Transaction Permission Table

[seanyoung]

Transaction Permission Table

Adds an on-chain, governance-managed rule table that decides whether a transaction
is allowed to run, enforced by the VM behind a new feature flag (off by default).

How it works

Each rule matches a sender (a specific account, or all accounts) and a
transaction kind — deploy (0), upgrade (1), script (2), other (3) —
and carries an allow/deny verdict. Rules are evaluated in order, first match
wins, and no match means allow, so an empty table changes nothing. Rules match
the primary transaction sender (fee-payer, multi-agent, and multisig included).

Enforcement happens at two points, because no single point can classify all
four kinds:

• Validation (validate_signed_transaction): scripts and "other"
  transactions. A denial discards with the new status code
  TRANSACTION_NOT_PERMITTED (claims reserved slot 46) — no gas charged, and
  it applies uniformly to mempool admission, execution, and simulation.
• Code-publish funnel (resolve_pending_code_publish_and_finish_user_session):
  deploy vs. upgrade, where upgrade means any target module already exists.
  This catches every publish path, including publishes from scripts, multisig,
  resource accounts, and object code deployment. A denial fails the transaction
  with the new kept status code MODULE_PUBLISHING_NOT_PERMITTED (reserved
  slot 1136), so denied publishes still pay gas and are not free compute.

A script that publishes code must pass both the script rules and the
deploy/upgrade rules.

Self-bricking guard

Hardcoded in the VM, not expressible in the table: approved governance scripts,
framework-reserved senders (0x1–0xa), the core-resources account, and
0x1::aptos_governance entry functions are never denied. A deny-all table
therefore cannot lock out the governance path needed to fix it (covered by a
dedicated e2e test).

Changes

• Framework: new 0x1::transaction_permissions module — vector<Rule>
  under @aptos_framework capped at 256 entries (the scan runs unmetered in
  validation); admin entry functions gated by the framework signer
  (insert_rule_for_sender, insert_rule_for_all, remove_rule,
  initialize_extension); get_rules / check / is_allowed views; events
  on every mutation; initialized from genesis for new chains.
• Feature flag: TRANSACTION_PERMISSIONS = 226 (fork range), wired in
  features.move, aptos_features.rs, and the release builder. Default off.
• VM: OnChainConfig mirror of the resource (BCS layout pinned by a unit
  test) and the two enforcement checks above.
• Migration: movement-migration/tx-permissions/ — core-resources scripts
  for initialize, rule edits, and feature enable/disable, plus an operator
  runbook (rollout order, listing via the view API, emergency disable, and the
  governance-proposal path once core-resources is decommissioned).

Note: the admin entry points are split into _for_sender / _for_all
variants because the SDK transaction-builder generator cannot encode
Option<address> arguments; a public insert_rule(Option<address>, ...)
remains for governance scripts.

Testing

• 13 Move unit tests in the new module (first-match ordering, wildcard
  matching, remove-shift, signer gating, bounds and cap) — all 679 framework
  Move tests pass.
• 6 e2e tests (e2e-move-tests/src/tests/transaction_permissions.rs): feature
  gating off/on, wildcard and per-sender rules, script/entry/deploy/upgrade
  denial with the expected status codes, and deny-all recovery through the
  exempt framework account.
• 4 unit tests on the Rust config mirror, including a BCS layout pin against
  the Move struct.
• All six migration scripts compile-verified against the framework.

Rollout

1. Framework upgrade carrying the new module and flag (plus node binaries with
   the enforcement code).
2. initialize_transaction_permissions.move (one-time, idempotent).
3. Populate initial rules (optional).
4. enable_transaction_permissions.move (enables flag 226 + epoch change).

disable_transaction_permissions.move is the emergency off switch; it leaves
the table intact.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}