@rootzero/contracts 1.14.0 → 1.15.0

package/CHANGELOG.md

@@ -3,6 +3,48 @@
 Until the protocol reaches integration-stable status, minor versions may include
 breaking API changes. Breaking changes are called out explicitly.
 
+## 1.15.0
+
+### Breaking Changes
+
+- Replaced the monolithic `AccessControl` base with the composable
+  `CommanderAccess`, `AdminAccess`, `NodeAccess`, `GuardianAccess`,
+  `CallerAccess`, and `TrustAccess` capabilities. `CommandBase` now requires a
+  concrete caller policy and no longer inherits outbound `NodeCalls`.
+- Split host composition into the commander-only `CommandHost`, the advanced
+  `Host`, and the optional `Admins` and `Guardians` feature bundles. Commands
+  that use trusted outbound calls must now inherit `NodeCalls` directly and
+  compose a `TrustAccess` implementation.
+- Removed the guardian account subtype. Guardians are now ordinary user
+  accounts assigned a host-local role, so previously encoded guardian account
+  IDs are not compatible.
+- Replaced the `Labeled` and `Schema` discovery events and their dedicated admin
+  commands with typed blocks in the generic `Annotation` event and the
+  `annotate` admin command.
+- Added the origin user account to `Introduction`, changing its event signature
+  to `Introduction(uint indexed host, uint peer, bytes32 origin, uint blocknum)`.
+
+### Added
+
+- Added opt-in `Label`, `Schema`, and `Action` annotation mixins together with
+  canonical `#label`, `#schema`, `#annotation`, and `#action` codec support.
+- Added semantic action annotations to deposit, payable deposit, withdrawal,
+  burn, payout, and port settlement endpoints.
+
+### Changed
+
+- Enabled the Solidity optimizer with 200 runs and pinned release testing to
+  the Cancun EVM target, the minimum target supporting the codec's `MCOPY` use.
+- Guardians can revoke node access but remain unable to grant it; admin
+  commands continue to require both the immutable commander caller and its
+  derived admin account.
+
+### Upgrade Compatibility
+
+- Existing deployments are not upgradeable and this release does not preserve
+  storage layout or guardian mapping keys for proxy upgrades. Deploy fresh host
+  contracts when adopting this version.
+
 ## 1.14.0
 
 ### Breaking Changes

package/Core.sol

@@ -4,12 +4,15 @@ pragma solidity ^0.8.33;
 // Aggregator: re-exports the core host, runtime, access, ledger, settlement, pipeline, node-call, and validation layer.
 // Import this file to bring the full rootzero host base layer into scope.
 
-import { AccessControl } from "./core/Access.sol";
+import { Action } from "./annotations/Action.sol";
+import { Label } from "./annotations/Label.sol";
+import { Schema } from "./annotations/Schema.sol";
+import { AdminAccess, CallerAccess, CommanderAccess, GuardianAccess, NodeAccess, TrustAccess } from "./core/Access.sol";
 import { Balances, InsufficientFunds } from "./core/Balances.sol";
 import { Escrows, InsufficientEscrow } from "./core/Escrows.sol";
 import { NativeAsset, Runtime } from "./core/Runtime.sol";
-import { Host, IHostIntroduction } from "./core/Host.sol";
-import { CommandCalls, FailedCall, NodeCalls, PortCalls } from "./core/Calls.sol";
+import { Admins, CommandHost, Guardians, Host, HostIntroduction, IHostIntroduction } from "./core/Host.sol";
+import { CommandCalls, FailedCall, NodeCalls, PortCalls, RawNodeCalls } from "./core/Calls.sol";
 import { EndpointBase } from "./core/Endpoint.sol";
 import { Pipeline } from "./core/Pipeline.sol";
 import { Budget, Budgets } from "./execution/Budget.sol";

package/Endpoints.sol

@@ -23,13 +23,12 @@ import { Withdraw, WithdrawHook } from "./commands/Withdraw.sol";
 import { AdminBase } from "./commands/admin/Base.sol";
 import { AllowAssets, AllowAssetsHook } from "./commands/admin/AllowAssets.sol";
 import { Allowance, AllowanceHook } from "./commands/admin/Allowance.sol";
+import { Annotate } from "./commands/admin/Annotate.sol";
 import { Appoint } from "./commands/admin/Appoint.sol";
 import { Authorize } from "./commands/admin/Authorize.sol";
 import { DenyAssets, DenyAssetsHook } from "./commands/admin/DenyAssets.sol";
 import { Dismiss } from "./commands/admin/Dismiss.sol";
 import { ExecutePayable } from "./commands/admin/Execute.sol";
-import { Label } from "./commands/admin/Label.sol";
-import { PublishSchema } from "./commands/admin/Schemas.sol";
 import { Unauthorize } from "./commands/admin/Unauthorize.sol";
 
 // Port endpoints

package/Events.sol

@@ -4,6 +4,7 @@ pragma solidity ^0.8.33;
 // Aggregator: re-exports all event contracts.
 // Import this file to get access to every event emitter in one import.
 
+import { AnnotationEvent } from "./events/Annotation.sol";
 import { AssetEvent, AssetStatusEvent } from "./events/Asset.sol";
 import { Actions } from "./utils/Actions.sol";
 import { BalanceEvent } from "./events/Balance.sol";
@@ -16,12 +17,10 @@ import { RecoveredEvent } from "./events/Recovered.sol";
 import { EventEmitter } from "./events/Emitter.sol";
 import { GuardianEvent } from "./events/Guardian.sol";
 import { IntroductionEvent } from "./events/Introduction.sol";
-import { LabeledEvent } from "./events/Labeled.sol";
 import { LockedEvent } from "./events/Locked.sol";
 import { NodeEvent } from "./events/Node.sol";
 import { RootedEvent } from "./events/Rooted.sol";
 import { RouteEvent } from "./events/Route.sol";
-import { SchemaEvent } from "./events/Schema.sol";
 import { SpentEvent } from "./events/Spent.sol";
 import { UndeliveredEvent } from "./events/Undelivered.sol";
 import { UnlockedEvent } from "./events/Unlocked.sol";

package/README.md

@@ -27,18 +27,18 @@ npx create-rootzero@latest my-app
 npm install @rootzero/contracts
 ```
 
-A minimal host composes the base `Host` with the endpoints it needs and
-implements their policy hooks:
+A minimal commander-only host composes `CommandHost` with the endpoints it
+needs and implements their policy hooks:
 
 ```solidity
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import { Host, Balances } from "@rootzero/contracts/Core.sol";
+import { CommandHost, Balances } from "@rootzero/contracts/Core.sol";
 import { Deposit } from "@rootzero/contracts/Endpoints.sol";
 
-contract ExampleHost is Host, Balances, Deposit {
-    constructor(address rootzero) Host(rootzero) {}
+contract ExampleHost is CommandHost, Balances, Deposit {
+    constructor(address commander) CommandHost(commander) {}
 
     function deposit(bytes32 account, bytes32 asset, uint amount) internal override {
         uint balance = creditTo(account, asset, amount);
@@ -47,6 +47,29 @@ contract ExampleHost is Host, Balances, Deposit {
 }
 ```
 
+`CommandHost` requires a nonzero commander and accepts command calls only from
+that address. It has no built-in admin commands, peer registry, guardians,
+inbound introduction endpoint, generic execution command, or native-token
+receive function. Use `Host` instead when the application needs those advanced
+facilities; its commands accept the commander, the host itself, and explicitly
+authorized host callers.
+
+Both host types introduce themselves during deployment when the commander is a
+contract. That commander must implement `introduce(uint,uint)` and accept the
+call, otherwise deployment reverts. EOA commanders do not receive an
+introduction call.
+
+Host contracts are designed for fresh deployment rather than proxy upgrades.
+Releases may change inheritance storage layout, immutable configuration, and
+encoded identity formats; storage compatibility across versions is not
+supported.
+
+Commands using trusted outbound `NodeCalls` also require a `TrustAccess`
+implementation. The advanced `Host` supplies one through its composed node access, while
+`CommandHost` deliberately does not. A minimal host can explicitly compose a
+custom trust policy, or a command that intentionally targets arbitrary nodes
+can inherit `RawNodeCalls` instead.
+
 Deploy it with your own address as commander and you can call its commands
 directly. A input is a run of binary blocks — here, a single `#amount` block
 asking to deposit an asset (the encoders are a few lines each; see
@@ -164,7 +187,8 @@ Structured EVM IDs use:
 where `type` packs `[uint16 representation][uint8 category][uint8 subtype]`. A
 structured ID announces what it is (an account, an asset, a node) and which
 chain it lives on, and the payload usually embeds the underlying address. User
-accounts are chain-agnostic; admin and guardian accounts are chain-local.
+accounts are chain-agnostic, while admin accounts are chain-local. Guardians
+are normal user accounts assigned a host-specific role.
 Assets are unique IDs in the same single-word form as accounts and nodes.
 Nodes are hosts, commands, ports, queries, and guards.
 
@@ -186,13 +210,18 @@ bytes32 opaque = Ids.toKeccak(preimage);  // 0x00-prefixed opaque ID
 
 A host is one contract assembled from mixins. The base `Host` brings access
 control and the admin surface (authorize, unauthorize, appoint, dismiss,
-label, executePayable) plus the guardian `revoke` action; you add the
+annotate, executePayable) plus the guardian `revoke` action; you add the
 endpoints you need and the policy hooks they require. Keeping a ledger is
 optional: the `Balances` mixin provides one, but a host can just as well
 implement commands that hold no persistent state in the host at all —
 forwarding funds elsewhere, or operating only on the state threaded through a
 pipeline.
 
+The built-in surface is also available as two independent feature bundles:
+`Admins` provides annotate, authorize, unauthorize, and executePayable;
+`Guardians` provides appoint, dismiss, and revoke. The full `Host` composes
+both, while smaller hosts can inherit either bundle separately.
+
 Trust is explicit and minimal. Each host has an immutable **commander**
 address fixed at construction, from which its **admin account** is derived.
 Other contracts become callers only when their node ID is authorized into the

package/annotations/Action.sol

@@ -0,0 +1,17 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {AnnotationEvent} from "../events/Annotation.sol";
+import {Blocks} from "../codec/Blocks.sol";
+
+/// @title Action
+/// @notice Emits a primary semantic action annotation for an entity.
+/// @dev For a trusted emitter, the latest action replaces the earlier value.
+abstract contract Action is AnnotationEvent {
+    /// @notice Attach a primary semantic action to `entity`.
+    /// @param entity Entity receiving the action annotation.
+    /// @param value Canonical action identifier, such as a value from `Actions`.
+    function action(uint entity, uint value) internal virtual {
+        emit Annotation(entity, Blocks.action(value));
+    }
+}

package/annotations/Label.sol

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {AnnotationEvent} from "../events/Annotation.sol";
+import {Blocks} from "../codec/Blocks.sol";
+
+/// @title Label
+/// @notice Emits standard label annotation blocks for entities.
+/// @dev A label is identified by its entity and namespace. For a trusted
+/// emitter, the latest label in a namespace replaces the earlier value.
+abstract contract Label is AnnotationEvent {
+    /// @notice Attach a human-readable namespaced label to `entity`.
+    /// @param entity Entity receiving the label annotation.
+    /// @param namespace Label namespace.
+    /// @param name Human-readable name within the namespace.
+    function label(
+        uint entity,
+        bytes32 namespace,
+        string memory name
+    ) internal virtual {
+        emit Annotation(entity, Blocks.label(namespace, name));
+    }
+}

package/annotations/Schema.sol

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-3.0-only
+pragma solidity ^0.8.33;
+
+import {Blocks} from "../codec/Blocks.sol";
+import {Specs} from "../codec/Specs.sol";
+import {AnnotationEvent} from "../events/Annotation.sol";
+import {Runtime} from "../core/Runtime.sol";
+
+/// @title Schema
+/// @notice Emits standard block-schema annotations for the current host.
+/// @dev Schema annotations accumulate for distinct block keys. For a trusted
+/// emitter, the latest schema for the same block key replaces the earlier claim.
+abstract contract Schema is Runtime, AnnotationEvent {
+    /// @notice Construct and publish a context-local block specification.
+    /// @param key Context-local key value.
+    /// @param min Minimum accepted payload length.
+    /// @param max Maximum accepted payload length; zero means unbounded.
+    /// @param hint Initial per-block payload capacity.
+    /// @param body Schema DSL string describing the block payload body.
+    /// @param name Schema alias name, or zero for unnamed schemas.
+    /// @return spec The context-local block specification.
+    function schema(
+        uint32 key,
+        uint32 min,
+        uint32 max,
+        uint32 hint,
+        string memory body,
+        bytes32 name
+    ) internal returns (uint spec) {
+        spec = Specs.create(key, min, max, hint);
+        return schema(spec, body, name);
+    }
+
+    /// @notice Construct and publish an exact-size context-local block specification.
+    /// @param key Context-local key value.
+    /// @param size Exact payload length and initial per-block payload capacity.
+    /// @param body Schema DSL string describing the block payload body.
+    /// @param name Schema alias name, or zero for unnamed schemas.
+    /// @return spec The context-local block specification.
+    function schema(uint32 key, uint32 size, string memory body, bytes32 name) internal returns (uint spec) {
+        return schema(Specs.create(key, size), body, name);
+    }
+
+    /// @notice Publish an already constructed block specification for the current host.
+    /// @param spec Packed block specification.
+    /// @param body Schema DSL string describing the block payload body.
+    /// @param name Schema alias name, or zero for unnamed schemas.
+    /// @return The published block specification.
+    function schema(uint spec, string memory body, bytes32 name) internal returns (uint) {
+        emit Annotation(host, Blocks.schema(spec, body, name));
+        return spec;
+    }
+}

package/codec/Blocks.sol

@@ -754,20 +754,18 @@ library Blocks {
     /// block size and ensure the encoded payload length fits in uint32.
     /// @param dst Destination buffer.
     /// @param i Relative write position.
-    /// @param id Node identifier.
     /// @param namespace Label namespace.
     /// @param name Label text.
-    function writeLabel(bytes memory dst, uint i, uint id, bytes32 namespace, string memory name) internal pure {
-        uint len = 64 + Sizes.Header + bytes(name).length;
+    function writeLabel(bytes memory dst, uint i, bytes32 namespace, string memory name) internal pure {
+        uint len = 32 + Sizes.Header + bytes(name).length;
         uint key = uint32(Keys.Label);
         uint stringkey = uint32(Keys.String);
         assembly ("memory-safe") {
             let p := add(add(dst, 0x20), i)
             mstore(p, or(shl(224, key), shl(192, len)))
-            mstore(add(p, 0x08), id)
-            mstore(add(p, 0x28), namespace)
+            mstore(add(p, 0x08), namespace)
 
-            let q := add(p, 0x48)
+            let q := add(p, 0x28)
             let namelen := mload(name)
             mstore(q, or(shl(224, stringkey), shl(192, namelen)))
             mcopy(add(q, 0x08), add(name, 0x20), namelen)
@@ -1345,6 +1343,23 @@ library Blocks {
 
     // One fixed word
 
+    /// @notice Decode one ANNOTATION block and its nested block stream.
+    /// @param abs Absolute block position.
+    /// @return entity Decoded entity identifier.
+    /// @return stream Decoded annotation block stream.
+    /// @return end Absolute position after the block.
+    function unpackAnnotation(
+        uint abs
+    ) internal pure returns (uint entity, bytes calldata stream, uint end) {
+        uint limit;
+        (abs, limit) = expect(abs, Specs.Annotation);
+        assembly ("memory-safe") {
+            entity := calldataload(abs)
+        }
+        (stream, end) = unpackBytes(abs + 32);
+        if (end != limit) revert InvalidBlock();
+    }
+
     /// @notice Decode one CONTEXT block and all nested byte blocks.
     /// @param abs Absolute block position.
     /// @return account Decoded account identifier.
@@ -1444,19 +1459,17 @@ library Blocks {
 
     /// @notice Decode one LABEL block and its nested name.
     /// @param abs Absolute block position.
-    /// @return id Decoded node identifier.
     /// @return namespace Decoded label namespace.
     /// @return name Decoded label text.
     /// @return end Absolute position after the block.
-    function unpackLabel(uint abs) internal pure returns (uint id, bytes32 namespace, string memory name, uint end) {
+    function unpackLabel(uint abs) internal pure returns (bytes32 namespace, string memory name, uint end) {
         uint limit;
         (abs, limit) = expect(abs, Specs.Label);
         assembly ("memory-safe") {
-            id := calldataload(abs)
-            namespace := calldataload(add(abs, 0x20))
+            namespace := calldataload(abs)
         }
         bytes calldata value;
-        (value, end) = unpackString(abs + 64);
+        (value, end) = unpackString(abs + 32);
         if (end != limit) revert InvalidBlock();
         name = string(value);
     }
@@ -1532,6 +1545,30 @@ library Blocks {
         return create(Keys.String, bytes(value));
     }
 
+    /// @notice Encode a LABEL block.
+    /// @param namespace Label namespace.
+    /// @param name Label text.
+    /// @return Encoded LABEL block bytes.
+    function label(bytes32 namespace, string memory name) internal pure returns (bytes memory) {
+        return create(Keys.Label, bytes.concat(namespace, text(name)));
+    }
+
+    /// @notice Encode an ACTION annotation block.
+    /// @param value Canonical semantic action identifier.
+    /// @return Encoded ACTION block bytes.
+    function action(uint value) internal pure returns (bytes memory) {
+        return create(Keys.Action, bytes.concat(bytes32(value)));
+    }
+
+    /// @notice Encode a SCHEMA block.
+    /// @param spec Block specification.
+    /// @param body Schema body.
+    /// @param name Schema name.
+    /// @return Encoded SCHEMA block bytes.
+    function schema(uint spec, string memory body, bytes32 name) internal pure returns (bytes memory) {
+        return create(Keys.Schema, bytes.concat(bytes32(spec), text(body), name));
+    }
+
     /// @notice Encode a BALANCE block.
     /// @param asset Asset identifier.
     /// @param amount Token amount.

package/codec/Decoders.sol

@@ -365,6 +365,19 @@ library Decoders {
         cur.state = cur.state.seekAbs(end);
     }
 
+    /// @notice Decode and consume one ANNOTATION block.
+    /// @param cur Cursor advanced past the block.
+    /// @return entity Decoded entity identifier.
+    /// @return data Decoded annotation block stream.
+    function unpackAnnotation(
+        Cur memory cur
+    ) internal pure returns (uint entity, bytes calldata data) {
+        uint abs = cur.state.absolute();
+        uint end;
+        (entity, data, end) = Blocks.unpackAnnotation(abs);
+        cur.state = cur.state.seekAbs(end);
+    }
+
     /// @notice Decode and consume one CONTEXT block.
     /// @param cur Cursor advanced past the block.
     /// @return account Decoded account identifier.
@@ -395,13 +408,12 @@ library Decoders {
 
     /// @notice Decode and consume one LABEL block.
     /// @param cur Cursor advanced past the block.
-    /// @return id Decoded node identifier.
     /// @return namespace Decoded label namespace.
     /// @return name Decoded label text.
-    function unpackLabel(Cur memory cur) internal pure returns (uint id, bytes32 namespace, string memory name) {
+    function unpackLabel(Cur memory cur) internal pure returns (bytes32 namespace, string memory name) {
         uint abs = cur.state.absolute();
         uint end;
-        (id, namespace, name, end) = Blocks.unpackLabel(abs);
+        (namespace, name, end) = Blocks.unpackLabel(abs);
         cur.state = cur.state.seekAbs(end);
     }
 

package/codec/Keys.sol

@@ -5,7 +5,7 @@ pragma solidity ^0.8.33;
 /// @notice Standard block type selectors for the rootzero block stream protocol.
 /// Standard keys use the first 4 bytes of `keccak256("#name")` by convention.
 /// Custom block keys only need to be unique in the context where they are used;
-/// hosts may publish custom key meanings with the `Schema` event.
+/// hosts may publish custom key meanings with `#schema` annotations.
 library Keys {
     /// @dev Empty / unset key.
     bytes4 constant Empty = bytes4(0);
@@ -49,8 +49,12 @@ library Keys {
     bytes4 constant Asset = bytes4(keccak256("#asset"));
     /// @dev Node identifier - (uint id)
     bytes4 constant Node = bytes4(keccak256("#node"));
-    /// @dev Mutable node label - (uint id, bytes32 namespace, #string as name)
+    /// @dev Entity label annotation - (bytes32 namespace, #string as name)
     bytes4 constant Label = bytes4(keccak256("#label"));
+    /// @dev Entity annotations - (uint entity, #bytes as data)
+    bytes4 constant Annotation = bytes4(keccak256("#annotation"));
+    /// @dev Primary semantic action annotation - (uint action)
+    bytes4 constant Action = bytes4(keccak256("#action"));
     /// @dev Block schema publication - (bytes4 key, #string as body, bytes32 name)
     bytes4 constant Schema = bytes4(keccak256("#schema"));
 

package/codec/Schema.sol

@@ -36,7 +36,7 @@ pragma solidity ^0.8.33;
 // - generic lists use the stable key derived from `#list`
 // - standard keys are derived from block aliases, e.g. bytes4(keccak256("#amount"))
 // - custom keys are opaque bytes4 tags and only need to be unique in their
-//   active context; use `Schema(host, spec, schema, name)` to publish their meaning
+//   active context; use a `#schema` annotation to publish their meaning
 // - see `docs/Schema.md` for the full working spec
 //
 // Pipeline state:
@@ -101,7 +101,12 @@ library Schemas {
     string constant Dispatch = "{ uint portal, uint resources, #bytes as payload }";
     string constant Context = "{ bytes32 account, #bytes as state, #bytes as input }";
     string constant Recover = "{ uint handler, uint resources, bytes32 key, #bytes as witness }";
-    string constant Label = "{ uint id, bytes32 namespace, #string as name }";
+    string constant Annotation = "{ uint entity, #bytes as data }";
+
+    // Annotation payloads
+
+    string constant Action = "{ uint action }";
+    string constant Label = "{ bytes32 namespace, #string as name }";
     string constant Schema = "{ uint spec, #string as body, bytes32 name }";
 }
 

package/codec/Specs.sol

@@ -54,6 +54,7 @@ library Specs {
     uint private constant Exact96 = 96 * SizeFields;
     uint private constant Exact128 = 128 * SizeFields;
     uint private constant UnboundedHint128 = uint(128) << 136;
+    uint private constant UnboundedMin40Hint256 = (uint(40) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin72Hint256 = (uint(72) << 192) | (uint(256) << 136);
     uint private constant UnboundedMin48Hint512 = (uint(48) << 192) | (uint(512) << 136);
     uint private constant UnboundedMin104Hint256 = (uint(104) << 192) | (uint(256) << 136);
@@ -79,7 +80,9 @@ library Specs {
     uint constant Call = uint(bytes32(Keys.Call)) | UnboundedMin72Hint256;
     uint constant Asset = uint(bytes32(Keys.Asset)) | Exact32;
     uint constant Node = uint(bytes32(Keys.Node)) | Exact32;
-    uint constant Label = uint(bytes32(Keys.Label)) | UnboundedMin72Hint256;
+    uint constant Label = uint(bytes32(Keys.Label)) | UnboundedMin40Hint256;
+    uint constant Annotation = uint(bytes32(Keys.Annotation)) | UnboundedMin40Hint256;
+    uint constant Action = uint(bytes32(Keys.Action)) | Exact32;
     uint constant Schema = uint(bytes32(Keys.Schema)) | UnboundedMin72Hint256;
 
     uint constant Status = uint(bytes32(Keys.Status)) | Exact32;
@@ -96,12 +99,31 @@ library Specs {
     /// @param hint Initial per-block payload capacity.
     /// @return spec Packed block specification.
     function create(bytes4 blockkey, uint32 min, uint32 max, uint32 hint) internal pure returns (uint spec) {
-        spec |= uint(uint32(blockkey)) << 224;
+        return create(uint32(blockkey), min, max, hint);
+    }
+
+    /// @notice Construct a block specification from its numeric key and encoded fields.
+    /// @param blockkey Numeric block key.
+    /// @param min Minimum accepted payload length.
+    /// @param max Maximum accepted payload length; zero means unbounded.
+    /// @param hint Initial per-block payload capacity.
+    /// @return spec Packed block specification.
+    function create(uint32 blockkey, uint32 min, uint32 max, uint32 hint) internal pure returns (uint spec) {
+        spec |= uint(blockkey) << 224;
         spec |= uint(min) << 192;
         spec |= uint(max) << 160;
         spec |= uint(max24(hint)) << 136;
     }
 
+    /// @notice Construct an exact-size block specification from a numeric key.
+    /// @dev Sets the minimum, maximum, and allocation hint to `size`.
+    /// @param blockkey Numeric block key.
+    /// @param size Exact payload length and initial per-block payload capacity.
+    /// @return spec Packed exact-size block specification.
+    function create(uint32 blockkey, uint32 size) internal pure returns (uint spec) {
+        return create(blockkey, size, size, size);
+    }
+
     /// @notice Decode the block key and accepted payload range from `spec`.
     /// @param spec Packed block specification.
     /// @return blockkey Encoded block key.

package/codec/Writers.sol

@@ -448,18 +448,16 @@ library Writers {
 
     /// @notice Append a LABEL block.
     /// @param writer Destination writer.
-    /// @param id Node identifier to encode.
     /// @param namespace Label namespace to encode.
     /// @param name Label text to encode.
     function appendLabel(
         Writer memory writer,
-        uint id,
         bytes32 namespace,
         string memory name
     ) internal pure {
-        uint size = Sizes.B64 + Sizes.Header + bytes(name).length;
+        uint size = Sizes.B32 + Sizes.Header + bytes(name).length;
         uint i = reserve(writer, size);
-        Blocks.writeLabel(writer.dst, i, id, namespace, name);
+        Blocks.writeLabel(writer.dst, i, namespace, name);
     }
 
     /// @notice Append a SCHEMA block.

package/commands/Base.sol

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-3.0-only
 pragma solidity ^0.8.33;
 
-import {NodeCalls} from "../core/Calls.sol";
+import {CallerAccess} from "../core/Access.sol";
 import {EndpointBase} from "../core/Endpoint.sol";
 import {Blocks} from "../codec/Blocks.sol";
 import {Specs} from "../codec/Specs.sol";
@@ -19,17 +19,10 @@ using Executions for Execution;
 /// @title CommandBase
 /// @notice Abstract base for all rootzero command contracts.
 /// Provides access control modifiers and command endpoint metadata helpers.
-abstract contract CommandBase is NodeCalls, EndpointBase, ReceivedEvent {
+abstract contract CommandBase is CallerAccess, EndpointBase, ReceivedEvent {
     /// @dev Thrown when `onlyActive` finds that `deadline` has already passed.
     error Expired();
 
-    /// @dev Restrict execution to the commander using the host's admin account.
-    modifier onlyAdmin(bytes32 account) {
-        if (account != admin) revert AccessDenied();
-        enforceCommander(msg.sender);
-        _;
-    }
-
     /// @dev Restrict execution to trusted callers.
     modifier onlyCommand() {
         enforceCaller(msg.sender);
@@ -43,26 +36,6 @@ abstract contract CommandBase is NodeCalls, EndpointBase, ReceivedEvent {
         _;
     }
 
-    /// @notice Close a command execution and refund unspent value to `account`.
-    /// @param exec Command execution to close.
-    /// @param account Account that should receive any unspent value.
-    /// @return output Final encoded output block stream.
-    /// @return transactions Final encoded transaction block stream.
-    function close(
-        Execution memory exec,
-        bytes32 account
-    ) internal returns (bytes memory output, bytes memory transactions) {
-        if (exec.budget == 0 && Cursors.initial(exec.writers)) return ("", "");
-
-        output = close(exec);
-        uint amount = exec.refundValue(account, nativeAsset);
-        if (amount != 0) {
-            emit Received(account, nativeAsset, amount, Actions.Refund, 0);
-        }
-
-        transactions = exec.finishTransactions();
-    }
-
     /// @notice Publish command metadata and a default label.
     /// @param name Command entrypoint name and default label. It must exactly
     /// match the Solidity command function name used by the canonical ABI.
@@ -83,11 +56,22 @@ abstract contract CommandBase is NodeCalls, EndpointBase, ReceivedEvent {
         bool funded,
         bool admin
     ) internal returns (uint id, uint descriptor) {
-        id = Nodes.toCommand(Selectors.command(name), address(this));
-        uint8 flags;
+        uint8 flags = 0;
         if (funded) flags |= Descriptors.Funded;
         if (admin) flags |= Descriptors.Admin;
-        descriptor = endpoint(id, name, state, input, output, transactions, flags);
+        descriptor = Descriptors.create(state, input, output, transactions, flags);
+        return command(name, descriptor);
+    }
+
+    /// @notice Publish an already constructed command descriptor and default label.
+    /// @param name Command entrypoint name and default label. It must exactly
+    /// match the Solidity command function name used by the canonical ABI.
+    /// @param descriptor Packed command endpoint descriptor.
+    /// @return id Command node ID.
+    /// @return published Published endpoint descriptor.
+    function command(string memory name, uint descriptor) internal returns (uint id, uint published) {
+        id = Nodes.toCommand(Selectors.command(name), address(this));
+        published = endpoint(id, name, descriptor);
     }
 
     /// @notice Open a command state stream and return the expected output block count.
@@ -117,4 +101,24 @@ abstract contract CommandBase is NodeCalls, EndpointBase, ReceivedEvent {
     ) internal view returns (Execution memory exec) {
         return Executions.open(state, input, descriptor, batches);
     }
+
+    /// @notice Close a command execution and refund unspent value to `account`.
+    /// @param exec Command execution to close.
+    /// @param account Account that should receive any unspent value.
+    /// @return output Final encoded output block stream.
+    /// @return transactions Final encoded transaction block stream.
+    function close(
+        Execution memory exec,
+        bytes32 account
+    ) internal returns (bytes memory output, bytes memory transactions) {
+        if (exec.budget == 0 && Cursors.initial(exec.writers)) return ("", "");
+
+        output = close(exec);
+        uint amount = exec.refundValue(account, nativeAsset);
+        if (amount != 0) {
+            emit Received(account, nativeAsset, amount, Actions.Refund, 0);
+        }
+
+        transactions = exec.finishTransactions();
+    }
 }