Hegel Fuzz

.github/workflows/build_push_workload.yml

@@ -44,7 +44,7 @@ jobs:
     - name: Build and push workload
       uses: docker/build-push-action@v5
       with:
-        context: ./workload
+        context: .
         file: ./workload/Dockerfile
         push: true
         tags: ${{ steps.meta-workload.outputs.tags }}, ${{ env.GITHUB_REF_NAME }}

.github/workflows/pr_antithesis_test.yml

@@ -206,7 +206,7 @@ jobs:
       - name: Build and push workload
         uses: docker/build-push-action@v5
         with:
-          context: ./workload
+          context: .
           file: ./workload/Dockerfile
           push: true
           tags: ${{ steps.meta.outputs.tags }}

Makefile

@@ -2,11 +2,12 @@
 # ==========================================
 -include versions.env
 
-# Git tags/commits for each image
-drand_tag = $(shell git ls-remote --tags https://github.com/drand/drand.git | grep -E 'refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$$' | tail -n1 | sed 's/.*refs\/tags\///')
-lotus_tag = $(shell git ls-remote https://github.com/filecoin-project/lotus.git HEAD | cut -f1)
-curio_tag = $(shell git ls-remote https://github.com/filecoin-project/curio.git refs/heads/pdpv0 | cut -f1)
-forest_commit = $(shell git ls-remote https://github.com/ChainSafe/forest.git HEAD | cut -f1)
+# Pinned versions — read from each Dockerfile so builds are reproducible.
+# To update: change the pinned value in the Dockerfile, then run `make check-versions`.
+drand_tag    = $(shell grep -oP 'ARG GIT_BRANCH="\K[^"]+' drand/Dockerfile)
+lotus_tag    = $(shell grep -oP 'ARG REF="\K[^"]+' lotus/Dockerfile)
+curio_tag    = $(shell grep -oP 'ARG GIT_COMMIT="\K[^"]+' curio/Dockerfile)
+forest_commit = $(shell grep -oP 'ARG GIT_COMMIT="\K[^"]+' forest/Dockerfile)
 
 # Docker configuration
 builder = docker
@@ -16,8 +17,8 @@ BUILD_CMD = docker build
 TARGET_ARCH ?= $(shell uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
 DOCKER_PLATFORM = linux/$(TARGET_ARCH)
 
-# Build mode: "local" uses local images, "remote" uses Antithesis registry
-BUILD_MODE ?= local
+# Build mode: empty for local images, "remote" uses Antithesis registry
+BUILD_MODE ?=
 
 # ==========================================
 # Show version info
@@ -52,6 +53,36 @@ show-arch:
 	@echo "Current target architecture: $(TARGET_ARCH)"
 	@echo "Docker platform: $(DOCKER_PLATFORM)"
 
+# ==========================================
+# Version drift check
+# ==========================================
+.PHONY: check-versions
+check-versions:
+	@echo "Checking pinned versions against upstream..."
+	@UP_DRAND=$$(git ls-remote --tags https://github.com/drand/drand.git \
+		| grep -E 'refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$$' | tail -n1 | sed 's/.*refs\/tags\///'); \
+	UP_LOTUS=$$(git ls-remote https://github.com/filecoin-project/lotus.git HEAD | cut -f1); \
+	UP_CURIO=$$(git ls-remote https://github.com/filecoin-project/curio.git refs/heads/pdpv0 | cut -f1); \
+	UP_FOREST=$$(git ls-remote https://github.com/ChainSafe/forest.git HEAD | cut -f1); \
+	WARN=0; \
+	if [ "$$UP_DRAND" != "$(drand_tag)" ]; then \
+		echo "  WARNING: drand pinned=$(drand_tag)  upstream=$$UP_DRAND"; WARN=1; \
+	else echo "  drand: up to date ($(drand_tag))"; fi; \
+	if [ "$$UP_LOTUS" != "$(lotus_tag)" ]; then \
+		echo "  WARNING: lotus pinned=$(lotus_tag)  upstream=$$UP_LOTUS"; WARN=1; \
+	else echo "  lotus: up to date ($(lotus_tag))"; fi; \
+	if [ "$$UP_CURIO" != "$(curio_tag)" ]; then \
+		echo "  WARNING: curio pinned=$(curio_tag)  upstream=$$UP_CURIO"; WARN=1; \
+	else echo "  curio: up to date ($(curio_tag))"; fi; \
+	if [ "$$UP_FOREST" != "$(forest_commit)" ]; then \
+		echo "  WARNING: forest pinned=$(forest_commit)  upstream=$$UP_FOREST"; WARN=1; \
+	else echo "  forest: up to date ($(forest_commit))"; fi; \
+	if [ "$$WARN" -eq 1 ]; then \
+		echo ""; \
+		echo "Some pinned versions are behind upstream."; \
+		echo "To update: change the pinned value in the relevant Dockerfile, re-test patches, and commit."; \
+	fi
+
 # ==========================================
 # Build individual images
 # ==========================================
@@ -65,7 +96,7 @@ build-drand:
 build-lotus:
 	@echo "Building lotus for $(TARGET_ARCH)..."
 	@echo "  Git commit: $(lotus_tag)"
-	$(BUILD_CMD) --build-arg=GIT_BRANCH=$(lotus_tag) -t lotus:latest -f lotus/Dockerfile lotus
+	$(BUILD_CMD) --build-arg=REF=$(lotus_tag) -t lotus:latest -f lotus/Dockerfile lotus
 
 .PHONY: build-forest
 build-forest:
@@ -78,7 +109,7 @@ build-curio:
 	@echo "Building curio for $(TARGET_ARCH)..."
 	@echo "  Git commit: $(curio_tag)"
 	@echo "  Build mode: $(BUILD_MODE)"
-	$(BUILD_CMD) --build-arg=GIT_BRANCH=$(curio_tag) --build-arg=LOTUS_TAG=$(lotus_tag) --build-arg=BUILD_MODE=$(BUILD_MODE) -t curio:latest -f curio/Dockerfile curio
+	$(BUILD_CMD) --build-arg=GIT_COMMIT=$(curio_tag) --build-arg=LOTUS_TAG=latest --build-arg=BUILD_MODE=$(BUILD_MODE) -t curio:latest -f curio/Dockerfile curio
 
 .PHONY: build-workload
 build-workload:
@@ -195,6 +226,7 @@ help:
 	@echo ""
 	@echo "Info:"
 	@echo "  make show-versions    Show all image version tags"
+	@echo "  make check-versions   Check pinned versions against upstream"
 	@echo "  make show-arch        Show target architecture"
 	@echo ""
 	@echo "Current arch: $(TARGET_ARCH)"

curio/Dockerfile

@@ -1,7 +1,7 @@
 # STAGE 1: Use the pre-built lotus image as a source for its binaries
 # This avoids rebuilding lotus and uses the same version as the rest of your environment.
-# BUILD_MODE: "local" uses local lotus image, "remote" uses Antithesis registry
-ARG BUILD_MODE=local
+# BUILD_MODE: empty (default) uses local lotus image, any non-empty value uses Antithesis registry
+ARG BUILD_MODE=
 ARG LOTUS_TAG=latest
 ARG ANTITHESIS_REGISTRY=us-central1-docker.pkg.dev/molten-verve-216720/filecoin-repository
 FROM ${BUILD_MODE:+${ANTITHESIS_REGISTRY}/}lotus:${LOTUS_TAG} as lotus-builder
@@ -47,7 +47,8 @@ RUN set -eux; \
 RUN git clone https://github.com/filecoin-project/curio.git /opt/curio
 WORKDIR /opt/curio
 
-RUN git checkout pdpv0
+ARG GIT_COMMIT="2bfe87dfe72d6face2c5e11d4b714bc636778ff7"
+RUN git checkout ${GIT_COMMIT}
 RUN git config --global user.email "richard.yao@antithesis.com"
 RUN git config --global user.name "Richard"
 COPY ./increase-cpu-avail-antithesis.patch ./increase-cpu-avail-antithesis.patch

docker-compose.yaml

@@ -225,6 +225,27 @@ services:
       - ./data/forest0:/root/devgen/forest0
       - ./data/curio:/root/devgen/curio
 
+  hegel-workload:
+    <<: [ *filecoin_service ]
+    image: workload:latest
+    container_name: hegel-workload
+    entrypoint: ["/opt/antithesis/entrypoint/entrypoint-hegel.sh"]
+    environment:
+      - STRESS_NODES=lotus0,lotus1,lotus2,lotus3
+      - STRESS_RPC_PORT=1234
+      - STRESS_KEYSTORE_PATH=/shared/configs/stress_keystore.json
+      - STRESS_WAIT_HEIGHT=10
+      - RUST_LOG=info
+    volumes:
+      - ./shared/configs:/shared/configs
+      - ./shared:/shared
+      - ./data/lotus0:/root/devgen/lotus0
+      - ./data/lotus1:/root/devgen/lotus1
+      - ./data/lotus2:/root/devgen/lotus2
+      - ./data/lotus3:/root/devgen/lotus3
+      - ./data/forest0:/root/devgen/forest0
+      - ./data/curio:/root/devgen/curio
+
   lotus-miner0:
     <<: [ *filecoin_service, *needs_lotus0_healthy ]
     image: lotus:${LOTUS_MINER_0_TAG:-${LOTUS_TAG:-latest}}

drand/Dockerfile

@@ -3,7 +3,7 @@ FROM docker.io/golang:1.25.1
 RUN apt-get update && \
    apt-get install -y ca-certificates build-essential clang ocl-icd-opencl-dev ocl-icd-libopencl1 jq libhwloc-dev git
 
-ARG GIT_BRANCH="v2.1.3"
+ARG GIT_BRANCH="v2.1.5"
 
 RUN git clone --depth=1 --branch="${GIT_BRANCH}" https://github.com/drand/drand /drand
 

forest/Dockerfile

@@ -1,7 +1,7 @@
 FROM docker.io/rust:1.81-bookworm AS builder
 
 # Pin forest to a specific branch
-ARG GIT_COMMIT=""
+ARG GIT_COMMIT="d0dc5b83e776a9df14371dd4e26179526b8696b2"
 ARG LOCAL_BUILD=1
 # Step 1: Install dependencies
 RUN apt-get update && \
@@ -21,12 +21,7 @@ RUN git clone https://github.com/chainsafe/forest /forest
 
 WORKDIR /forest
 
-# Use provided commit or default to latest main
-RUN if [ -n "${GIT_COMMIT}" ]; then \
-        git checkout ${GIT_COMMIT}; \
-    else \
-        echo "No GIT_COMMIT specified, using latest main"; \
-    fi
+RUN git checkout ${GIT_COMMIT}
 
 COPY ./patches/forest.patch ./forest.patch
 RUN git apply forest.patch
@@ -37,27 +32,35 @@ WORKDIR /forest
 COPY ./forest_config.toml.tpl .
 COPY libvoidstar.so /usr/local/lib/libvoidstar.so
 ENV LD_LIBRARY_PATH="/usr/local/lib:${LD_LIBRARY_PATH}" 
-# Build forest binaries + Rust instrumentation on main forest binary for code coverage
+# Build forest binaries + optional Rust instrumentation on main forest binary for code coverage
+# LOCAL_BUILD=1 (default): skip instrumentation for fast local builds
+# LOCAL_BUILD=0 (CI): enable Antithesis instrumentation with libvoidstar
 RUN cargo build --release --bin forest-cli && \
     cargo build --release --bin forest-tool && \
     cargo build --release --bin forest-wallet && \
     cp /forest/target/release/forest-cli /usr/local/cargo/bin/forest-cli && \
     cp /forest/target/release/forest-tool /usr/local/cargo/bin/forest-tool && \
     cp /forest/target/release/forest-wallet /usr/local/cargo/bin/forest-wallet && \
-    # Setup Antithesis instrumentation
-    export LD_LIBRARY_PATH=/usr/local/lib && \
-    export RUSTFLAGS="-Ccodegen-units=1 -Cpasses=sancov-module -Cllvm-args=-sanitizer-coverage-level=3 \
-    -Cllvm-args=-sanitizer-coverage-trace-pc-guard -Clink-arg=-Wl,-z,undefs \
-    -Clink-args=-Wl,--build-id -L/usr/local/lib -lvoidstar" && \
-    cd /forest && \
-    sed -i 's/strip = true/strip = false/' Cargo.toml && \
-    cargo build --release --bin forest && \
-    cp /forest/target/release/forest /usr/local/cargo/bin/forest && \
-    cd / && \
-    mkdir -p /symbols && \
-    ln -s /usr/local/cargo/bin/forest /symbols/forest && \
-    ldd /symbols/forest | grep "libvoidstar" && \
-    nm /symbols/forest | grep "sanitizer_cov_trace_pc_guard";
+    if [ "$LOCAL_BUILD" = "0" ]; then \
+      echo "Building forest with Antithesis instrumentation..." && \
+      export LD_LIBRARY_PATH=/usr/local/lib && \
+      export RUSTFLAGS="-Ccodegen-units=1 -Cpasses=sancov-module -Cllvm-args=-sanitizer-coverage-level=3 \
+      -Cllvm-args=-sanitizer-coverage-trace-pc-guard -Clink-arg=-Wl,-z,undefs \
+      -Clink-args=-Wl,--build-id -L/usr/local/lib -lvoidstar" && \
+      sed -i 's/strip = true/strip = false/' Cargo.toml && \
+      cargo build --release --bin forest && \
+      cp /forest/target/release/forest /usr/local/cargo/bin/forest && \
+      mkdir -p /symbols && \
+      ln -s /usr/local/cargo/bin/forest /symbols/forest && \
+      ldd /symbols/forest | grep "libvoidstar" && \
+      nm /symbols/forest | grep "sanitizer_cov_trace_pc_guard"; \
+    else \
+      echo "Building forest without instrumentation (local build)..." && \
+      cargo build --release --bin forest && \
+      cp /forest/target/release/forest /usr/local/cargo/bin/forest && \
+      mkdir -p /symbols && \
+      ln -s /usr/local/cargo/bin/forest /symbols/forest; \
+    fi
 
 WORKDIR /forest
 

forest/patches/forest.patch

@@ -33,7 +33,7 @@ index 32e34106c..dc8e01860 100644
  	OpportunisticGraftScoreThreshold = 3.5
  )
 diff --git a/src/libp2p/gossip_params.rs b/src/libp2p/gossip_params.rs
-index 26298991e..5873e3cd1 100644
+index 38822868c..55aa20dd6 100644
 --- a/src/libp2p/gossip_params.rs
 +++ b/src/libp2p/gossip_params.rs
 @@ -45,7 +45,7 @@ fn build_msg_topic_config() -> TopicScoreParams {
@@ -84,21 +84,15 @@ index 26298991e..5873e3cd1 100644
          opportunistic_graft_threshold: 3.5,
      }
 diff --git a/src/rpc/methods/chain.rs b/src/rpc/methods/chain.rs
-index 35b9dfa..5fade36 100644
+index 620ab0086..8177746ba 100644
 --- a/src/rpc/methods/chain.rs
 +++ b/src/rpc/methods/chain.rs
-@@ -1076,12 +1076,12 @@ impl ChainGetTipSetV2 {
-         // Latest F3 finalized tipset is older than EC finality, falling back to EC finality
--        if head.epoch() > f3_finalized_head.epoch() + ctx.chain_config().policy.chain_finality {
-+        if head.epoch() > f3_finalized_head.epoch() + 20 {
-             Self::get_ec_finalized_tipset(ctx)
-         } else {
-             Ok(f3_finalized_head)
-         }
-     }
-
+@@ -1082,7 +1082,7 @@ impl ChainGetTipSetV2 {
+
      pub fn get_ec_finalized_tipset(ctx: &Ctx<impl Blockstore>) -> anyhow::Result<Tipset> {
          let head = ctx.chain_store().heaviest_tipset();
 -        let ec_finality_epoch = (head.epoch() - ctx.chain_config().policy.chain_finality).max(0);
 +        let ec_finality_epoch = (head.epoch() - 20).max(0);
          Ok(ctx.chain_index().tipset_by_height(
+             ec_finality_epoch,
+             head,

hegel-workload/.gitignore

@@ -0,0 +1,2 @@
+.hegel/
+target/