test(mainnet-nns): reintroduction of the mainnet NNS testnet (#8170)

This PR introduces a new testnet `mainnet_nns`: A single-node NNS subnet
holding mainnet state, along with 1 API BN and 1 HTTP Gateway, for
general use-case. In a separate PR, the current `nns_recovery` testnet
will be adapted to also be able to spawn it with mainnet state. Finally,
that second PR will also introduce an NNS recovery system test that will
use mainnet state.

Most of the changes are the revert of
e38941a,
but some changes were required in `ic-replay`:
- Bumping the ingress messages' expiry, otherwise some messages would
expire if delivered in multiple batches. This was already done for
certain `SubCommand`s, so we generalize it to all of them.
- The list of trusted neurons was outdated.
- Now neurons need to be made public to be followed.
- Trusted neurons will follow the new neuron on all topics and not just
`Unspecified` to be more robust.

The code lives in its own crate in `//rs/tests/testnets/mainnet_nns/` as
a library such that one can turn any testnet or system test into a
variant that holds mainnet state, with as few modifications as possible
to their original code. For example, the setup of the IC can be done by
running the provided `setup` and making proposals to change the topology
to achieve the intended initial topology. Such proposals can be made as
easily as calling `ProposalWithMainnetState::[name_of_the_proposal]`.

Finally, it is intended to use the mainnet's version of `ic-replay` and
`ic-recovery` like
[previously](https://github.com/dfinity/ic/blob/6cd54499b0ec4f4190043f66769e54e78ffa0ccf/rs/tests/nns/ic_mainnet_nns_recovery/src/lib.rs#L206-L212),
but since I needed to modify those to create this testnet, we need to
wait for this change to reach mainnet NNS before downloading those. This
is tracked in ticket CON-1624.

---------

Co-authored-by: IDX GitHub Automation <infra+github-automation@dfinity.org>

Author: pierugo-dfinity

.github/CODEOWNERS

@@ -245,6 +245,8 @@ go.sum                    @dfinity/idx
 /rs/tests/                                              @dfinity/idx
 /rs/tests/idx/                                          @dfinity/idx
 /rs/tests/testnets/                                     @dfinity/idx
+/rs/tests/testnets/mainnet_nns/                         @dfinity/consensus
+/rs/tests/testnets/mainnet_nns.rs                       @dfinity/consensus
 /rs/tests/testnets/nns_recovery.rs                      @dfinity/consensus
 /rs/tests/driver/src/driver/simulate_network.rs         @dfinity/consensus @dfinity/idx
 /rs/tests/boundary_nodes/                               @dfinity/node

Cargo.lock

@@ -248,11 +248,8 @@ impl AdminHelper {
 
         ic_admin
             .add_positional_argument("propose-to-create-subnet")
-            .add_argument("unit-delay-millis", 2000)
-            .add_argument("subnet-handler-id", "unused")
             .add_argument("replica-version-id", replica_version)
             .add_argument("subnet-id-override", subnet_id_override)
-            .add_argument("dkg-interval-length", 12)
             .add_positional_argument("--is-halted")
             .add_argument("subnet-type", "system")
             .add_argument(
@@ -395,11 +392,8 @@ mod tests {
             "/fake/ic/admin/dir/ic-admin \
             --nns-url \"https://fake_nns_url.com:8080/\" \
             propose-to-create-subnet \
-            --unit-delay-millis 2000 \
-            --subnet-handler-id unused \
             --replica-version-id fake_replica_version \
             --subnet-id-override gpvux-2ejnk-3hgmh-cegwf-iekfc-b7rzs-hrvep-5euo2-3ywz3-k3hcb-cqe \
-            --dkg-interval-length 12 \
             --is-halted \
             --subnet-type system \
             --summary Create subnet with id gpvux-2ejnk-3hgmh-cegwf-iekfc-b7rzs-hrvep-5euo2-3ywz3-k3hcb-cqe nqpqw-cp42a-rmdsx-fpui3-ncne5-kzq6o-m67an-w25cx-zu636-lcf2v-fqe \

rs/recovery/src/admin_helper.rs

@@ -50,6 +50,7 @@ DEPENDENCIES = [
     "@crate_index//:serde_json",
     "@crate_index//:slog",
     "@crate_index//:slog-async",
+    "@crate_index//:strum",
     "@crate_index//:tempfile",
     "@crate_index//:time",
     "@crate_index//:tokio",
@@ -69,7 +70,6 @@ DEV_DEPENDENCIES = [
     "//rs/test_utilities/consensus",
     "//rs/test_utilities/types",
     "@crate_index//:pretty_assertions",
-    "@crate_index//:strum",
 ]
 
 MACRO_DEPENDENCIES = [

rs/replay/BUILD.bazel

@@ -55,6 +55,7 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 slog = { workspace = true }
 slog-async = { workspace = true }
+strum = { workspace = true }
 tempfile = { workspace = true }
 time = { workspace = true }
 tokio = { workspace = true }
@@ -73,7 +74,6 @@ ic-test-utilities-consensus = { path = "../test_utilities/consensus" }
 ic-test-utilities-types = { path = "../test_utilities/types" }
 pocket-ic = { path = "../../packages/pocket-ic" }
 pretty_assertions = { workspace = true }
-strum = { workspace = true }
 
 [[bin]]
 name = "ic-replay"

rs/replay/Cargo.toml

@@ -12,11 +12,12 @@ use ic_nervous_system_common::ledger;
 use ic_nns_common::pb::v1::NeuronId;
 use ic_nns_constants::{GOVERNANCE_CANISTER_ID, LEDGER_CANISTER_ID, REGISTRY_CANISTER_ID};
 use ic_nns_governance_api::{
-    ManageNeuronCommandRequest, ManageNeuronRequest, ManageNeuronResponse, Topic,
+    ManageNeuronCommandRequest, ManageNeuronRequest, ManageNeuronResponse, Topic, Visibility,
     manage_neuron::{
-        ClaimOrRefresh, Configure, Follow, IncreaseDissolveDelay, NeuronIdOrSubaccount,
+        self, ClaimOrRefresh, Configure, IncreaseDissolveDelay, NeuronIdOrSubaccount, SetFollowing,
         claim_or_refresh::{By, MemoAndController},
-        configure::Operation,
+        configure::{self, Operation},
+        set_following::FolloweesForTopic,
     },
     manage_neuron_response,
 };
@@ -39,8 +40,14 @@ use ic_types::{
 use icp_ledger::{AccountIdentifier, Memo, SendArgs, Tokens};
 use prost::Message;
 use std::{convert::TryFrom, str::FromStr, time::Duration};
+use strum::IntoEnumIterator;
 use time::OffsetDateTime;
 
+// This is the buffer time added to the expiry time of added ingress messages to make sure those
+// messages do not expire too early, in particular in case the original expiry time was chosen to be
+// the current time.
+const INGRESS_EXPIRY_BUFFER_SECS: u64 = 180;
+
 pub struct IngressWithPrinter {
     pub ingress: SignedIngress,
     pub print: Option<fn(Vec<u8>)>,
@@ -89,8 +96,12 @@ fn make_signed_ingress(
         .update(&Principal::from(canister_id), method)
         .with_arg(payload)
         .expire_at(
-            OffsetDateTime::from_unix_timestamp_nanos(expiry.as_nanos_since_unix_epoch().into())
-                .map_err(|err| format!("Error preparing update message: {err:?}"))?,
+            OffsetDateTime::from_unix_timestamp_nanos(
+                (expiry + Duration::from_secs(INGRESS_EXPIRY_BUFFER_SECS))
+                    .as_nanos_since_unix_epoch()
+                    .into(),
+            )
+            .map_err(|err| format!("Error preparing update message: {err:?}"))?,
         )
         .sign()
         .map_err(|err| format!("Error preparing update message: {err:?}"))?;
@@ -188,43 +199,55 @@ pub fn cmd_make_trusted_neurons_follow_neuron(
 ) -> Result<Vec<SignedIngress>, String> {
     let mut msgs = Vec::new();
 
-    let trusted_neurons: &[(&str, u64)] = &[
-        (
-            "pkjng-fnb6a-zzirr-kykal-ghbjs-ndmj2-tfoma-bzski-wtbsl-2fgbu-hae",
-            16,
-        ),
-        (
-            "ilqei-ofqjz-v7jbw-usmzf-jtdss-6mvzv-puesh-3kfga-nhr3v-zmgig-eqe",
-            15,
-        ),
-        (
-            "2q5kv-5vcol-eh2je-udy6s-j74gx-djqza-siucy-2jxyq-u5kw6-imugq-uae",
-            18,
-        ),
-        (
-            "wyzjx-3pde2-wzr4k-fblse-7hzgm-v2kkx-lcuhl-dftmv-5ywr7-gsszf-6ae",
-            1_947_868_782_075_274_250,
-        ),
-        (
-            "j2xaq-c6ph5-e4oa7-nleph-joz7b-nvv4r-if4ol-ilz7w-mzetf-jof6l-mae",
-            5_091_612_375_828_828_066,
-        ),
-        (
-            "2yjpj-uumzi-wnefi-5tum7-qt6yq-7gtxo-i4jt5-enll5-pma6q-2gild-mqe",
-            12_262_067_573_992_506_876,
-        ),
-    ];
+    // It is enough to be followed only by Neuron 27 to pass all proposals as of December 2025.
+    let trusted_neurons = [(
+        "4vnki-cqaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aaaaa-aae",
+        27,
+    )];
+
+    let user_agent = &agent_with_principal_as_sender(&cmd.neuron_controller)?;
+    let make_public_payload = Encode!(&ManageNeuronRequest {
+        id: None,
+        neuron_id_or_subaccount: Some(NeuronIdOrSubaccount::NeuronId(NeuronId {
+            id: cmd.neuron_id,
+        })),
+        command: Some(ManageNeuronCommandRequest::Configure(Configure {
+            operation: Some(configure::Operation::SetVisibility(
+                manage_neuron::SetVisibility {
+                    visibility: Some(Visibility::Public as i32),
+                }
+            ))
+        })),
+    })
+    .expect("Couldn't encode payload for manage neuron command");
+    msgs.push(
+        make_signed_ingress(
+            user_agent,
+            GOVERNANCE_CANISTER_ID,
+            "manage_neuron",
+            make_public_payload,
+            time,
+        )
+        .expect("Couldn't create message to make the neuron public"),
+    );
 
     for (principal, neuron_id) in trusted_neurons {
         let principal = PrincipalId::from_str(principal).expect("Invalid principal");
-        let follow_payload = Encode!(&ManageNeuronRequest {
+        let set_following_payload = Encode!(&ManageNeuronRequest {
             id: None,
             neuron_id_or_subaccount: Some(NeuronIdOrSubaccount::NeuronId(NeuronId {
-                id: *neuron_id,
+                id: neuron_id,
             })),
-            command: Some(ManageNeuronCommandRequest::Follow(Follow {
-                topic: Topic::Unspecified as i32,
-                followees: [NeuronId { id: cmd.neuron_id }].to_vec(),
+            // Make trusted neuron follow the test neuron on all topics
+            command: Some(ManageNeuronCommandRequest::SetFollowing(SetFollowing {
+                topic_following: Some(
+                    Topic::iter()
+                        .map(|topic| FolloweesForTopic {
+                            topic: Some(topic as i32),
+                            followees: Some(vec![NeuronId { id: cmd.neuron_id }]),
+                        })
+                        .collect()
+                ),
             })),
         })
         .expect("Couldn't encode payload for manage neuron command");
@@ -234,7 +257,7 @@ pub fn cmd_make_trusted_neurons_follow_neuron(
                 user_agent,
                 GOVERNANCE_CANISTER_ID,
                 "manage_neuron",
-                follow_payload,
+                set_following_payload,
                 time,
             )
             .expect("Couldn't create message to make trusted neurons follow test neuron"),
@@ -399,7 +422,7 @@ pub fn cmd_add_registry_content(
                     REGISTRY_CANISTER_ID,
                     mutations,
                     req.preconditions,
-                    context_time + Duration::from_secs(60),
+                    context_time,
                 ))
             } else {
                 None
@@ -476,7 +499,7 @@ pub(crate) fn bless_replica_version(
         REGISTRY_CANISTER_ID,
         vec![mutation],
         vec![],
-        context_time + Duration::from_secs(60),
+        context_time,
     )
 }
 
@@ -501,7 +524,7 @@ pub fn add_replica_version(
         REGISTRY_CANISTER_ID,
         vec![mutation],
         vec![],
-        context_time + Duration::from_secs(60),
+        context_time,
     )
 }
 
@@ -526,6 +549,6 @@ pub fn update_subnet_record(
         REGISTRY_CANISTER_ID,
         vec![mutation],
         vec![],
-        context_time + Duration::from_secs(60),
+        context_time,
     )
 }

rs/replay/src/ingress.rs

@@ -5,7 +5,7 @@ use serde::{Deserialize, Serialize};
 use slog::{Logger, info};
 use std::{
     fs,
-    net::{Ipv4Addr, Ipv6Addr},
+    net::{IpAddr, Ipv4Addr, Ipv6Addr},
     path::Path,
     time::Duration,
 };
@@ -19,7 +19,7 @@ use crate::{
         resource::AllocatedVm,
         test_env::{TestEnv, TestEnvAttribute},
         test_env_api::{
-            AcquirePlaynetCertificate, CreatePlaynetDnsRecords, HasPublicApiUrl,
+            AcquirePlaynetCertificate, CreatePlaynetDnsRecords, HasPublicApiUrl, HasTestEnv,
             HasTopologySnapshot, IcNodeSnapshot, RetrieveIpv4Addr, SshSession, get_dependency_path,
         },
         test_setup::InfraProvider,
@@ -49,6 +49,7 @@ pub struct IcGatewayVm {
 /// Represents a deployed IC HTTP Gateway VM.
 #[derive(Debug)]
 pub struct DeployedIcGatewayVm {
+    env: TestEnv,
     vm: AllocatedVm,
     https_url: Url,
 }
@@ -64,6 +65,18 @@ impl DeployedIcGatewayVm {
     }
 }
 
+impl HasTestEnv for DeployedIcGatewayVm {
+    fn test_env(&self) -> TestEnv {
+        self.env.clone()
+    }
+}
+
+impl SshSession for DeployedIcGatewayVm {
+    fn get_host_ip(&self) -> Result<IpAddr> {
+        Ok(self.get_vm().ipv6.into())
+    }
+}
+
 impl Default for IcGatewayVm {
     fn default() -> Self {
         Self::new(IC_GATEWAY_VM_NAME)
@@ -373,12 +386,13 @@ impl HasIcGatewayVm for TestEnv {
             .then(|| playnet_url.clone())
             .context("Expected a TLS URL")?;
 
-        let vm = self
+        let uvm = self
             .get_deployed_universal_vm(name)
-            .context("Failed to retrieve deployed universal VM")?
-            .get_vm()?;
+            .context("Failed to retrieve deployed universal VM")?;
+        let env = uvm.test_env();
+        let vm = uvm.get_vm()?;
 
-        Ok(DeployedIcGatewayVm { vm, https_url })
+        Ok(DeployedIcGatewayVm { env, vm, https_url })
     }
 
     fn get_deployed_ic_gateways(&self) -> Result<Vec<DeployedIcGatewayVm>> {