playbook.
+- **Keyring extensions** (`pkg/keyring`):
+  - Supports both `secp256k1` (legacy) and `eth_secp256k1` (EVM) key algorithms in the same keyring backend (Cosmos SDK + cosmos/evm codec registration).
+  - New helpers to look up keys by address, regardless of algorithm, and delete legacy keys after a successful migration.
+- **Protobuf / codec wiring** for cosmos/evm and `evmigration` types so that messages round-trip correctly through the SuperNode and SDK transaction pipelines.
+- **P2P bootstrap reacts to migrations.** After a successful EVM migration, the local DHT:
+  - Clears the `KeyExchanger` credential cache so subsequent handshakes use the post-migration identity for HKDF key derivation.
+  - Releases all pooled gRPC connections (they were authenticated with the old identity and would fail re-use).
+  - Signals the bootstrap refresher via `NotifyEVMMigration` to immediately re-sync peers from the chain and switch to an **accelerated 1-minute refresh interval for 5 cycles** so peer-address changes propagate quickly. Reverts to the normal 10-minute cadence afterwards.
+- **SDK ICA / signing updates** (`sdk/task`):
+  - Cascade signing path now produces signatures compatible with EVM-style accounts (eth_secp256k1) in addition to the legacy ADR-36 path.
+  - `spendable_balance` checks correctly handle EVM-derived addresses.
+- **Module dependencies bumped to EVM-enabled Lumera** (`v1.20.0-rc3`), which provides the `evmigration` module, `erc20policy`, Cosmos EVM integration, and forked `go-ethereum` (`cosmos/go-ethereum v1.16.2-cosmos-1`). Aligned across `supernode`, `sn-manager`, `cmd/sncli`, and `tests/system` go.mod files; Go toolchain bumped to **1.26.2**.
+- **Integration tests** for the full EVM migration flow (`tests/integration/evmigration`): legacy → EVM migration of plain accounts, validators, and rejection of multisig accounts; verifies on-chain state, keyring state, and config rewrites.
+- **Build & release** workflow updated to produce artifacts against the EVM-enabled toolchain.
+- **Operator documentation:** `docs/evm-migration.md` describes the migration model, supported account types, the automatic startup flow, manual multisig procedure, and recovery scenarios.
+
+### Reliability & concurrency hardening (post-merge)
+
+- **Storage-truth recovery restored.** The `v1.20.0-rc3` bump pulls in lumera audit fixes (#139/#143) so **POSTPONED** SuperNodes remain storage-truth target candidates and can recover to ACTIVE via clean PASS proofs. `rc2` had excluded them, which broke the postpone→recover lifecycle (and the LEP-6 enforcement/heal e2e tests).
+- **Concurrent cascade uploads hardened** (real-binary contention path):
+  - **Finalize simulation** now retries a transient `account sequence mismatch` by re-fetching account info, bounded by the same cap as the broadcast path. Previously the simulate pre-check failed the whole upload on a stale-sequence false negative even though the subsequent broadcast (which already retries) would have succeeded — surfaced when one SuperNode finalizes several actions at once.
+  - **Artefact storage** retries transient P2P conditions — `no eligible store peers` (routing not yet converged), `0.00% successful` (store RPCs failing under load), and momentary `zero peers` — with bounded backoff, forcing the idempotent symbol-directory upsert on retries (symbol/data key stores are already idempotent by key). Deterministic errors are not retried.
+- **SQLite P2P store shutdown fixed.** `Store.Close` now broadcasts the stop signal to *all* background goroutines (DB worker, WAL checkpoint worker, replication writer) and waits for them to exit before closing the database; the checkpoint worker is interruptible and bails out of its retry loop on shutdown. Fixes a goroutine leak and a WAL-write-after-close race that intermittently corrupted teardown (and flaked unit tests).
+- **EVM-chain startup gate is crash-loop safe.** `requireEVMChain` distinguishes a transient module-version query failure (chain momentarily unreachable / gRPC blip → retried with backoff) from a definitive "EVM module absent" answer (fail fast), so a brief network blip at boot no longer hard-crashes the daemon.
+- **Stricter EVM key validation.** The migration pre-flight gate now explicitly type-asserts `*ethsecp256k1.PubKey` instead of treating "anything that is not legacy `secp256k1`" as EVM, so multisig/offline/ledger or other non-EVM key types are rejected up front rather than failing later during signing/proof validation.
+
+(Will be finalized on release.)
+
 ## Upcoming Release: v2.4.9
 
 This release focuses on stability, performance, and operational clarity across the cascade pipeline and SuperNode operation:

cmd/sncli/go.mod

@@ -1,50 +1,58 @@
 module github.com/LumeraProtocol/supernode/v2/cmd/sncli
 
-go 1.25.5
+go 1.26.2
 
 replace (
 	github.com/LumeraProtocol/supernode/v2 => ../..
 	github.com/envoyproxy/protoc-gen-validate => github.com/bufbuild/protoc-gen-validate v1.3.0
+	// cosmos/evm requires a forked go-ethereum with custom EVM operation methods
+	github.com/ethereum/go-ethereum => github.com/cosmos/go-ethereum v1.16.2-cosmos-1
 	github.com/lyft/protoc-gen-validate => github.com/envoyproxy/protoc-gen-validate v1.3.0
 	nhooyr.io/websocket => github.com/coder/websocket v1.8.7
 )
 
 require (
-	github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c
-	github.com/LumeraProtocol/lumera v1.11.0-rc
+	github.com/BurntSushi/toml v1.6.0
+	github.com/LumeraProtocol/lumera v1.20.0-rc3
 	github.com/LumeraProtocol/supernode/v2 v2.0.0-00010101000000-000000000000
-	github.com/cosmos/cosmos-sdk v0.53.5
-	github.com/spf13/cobra v1.10.1
-	google.golang.org/grpc v1.77.0
+	github.com/cosmos/cosmos-sdk v0.53.6
+	github.com/spf13/cobra v1.10.2
+	google.golang.org/grpc v1.80.0
 	google.golang.org/protobuf v1.36.11
 )
 
 require (
 	cosmossdk.io/api v0.9.2 // indirect
-	cosmossdk.io/collections v1.3.1 // indirect
+	cosmossdk.io/collections v1.4.0 // indirect
 	cosmossdk.io/core v0.11.3 // indirect
 	cosmossdk.io/depinject v1.2.1 // indirect
-	cosmossdk.io/errors v1.0.2 // indirect
+	cosmossdk.io/errors v1.1.0 // indirect
 	cosmossdk.io/log v1.6.1 // indirect
 	cosmossdk.io/math v1.5.3 // indirect
 	cosmossdk.io/schema v1.1.0 // indirect
 	cosmossdk.io/store v1.1.2 // indirect
+	cosmossdk.io/x/feegrant v0.2.0 // indirect
 	cosmossdk.io/x/tx v0.14.0 // indirect
 	cosmossdk.io/x/upgrade v0.2.0 // indirect
-	filippo.io/edwards25519 v1.1.0 // indirect
+	filippo.io/edwards25519 v1.1.1 // indirect
 	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
 	github.com/99designs/keyring v1.2.2 // indirect
 	github.com/DataDog/datadog-go v4.8.3+incompatible // indirect
 	github.com/DataDog/zstd v1.5.7 // indirect
-	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/benbjohnson/clock v1.3.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.2.0 // indirect
+	github.com/bits-and-blooms/bitset v1.24.3 // indirect
+	github.com/btcsuite/btcd v0.24.2 // indirect
+	github.com/btcsuite/btcd/btcec/v2 v2.3.5 // indirect
+	github.com/btcsuite/btcd/btcutil v1.1.6 // indirect
+	github.com/btcsuite/btcd/chaincfg/chainhash v1.1.0 // indirect
 	github.com/btcsuite/btcutil v1.0.3-0.20201208143702-a53e38424cce // indirect
 	github.com/bytedance/gopkg v0.1.3 // indirect
-	github.com/bytedance/sonic v1.14.2 // indirect
-	github.com/bytedance/sonic/loader v0.4.0 // indirect
+	github.com/bytedance/sonic v1.15.0 // indirect
+	github.com/bytedance/sonic/loader v0.5.0 // indirect
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
@@ -54,18 +62,22 @@ require (
 	github.com/cockroachdb/pebble v1.1.5 // indirect
 	github.com/cockroachdb/redact v1.1.6 // indirect
 	github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
-	github.com/cometbft/cometbft v0.38.20 // indirect
+	github.com/cometbft/cometbft v0.38.21 // indirect
 	github.com/cometbft/cometbft-db v0.14.1 // indirect
+	github.com/consensys/gnark-crypto v0.18.0 // indirect
 	github.com/cosmos/btcutil v1.0.5 // indirect
 	github.com/cosmos/cosmos-db v1.1.3 // indirect
 	github.com/cosmos/cosmos-proto v1.0.0-beta.5 // indirect
+	github.com/cosmos/evm v0.6.0 // indirect
 	github.com/cosmos/go-bip39 v1.0.0 // indirect
 	github.com/cosmos/gogogateway v1.2.0 // indirect
 	github.com/cosmos/gogoproto v1.7.2 // indirect
 	github.com/cosmos/iavl v1.2.6 // indirect
 	github.com/cosmos/ibc-go/v10 v10.5.0 // indirect
 	github.com/cosmos/ics23/go v0.11.0 // indirect
-	github.com/cosmos/ledger-cosmos-go v0.16.0 // indirect
+	github.com/cosmos/ledger-cosmos-go v1.0.0 // indirect
+	github.com/crate-crypto/go-eth-kzg v1.3.0 // indirect
+	github.com/crate-crypto/go-ipa v0.0.0-20240724233137-53bbb0ceb27a // indirect
 	github.com/danieljoos/wincred v1.2.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
@@ -76,21 +88,24 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
 	github.com/emicklei/dot v1.6.2 // indirect
+	github.com/ethereum/c-kzg-4844/v2 v2.1.0 // indirect
+	github.com/ethereum/go-ethereum v1.17.0 // indirect
+	github.com/ethereum/go-verkle v0.2.2 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/getsentry/sentry-go v0.35.0 // indirect
+	github.com/getsentry/sentry-go v0.42.0 // indirect
 	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-kit/kit v0.13.0 // indirect
 	github.com/go-kit/log v0.2.1 // indirect
 	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
 	github.com/gogo/googleapis v1.4.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/golang/snappy v0.0.5-0.20231225225746-43d5d4cd4e0e // indirect
+	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
 	github.com/google/flatbuffers v24.3.25+incompatible // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
@@ -111,18 +126,19 @@ require (
 	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
+	github.com/holiman/uint256 v1.3.2 // indirect
 	github.com/huandu/skiplist v1.2.1 // indirect
 	github.com/iancoleman/strcase v0.3.0 // indirect
 	github.com/improbable-eng/grpc-web v0.15.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmhodges/levigo v1.0.0 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/compress v1.18.4 // indirect
 	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.9 // indirect
+	github.com/lib/pq v1.11.2 // indirect
 	github.com/linxGnu/grocksdb v1.9.8 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -141,8 +157,8 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_golang v1.23.2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.66.1 // indirect
-	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/prometheus/common v0.67.5 // indirect
+	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/cors v1.11.1 // indirect
@@ -156,10 +172,16 @@ require (
 	github.com/spf13/viper v1.21.0 // indirect
 	github.com/stretchr/testify v1.11.1 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/supranational/blst v0.3.14 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
 	github.com/tendermint/go-amino v0.16.0 // indirect
-	github.com/tidwall/btree v1.7.0 // indirect
+	github.com/tidwall/btree v1.8.1 // indirect
+	github.com/tidwall/gjson v1.18.0 // indirect
+	github.com/tidwall/match v1.1.1 // indirect
+	github.com/tidwall/pretty v1.2.1 // indirect
+	github.com/tidwall/sjson v1.2.5 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/tyler-smith/go-bip39 v1.1.0 // indirect
 	github.com/zondax/golem v0.27.0 // indirect
 	github.com/zondax/hid v0.9.2 // indirect
 	github.com/zondax/ledger-go v1.0.1 // indirect
@@ -169,19 +191,19 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/ratelimit v0.3.1 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/arch v0.17.0 // indirect
-	golang.org/x/crypto v0.47.0 // indirect
+	golang.org/x/crypto v0.48.0 // indirect
 	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b // indirect
-	golang.org/x/net v0.48.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/term v0.39.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/net v0.51.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.41.0 // indirect
+	golang.org/x/term v0.40.0 // indirect
+	golang.org/x/text v0.34.0 // indirect
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	gotest.tools/v3 v3.5.2 // indirect
 	lukechampine.com/blake3 v1.4.1 // indirect