Smart Contract Runtime Reproducible Builds

This document records how operators and auditors identify the Wasmtime contract sidecar binary that a network is about to activate. It is a provenance guide, not a replacement for release signing or deployment-specific supply-chain controls.

Pinned Runtime Profile

The current production smart-contract runtime profile is:

profile id: v1-wasmtime-26.0.1
protocol version: 1
runtime: wasm-assemblyscript-v1
sidecar protocol: 2
executor version: 0.1.0
Wasmtime version: 26.0.1
ABI version: noos-contract-abi-v2
metering model: wasmtime-native-fuel

The profile is defined in:

src/contracts/runtime-compatibility.ts
src/contracts/runtime-requirements.ts

Changing the Wasmtime version, sidecar protocol, executor version, ABI version, host import set, metering model, or limit semantics requires a new protocol-pinned profile and compatibility vectors.

Build Command

Build the sidecar from the repository root:

npm run build:contract-wasmtime-sidecar

Equivalent cargo command:

cargo build --release --manifest-path external/noos-contract-executor-wasmtime/Cargo.toml

Default binary path:

external/noos-contract-executor-wasmtime/target/release/noos-contract-executor-wasmtime

On Windows the binary name is:

noos-contract-executor-wasmtime.exe

Provenance Report

Generate the local provenance report:

npm run contracts:sidecar:provenance

For a custom binary path:

npm run contracts:sidecar:provenance -- --binary-path .\external\noos-contract-executor-wasmtime\target\release\noos-contract-executor-wasmtime.exe

The report includes:

• runtime profile id;
• protocol version;
• required sidecar protocol, executor version, Wasmtime version, ABI version, command set, host import set, and fuel metering requirement;
• build command and package script;
• expected binary path;
• binary existence, byte length, modified timestamp, and SHA-256 hash.

Operators can also query a running node:

npm run noos -- contracts runtime provenance --json

The node-side command hashes the binary visible to that node. Attach the JSON output to the launch ticket and external audit package.

Launch Gate Integration

The mainnet launch gate includes a sidecar provenance check:

npm run noos -- contracts launch-gate --profile mainnet --json

The gate passes the provenance check when the configured sidecar binary exists and the report can compute a SHA-256 hash. The gate does not prove that the binary came from a trusted build pipeline; release signing and artifact custody remain operational controls.

Audit Evidence

Attach these artifacts to the security review:

• contracts:sidecar:provenance JSON output;
• contracts runtime provenance --json output from every production node class;
• sidecar build logs;
• release tag/commit;
• runtime compatibility vector results;
• hash/signature records from the release artifact store;
• completed Smart Contract Security Review Checklist.