From 1618fb4c61b8324e8437278e0647191d2a0b0600 Mon Sep 17 00:00:00 2001
From: Chris Hibbert <hibbert@agoric.com>
Date: Thu, 22 Jun 2023 09:29:33 -0700
Subject: [PATCH] test: a test framework for verifying upgrade of Zoe and ZCF

It starts from the currently installed version of Zoe and ZCF. First
it verifies that reallocation via staging and via the helper work and
that the version internal to ZCF is not present. It then upgrades Zoe
and ZCF as necessary to introduce the new behavior. Finally, it
re-runs the initial verification to show that the ZCF internal version
works.

This currently fails on the first step since it runs in a state in
which the new Zoe/ZCF code has already replaced the old.

Variants of this test will run on master without this PR to verify
that upgrading to the new Zoe/ZCF works, and in
deployment/upgrade-test to show that the upgrade to the new zoe & zcf
will succeed.
---
 packages/vats/package.json                    |   1 +
 packages/vats/scripts/replace-zoe.js          |  19 ++
 packages/vats/src/proposals/zcf-proposal.js   |  44 ++++
 packages/vats/test/bootstrapTests/drivers.js  |  81 +++++++
 packages/vats/test/bootstrapTests/supports.js | 204 +++++++++++++++++-
 .../test/bootstrapTests/test-vats-restart.js  | 152 +------------
 .../test/bootstrapTests/test-zcf-upgrade.js   | 104 +++++++++
 packages/vats/test/bootstrapTests/zcfProbe.js | 132 ++++++++++++
 8 files changed, 584 insertions(+), 153 deletions(-)
 create mode 100644 packages/vats/scripts/replace-zoe.js
 create mode 100644 packages/vats/src/proposals/zcf-proposal.js
 create mode 100644 packages/vats/test/bootstrapTests/test-zcf-upgrade.js
 create mode 100644 packages/vats/test/bootstrapTests/zcfProbe.js

diff --git a/packages/vats/package.json b/packages/vats/package.json
index ad128928217..7ff6ac4fa9f 100644
--- a/packages/vats/package.json
+++ b/packages/vats/package.json
@@ -14,6 +14,7 @@
     "build:boot-viz-sim": "node src/authorityViz.js --sim-chain >docs/boot-sim.dot && dot -Tsvg docs/boot-sim.dot >docs/boot-sim.dot.svg",
     "build:boot-viz-sim-gov": "node src/authorityViz.js --sim-chain --gov >docs/boot-sim-gov.dot && dot -Tsvg docs/boot-sim-gov.dot >docs/boot-sim-gov.dot.svg",
     "build:restart-vats-proposal": "agoric run scripts/restart-vats.js",
+    "build:zcf-proposal": "agoric run scripts/replace-zoe.js",
     "prepack": "tsc --build jsconfig.build.json",
     "postpack": "git clean -f '*.d.ts*'",
     "test": "ava",
diff --git a/packages/vats/scripts/replace-zoe.js b/packages/vats/scripts/replace-zoe.js
new file mode 100644
index 00000000000..00fc1878bc6
--- /dev/null
+++ b/packages/vats/scripts/replace-zoe.js
@@ -0,0 +1,19 @@
+import { makeHelpers } from '@agoric/deploy-script-support';
+
+/** @type {import('@agoric/deploy-script-support/src/externalTypes.js').ProposalBuilder} */
+export const defaultProposalBuilder = async ({ publishRef, install }) =>
+  harden({
+    sourceSpec: '../src/proposals/zcf-proposal.js',
+    getManifestCall: [
+      'getManifestForZoe',
+      {
+        zoeRef: publishRef(install('../src/vat-zoe.js')),
+        zcfRef: publishRef(install('../../zoe/src/contractFacet/vatRoot.js')),
+      },
+    ],
+  });
+
+export default async (homeP, endowments) => {
+  const { writeCoreProposal } = await makeHelpers(homeP, endowments);
+  await writeCoreProposal('replace-zcf', defaultProposalBuilder);
+};
diff --git a/packages/vats/src/proposals/zcf-proposal.js b/packages/vats/src/proposals/zcf-proposal.js
new file mode 100644
index 00000000000..3a245895ac7
--- /dev/null
+++ b/packages/vats/src/proposals/zcf-proposal.js
@@ -0,0 +1,44 @@
+import { E } from '@endo/far';
+
+/**
+ * @param { BootstrapPowers & {
+ *   consume: {
+ *     vatAdminSvc: VatAdminSve,
+ *     vatStore: MapStore<string, CreateVatResults>,
+ *   }
+ * }} powers
+ *
+ * @param {object} options
+ * @param {{zoeRef: VatSourceRef, zcfRef: VatSourceRef}} options.options
+ */
+export const upgradeZcf = async (
+  { consume: { vatAdminSvc, vatStore } },
+  options,
+) => {
+  const { zoeRef, zcfRef } = options.options;
+
+  const zoeBundleCap = await E(vatAdminSvc).getBundleCap(zoeRef.bundleID);
+
+  const { adminNode, root: zoeRoot } = await E(vatStore).get('zoe');
+
+  await E(adminNode).upgrade(zoeBundleCap, {});
+
+  const zoeConfigFacet = await E(zoeRoot).getZoeConfigFacet();
+  await E(zoeConfigFacet).updateZcfBundleId(zcfRef.bundleID);
+};
+
+export const getManifestForZoe = (_powers, { zoeRef, zcfRef }) => ({
+  manifest: {
+    [upgradeZcf.name]: {
+      consume: {
+        vatAdminSvc: 'vatAdminSvc',
+        vatStore: 'vatStore',
+      },
+      produce: {},
+    },
+  },
+  options: {
+    zoeRef,
+    zcfRef,
+  },
+});
diff --git a/packages/vats/test/bootstrapTests/drivers.js b/packages/vats/test/bootstrapTests/drivers.js
index aa2824d8519..0c54a0d422b 100644
--- a/packages/vats/test/bootstrapTests/drivers.js
+++ b/packages/vats/test/bootstrapTests/drivers.js
@@ -4,6 +4,7 @@ import { Offers } from '@agoric/inter-protocol/src/clientSupport.js';
 import { SECONDS_PER_MINUTE } from '@agoric/inter-protocol/src/proposals/econ-behaviors.js';
 import { unmarshalFromVstorage } from '@agoric/internal/src/lib-chainStorage.js';
 import { slotToRemotable } from '@agoric/internal/src/storage-test-utils.js';
+
 import { boardSlottingMarshaller } from '../../tools/board-utils.js';
 
 /**
@@ -339,3 +340,83 @@ export const makeGovernanceDriver = async (
     },
   };
 };
+
+/**
+ * @param {import('./supports.js').SwingsetTestKit} testKit
+ */
+export const makeZoeDriver = async testKit => {
+  const { EV } = testKit.runUtils;
+  const zoe = await EV.vat('bootstrap').consumeItem('zoe');
+  let creatorFacet;
+  let adminFacet;
+  let brand;
+  const sub = (a, v) => {
+    return { brand: a.brand, value: a.value - v };
+  };
+
+  return {
+    async instantiateProbeContract(probeContractBundle) {
+      const installation = await EV(zoe).install(probeContractBundle);
+      const startResults = await EV(zoe).startInstance(installation);
+      ({ creatorFacet, adminFacet } = startResults);
+
+      const issuers = await EV(zoe).getIssuers(startResults.instance);
+      const brands = await EV(zoe).getBrands(startResults.instance);
+      brand = brands.Ducats;
+      return { creatorFacet, issuer: issuers.Ducats, brand };
+    },
+    async upgradeProbe(probeContractBundle) {
+      const fabricateBundleId = bundle => {
+        return `b1-${bundle.endoZipBase64Sha512}`;
+      };
+
+      await EV(adminFacet).upgradeContract(
+        fabricateBundleId(probeContractBundle),
+      );
+    },
+
+    verifyRealloc() {
+      const alloc = EV(creatorFacet).getAllocation();
+      return alloc;
+    },
+    async probeReallocation(value, payment) {
+      const stagingInv = await EV(creatorFacet).makeProbeStagingInvitation();
+
+      const stagingSeat = await EV(zoe).offer(
+        stagingInv,
+        { give: { Ducats: value } },
+        { Ducats: payment },
+      );
+      const helperPayments = await EV(stagingSeat).getPayouts();
+
+      const helperInv = await EV(creatorFacet).makeProbeHelperInvitation();
+      const helperSeat = await EV(zoe).offer(
+        helperInv,
+        { give: { Ducats: sub(value, 1n) } },
+        { Ducats: helperPayments.Ducats },
+      );
+      const internalPayments = await EV(helperSeat).getPayouts();
+
+      const internalInv = await EV(creatorFacet).makeProbeInternalInvitation();
+      const internalSeat = await EV(zoe).offer(
+        internalInv,
+        { give: { Ducats: sub(value, 2n) } },
+        { Ducats: internalPayments.Ducats },
+      );
+      const leftoverPayments = await EV(internalSeat).getPayouts();
+
+      return {
+        stagingResult: await EV(stagingSeat).getOfferResult(),
+        helperResult: await EV(helperSeat).getOfferResult(),
+        internalResult: await EV(internalSeat).getOfferResult(),
+        leftoverPayments,
+      };
+    },
+    async faucet() {
+      const faucetInv = await EV(creatorFacet).makeFaucetInvitation();
+      const seat = await EV(zoe).offer(faucetInv);
+
+      return EV(seat).getPayout('Ducats');
+    },
+  };
+};
diff --git a/packages/vats/test/bootstrapTests/supports.js b/packages/vats/test/bootstrapTests/supports.js
index 2ad85a28a13..093d1592473 100644
--- a/packages/vats/test/bootstrapTests/supports.js
+++ b/packages/vats/test/bootstrapTests/supports.js
@@ -1,5 +1,8 @@
 // @ts-check
-import { promises as fs } from 'fs';
+
+/* global process */
+
+import { promises as fsAmbientPromises } from 'fs';
 import { resolve as importMetaResolve } from 'import-meta-resolve';
 import { basename } from 'path';
 import { inspect } from 'util';
@@ -16,14 +19,22 @@ import { loadSwingsetConfigFile } from '@agoric/swingset-vat';
 import { E } from '@endo/eventual-send';
 import { makeQueue } from '@endo/stream';
 import { TimeMath } from '@agoric/time';
+import { eventLoopIteration } from '@agoric/internal/src/testing-utils.js';
+
+import * as processAmbient from 'child_process';
 import {
   boardSlottingMarshaller,
+  makeAgoricNamesRemotesFromFakeStorage,
   slotToBoardRemote,
 } from '../../tools/board-utils.js';
+import { makeWalletFactoryDriver, makeZoeDriver } from './drivers.js';
 
 // to retain for ESlint, used by typedef
 E;
 
+// main/production config doesn't have initialPrice, upon which 'open vaults' depends
+const PLATFORM_CONFIG = '@agoric/vats/decentral-itest-vaults-config.json';
+
 const sink = () => {};
 
 const trace = makeTracer('BSTSupport', false);
@@ -191,7 +202,7 @@ export const getNodeTestVaultsConfig = async (
   config.defaultManagerType = 'local';
   // speed up build (60s down to 10s in testing)
   config.bundleCachePath = bundleDir;
-  await fs.mkdir(bundleDir, { recursive: true });
+  await fsAmbientPromises.mkdir(bundleDir, { recursive: true });
 
   if (config.coreProposals) {
     // remove Pegasus because it relies on IBC to Golang that isn't running
@@ -201,7 +212,11 @@ export const getNodeTestVaultsConfig = async (
   }
 
   const testConfigPath = `${bundleDir}/${basename(specifier)}`;
-  await fs.writeFile(testConfigPath, JSON.stringify(config), 'utf-8');
+  await fsAmbientPromises.writeFile(
+    testConfigPath,
+    JSON.stringify(config),
+    'utf-8',
+  );
   return testConfigPath;
 };
 
@@ -384,4 +399,187 @@ export const makeSwingsetTestKit = async (
     timer,
   };
 };
+
+/**
+ * @param {object} powers
+ * @param {Pick<typeof import('node:child_process'), 'execFileSync' >} powers.childProcess
+ * @param {typeof import('node:fs/promises')} powers.fs
+ */
+const makeProposalExtractor = ({ childProcess, fs }) => {
+  const getPkgPath = (pkg, fileName = '') =>
+    new URL(`../../../${pkg}/${fileName}`, import.meta.url).pathname;
+
+  const runPackageScript = async (pkg, name, env) => {
+    console.warn(pkg, 'running package script:', name);
+    const pkgPath = getPkgPath(pkg);
+    return childProcess.execFileSync('yarn', ['run', name], {
+      cwd: pkgPath,
+      env,
+    });
+  };
+
+  const loadJSON = async filePath =>
+    harden(JSON.parse(await fs.readFile(filePath, 'utf8')));
+
+  // XXX parses the output to find the files but could write them to a path that can be traversed
+  /** @param {string} txt */
+  const parseProposalParts = txt => {
+    const evals = [
+      ...txt.matchAll(/swingset-core-eval (?<permit>\S+) (?<script>\S+)/g),
+    ].map(m => {
+      if (!m.groups) throw Fail`Invalid proposal output ${m[0]}`;
+      const { permit, script } = m.groups;
+      return { permit, script };
+    });
+    evals.length ||
+      Fail`No swingset-core-eval found in proposal output: ${txt}`;
+
+    const bundles = [
+      ...txt.matchAll(/swingset install-bundle @([^\n]+)/gm),
+    ].map(([, bundle]) => bundle);
+    bundles.length || Fail`No bundles found in proposal output: ${txt}`;
+
+    return { evals, bundles };
+  };
+
+  /**
+   * @param {object} options
+   * @param {string} options.package
+   * @param {string} options.packageScriptName
+   * @param {Record<string, string>} [options.env]
+   */
+  const buildAndExtract = async ({
+    package: packageName,
+    packageScriptName,
+    env = {},
+  }) => {
+    const scriptEnv = Object.assign(Object.create(process.env), env);
+    // XXX use '@agoric/inter-protocol'?
+    const out = await runPackageScript(
+      packageName,
+      packageScriptName,
+      scriptEnv,
+    );
+    const built = parseProposalParts(out.toString());
+
+    const loadAndRmPkgFile = async fileName => {
+      const filePath = getPkgPath(packageName, fileName);
+      const content = await fs.readFile(filePath, 'utf8');
+      await fs.rm(filePath);
+      return content;
+    };
+
+    const evalsP = Promise.all(
+      built.evals.map(async ({ permit, script }) => {
+        const [permits, code] = await Promise.all([
+          loadAndRmPkgFile(permit),
+          loadAndRmPkgFile(script),
+        ]);
+        return { json_permits: permits, js_code: code };
+      }),
+    );
+
+    const bundlesP = Promise.all(
+      built.bundles.map(
+        async bundleFile =>
+          /** @type {Promise<EndoZipBase64Bundle>} */ (loadJSON(bundleFile)),
+      ),
+    );
+    return Promise.all([evalsP, bundlesP]).then(([evals, bundles]) => ({
+      evals,
+      bundles,
+    }));
+  };
+  return buildAndExtract;
+};
+
 /** @typedef {Awaited<ReturnType<typeof makeSwingsetTestKit>>} SwingsetTestKit */
+
+export const makeTestContext = async t => {
+  console.time('DefaultTestContext');
+  /** @type {SwingsetTestKit} */
+  const swingsetTestKit = await makeSwingsetTestKit(t, 'bundles/vaults', {
+    configSpecifier: PLATFORM_CONFIG,
+  });
+
+  const { runUtils, storage } = swingsetTestKit;
+  console.timeLog('DefaultTestContext', 'swingsetTestKit');
+  const { EV } = runUtils;
+
+  // Wait for ATOM to make it into agoricNames
+  await EV.vat('bootstrap').consumeItem('vaultFactoryKit');
+  console.timeLog('DefaultTestContext', 'vaultFactoryKit');
+
+  await eventLoopIteration();
+
+  // has to be late enough for agoricNames data to have been published
+  const agoricNamesRemotes = makeAgoricNamesRemotesFromFakeStorage(
+    swingsetTestKit.storage,
+  );
+  agoricNamesRemotes.brand.ATOM || Fail`ATOM brand not yet defined`;
+  console.timeLog('DefaultTestContext', 'agoricNamesRemotes');
+
+  const walletFactoryDriver = await makeWalletFactoryDriver(
+    runUtils,
+    storage,
+    agoricNamesRemotes,
+  );
+  console.timeLog('DefaultTestContext', 'walletFactoryDriver');
+
+  console.timeEnd('DefaultTestContext');
+
+  const buildProposal = makeProposalExtractor({
+    childProcess: processAmbient,
+    fs: fsAmbientPromises,
+  });
+
+  return {
+    ...swingsetTestKit,
+    agoricNamesRemotes,
+    walletFactoryDriver,
+    buildProposal,
+  };
+};
+
+export const makeZoeTestContext = async t => {
+  console.time('DefaultTestContext');
+  /** @type {SwingsetTestKit} */
+  const swingsetTestKit = await makeSwingsetTestKit(t, 'bundles/zoe', {
+    configSpecifier: '@agoric/vats/decentral-demo-config.json',
+  });
+
+  const { controller, runUtils } = swingsetTestKit;
+  console.timeLog('DefaultTestContext', 'swingsetTestKit');
+  const { EV } = runUtils;
+
+  await eventLoopIteration();
+
+  // We don't need vaults, but this gets the brand, which is checked somewhere
+  // Wait for ATOM to make it into agoricNames
+  await EV.vat('bootstrap').consumeItem('vaultFactoryKit');
+  console.timeLog('DefaultTestContext', 'vaultFactoryKit');
+
+  // has to be late enough for agoricNames data to have been published
+  const agoricNamesRemotes = makeAgoricNamesRemotesFromFakeStorage(
+    swingsetTestKit.storage,
+  );
+  console.timeLog('DefaultTestContext', 'agoricNamesRemotes');
+
+  const zoeDriver = await makeZoeDriver(swingsetTestKit);
+  console.timeLog('DefaultTestContext', 'walletFactoryDriver');
+
+  console.timeEnd('DefaultTestContext');
+
+  const buildProposal = makeProposalExtractor({
+    childProcess: processAmbient,
+    fs: fsAmbientPromises,
+  });
+
+  return {
+    ...swingsetTestKit,
+    controller,
+    agoricNamesRemotes,
+    zoeDriver,
+    buildProposal,
+  };
+};
diff --git a/packages/vats/test/bootstrapTests/test-vats-restart.js b/packages/vats/test/bootstrapTests/test-vats-restart.js
index 9131b396c0c..7516cbe891e 100644
--- a/packages/vats/test/bootstrapTests/test-vats-restart.js
+++ b/packages/vats/test/bootstrapTests/test-vats-restart.js
@@ -1,168 +1,20 @@
 // @ts-check
-/* global process */
+
 /**
  * @file Bootstrap test of restarting (almost) all vats
  */
 import { test as anyTest } from '@agoric/zoe/tools/prepare-test-env-ava.js';
-
-import * as processAmbient from 'child_process';
-import * as fsAmbient from 'fs';
-import { Fail } from '@agoric/assert';
-import { eventLoopIteration } from '@agoric/internal/src/testing-utils.js';
 import { Offers } from '@agoric/inter-protocol/src/clientSupport.js';
-import { makeAgoricNamesRemotesFromFakeStorage } from '../../tools/board-utils.js';
-import { makeSwingsetTestKit } from './supports.js';
-import { makeWalletFactoryDriver } from './drivers.js';
+import { makeTestContext } from './supports.js';
 
 /**
  * @type {import('ava').TestFn<Awaited<ReturnType<typeof makeTestContext>>>}
  */
 const test = anyTest;
 
-// main/production config doesn't have initialPrice, upon which 'open vaults' depends
-const PLATFORM_CONFIG = '@agoric/vats/decentral-itest-vaults-config.json';
-
 // presently all these tests use one collateral manager
 const collateralBrandKey = 'ATOM';
 
-/**
- * @param {object} powers
- * @param {Pick<typeof import('node:child_process'), 'execFileSync' >} powers.childProcess
- * @param {typeof import('node:fs/promises')} powers.fs
- */
-const makeProposalExtractor = ({ childProcess, fs }) => {
-  const getPkgPath = (pkg, fileName = '') =>
-    new URL(`../../../${pkg}/${fileName}`, import.meta.url).pathname;
-
-  const runPackageScript = async (pkg, name, env) => {
-    console.warn(pkg, 'running package script:', name);
-    const pkgPath = getPkgPath(pkg);
-    return childProcess.execFileSync('yarn', ['run', name], {
-      cwd: pkgPath,
-      env,
-    });
-  };
-
-  const loadJSON = async filePath =>
-    harden(JSON.parse(await fs.readFile(filePath, 'utf8')));
-
-  // XXX parses the output to find the files but could write them to a path that can be traversed
-  /** @param {string} txt */
-  const parseProposalParts = txt => {
-    const evals = [
-      ...txt.matchAll(/swingset-core-eval (?<permit>\S+) (?<script>\S+)/g),
-    ].map(m => {
-      if (!m.groups) throw Fail`Invalid proposal output ${m[0]}`;
-      const { permit, script } = m.groups;
-      return { permit, script };
-    });
-    evals.length ||
-      Fail`No swingset-core-eval found in proposal output: ${txt}`;
-
-    const bundles = [
-      ...txt.matchAll(/swingset install-bundle @([^\n]+)/gm),
-    ].map(([, bundle]) => bundle);
-    bundles.length || Fail`No bundles found in proposal output: ${txt}`;
-
-    return { evals, bundles };
-  };
-
-  /**
-   * @param {object} options
-   * @param {string} options.package
-   * @param {string} options.packageScriptName
-   * @param {Record<string, string>} [options.env]
-   */
-  const buildAndExtract = async ({
-    package: packageName,
-    packageScriptName,
-    env = {},
-  }) => {
-    const scriptEnv = Object.assign(Object.create(process.env), env);
-    // XXX use '@agoric/inter-protocol'?
-    const out = await runPackageScript(
-      packageName,
-      packageScriptName,
-      scriptEnv,
-    );
-    const built = parseProposalParts(out.toString());
-
-    const loadAndRmPkgFile = async fileName => {
-      const filePath = getPkgPath(packageName, fileName);
-      const content = await fs.readFile(filePath, 'utf8');
-      await fs.rm(filePath);
-      return content;
-    };
-
-    const evalsP = Promise.all(
-      built.evals.map(async ({ permit, script }) => {
-        const [permits, code] = await Promise.all([
-          loadAndRmPkgFile(permit),
-          loadAndRmPkgFile(script),
-        ]);
-        return { json_permits: permits, js_code: code };
-      }),
-    );
-
-    const bundlesP = Promise.all(
-      built.bundles.map(
-        async bundleFile =>
-          /** @type {Promise<EndoZipBase64Bundle>} */ (loadJSON(bundleFile)),
-      ),
-    );
-    return Promise.all([evalsP, bundlesP]).then(([evals, bundles]) => ({
-      evals,
-      bundles,
-    }));
-  };
-  return buildAndExtract;
-};
-
-const makeTestContext = async t => {
-  console.time('DefaultTestContext');
-  const swingsetTestKit = await makeSwingsetTestKit(t, 'bundles/vaults', {
-    configSpecifier: PLATFORM_CONFIG,
-  });
-
-  const { runUtils, storage } = swingsetTestKit;
-  console.timeLog('DefaultTestContext', 'swingsetTestKit');
-  const { EV } = runUtils;
-
-  // Wait for ATOM to make it into agoricNames
-  await EV.vat('bootstrap').consumeItem('vaultFactoryKit');
-  console.timeLog('DefaultTestContext', 'vaultFactoryKit');
-
-  await eventLoopIteration();
-
-  // has to be late enough for agoricNames data to have been published
-  const agoricNamesRemotes = makeAgoricNamesRemotesFromFakeStorage(
-    swingsetTestKit.storage,
-  );
-  agoricNamesRemotes.brand.ATOM || Fail`ATOM brand not yet defined`;
-  console.timeLog('DefaultTestContext', 'agoricNamesRemotes');
-
-  const walletFactoryDriver = await makeWalletFactoryDriver(
-    runUtils,
-    storage,
-    agoricNamesRemotes,
-  );
-  console.timeLog('DefaultTestContext', 'walletFactoryDriver');
-
-  console.timeEnd('DefaultTestContext');
-
-  const buildProposal = makeProposalExtractor({
-    childProcess: processAmbient,
-    fs: fsAmbient.promises,
-  });
-
-  return {
-    ...swingsetTestKit,
-    agoricNamesRemotes,
-    walletFactoryDriver,
-    buildProposal,
-  };
-};
-
 test.before(async t => {
   t.context = await makeTestContext(t);
 });
diff --git a/packages/vats/test/bootstrapTests/test-zcf-upgrade.js b/packages/vats/test/bootstrapTests/test-zcf-upgrade.js
new file mode 100644
index 00000000000..9cdc8c2dc34
--- /dev/null
+++ b/packages/vats/test/bootstrapTests/test-zcf-upgrade.js
@@ -0,0 +1,104 @@
+// @ts-check
+
+import { test as anyTest } from '@agoric/zoe/tools/prepare-test-env-ava.js';
+import bundleSource from '@endo/bundle-source';
+
+import path from 'path';
+import { makeZoeTestContext } from './supports.js';
+
+const filename = new URL(import.meta.url).pathname;
+const dirname = path.dirname(filename);
+
+const ZCF_PROBE_SRC = './zcfProbe.js';
+
+/**
+ * @file Bootstrap test of upgrading ZCF to support atomicRearrange internally.
+ *
+ * The goal is to tell Zoe about a new version of ZCF that it should use
+ * when starting new contracts. Zoe wasn't previously configurable for that, so
+ * a prerequisite was to upgrade Zoe to a version that could have its ZCF
+ * updated. To test that we install a contract that can detect the variation
+ * among zcf versions, and run it before, in the middle and after the upgrades.
+ *
+ *  0. add a contract that can report on the state of ZCF's support for
+ *     different versions of reallocation: staging, helper, and internal.
+ *  1. put new Zoe & ZCF bundles on chain
+ *  2. upgrade Zoe; return a new facet that supports ZCF update
+ *  3. tell Zoe to use new ZCF
+ *  4. restart the new contract; verify that the behavior is unchanged.
+ *  5. null upgrade the contract; verify that zcf supports internal rearrange.
+ *  6. [optional] fully upgrade the contract; verify that it works
+ */
+
+/** @type {import('ava').TestFn<Awaited<ReturnType<typeof makeZoeTestContext>>>} */
+const test = anyTest;
+
+test.before(async t => {
+  t.context = await makeZoeTestContext(t);
+});
+test.after.always(t => t.context.shutdown?.());
+
+test('run restart-vats proposal', async t => {
+  const { controller, buildProposal, zoeDriver } = t.context;
+  const { EV } = t.context.runUtils;
+
+  const buildAndExecuteProposal = async packageSpec => {
+    const proposal = await buildProposal(packageSpec);
+
+    for await (const bundle of proposal.bundles) {
+      await controller.validateAndInstallBundle(bundle);
+    }
+
+    t.log('installed', proposal.bundles.length, 'bundles');
+
+    t.log('launching proposal');
+    const bridgeMessage = {
+      type: 'CORE_EVAL',
+      evals: proposal.evals,
+    };
+
+    t.log({ bridgeMessage });
+    /** @type {ERef<import('../../src/types.js').BridgeHandler>} */
+    const coreEvalBridgeHandler = await EV.vat('bootstrap').consumeItem(
+      'coreEvalBridgeHandler',
+    );
+    await EV(coreEvalBridgeHandler).fromBridge(bridgeMessage);
+  };
+  const source = `${dirname}/${ZCF_PROBE_SRC}`;
+
+  const zcfProbeBundle = await bundleSource(source);
+  const brandRecord = await zoeDriver.instantiateProbeContract(zcfProbeBundle);
+  const { brand, issuer } = brandRecord;
+  const ducatAmountRecord = v => ({ Ducats: { brand, value: v } });
+
+  t.deepEqual(await zoeDriver.verifyRealloc(), {});
+
+  const ducats = await zoeDriver.faucet();
+  const initialAmount = await EV(issuer).getAmountOf(ducats);
+
+  const beforeResult = await zoeDriver.probeReallocation(initialAmount, ducats);
+  t.true(beforeResult.stagingResult);
+  t.true(beforeResult.helperResult);
+  // In this version of the test, we're upgrading from new ZCF to new ZCF
+  t.true(beforeResult.internalResult);
+  t.deepEqual(await zoeDriver.verifyRealloc(), ducatAmountRecord(3n));
+
+  t.log('building proposal');
+  // /////// Upgrading ////////////////////////////////
+  const zcfPackageSpec = {
+    package: 'vats',
+    packageScriptName: 'build:zcf-proposal',
+  };
+  await buildAndExecuteProposal(zcfPackageSpec);
+
+  t.log('upgrade zoe&zcf proposal executed');
+  zoeDriver.upgradeProbe(zcfProbeBundle);
+  const nextDucats = beforeResult.leftoverPayments.Ducats;
+  const nextAmount = await EV(issuer).getAmountOf(nextDucats);
+
+  const afterResult = await zoeDriver.probeReallocation(nextAmount, nextDucats);
+  t.true(afterResult.stagingResult);
+  t.true(afterResult.helperResult);
+  t.true(afterResult.internalResult);
+  t.deepEqual(await zoeDriver.verifyRealloc(), ducatAmountRecord(6n));
+});
diff --git a/packages/vats/test/bootstrapTests/zcfProbe.js b/packages/vats/test/bootstrapTests/zcfProbe.js
new file mode 100644
index 00000000000..576d88e492d
--- /dev/null
+++ b/packages/vats/test/bootstrapTests/zcfProbe.js
@@ -0,0 +1,132 @@
+import { makeTracer } from '@agoric/internal';
+import {
+  atomicRearrange,
+  provideAll,
+} from '@agoric/zoe/src/contractSupport/index.js';
+import { M, prepareExoClass, provide } from '@agoric/vat-data';
+import { AmountMath } from '@agoric/ertp';
+
+const trace = makeTracer('ZCF Probe');
+
+const ZcfProbeI = M.interface('ZCF Probe', {
+  makeProbeHelperInvitation: M.call().returns(M.promise()),
+  makeProbeInternalInvitation: M.call().returns(M.promise()),
+  makeProbeStagingInvitation: M.call().returns(M.promise()),
+  getAllocation: M.call().returns(M.any()),
+  makeFaucetInvitation: M.call().returns(M.promise()),
+});
+
+/**
+ *
+ * @param {ZCF} zcf
+ * @param {undefined} privateArgs
+ * @param {import('@agoric/vat-data').Baggage} baggage
+ */
+export const prepare = async (zcf, privateArgs, baggage) => {
+  const { probeMint } = await provideAll(baggage, {
+    probeMint: () => zcf.makeZCFMint('Ducats'),
+  });
+
+  const makeZcfProbe = await prepareExoClass(
+    baggage,
+    'zcfProbe',
+    ZcfProbeI,
+    () => ({
+      stashSeat: zcf.makeEmptySeatKit().zcfSeat,
+      probeMint: null,
+    }),
+    {
+      makeProbeHelperInvitation() {
+        const { stashSeat } = this.state;
+
+        const probeHelper = seat => {
+          trace('ProbeHelper');
+          const originalAlloc = seat.getCurrentAllocation().Ducats;
+          const one = AmountMath.make(originalAlloc.brand, 1n);
+          let result;
+          try {
+            atomicRearrange(zcf, harden([[seat, stashSeat, { Ducats: one }]]));
+            result = true;
+          } catch (e) {
+            result = false;
+          }
+
+          seat.exit();
+          return result;
+        };
+
+        return zcf.makeInvitation(probeHelper, 'probe helper');
+      },
+      makeProbeInternalInvitation() {
+        const { stashSeat } = this.state;
+        const probeInternal = seat => {
+          trace('ProbeIntrinsics');
+          const originalAlloc = seat.getCurrentAllocation().Ducats;
+          const one = AmountMath.make(originalAlloc.brand, 1n);
+          let result;
+          try {
+            zcf.atomicRearrange(harden([[seat, stashSeat, { Ducats: one }]]));
+            result = true;
+          } catch (e) {
+            result = false;
+          }
+
+          seat.clear();
+          seat.exit();
+          return result;
+        };
+
+        return zcf.makeInvitation(probeInternal, 'probe intrinsic');
+      },
+      makeProbeStagingInvitation() {
+        const { stashSeat } = this.state;
+
+        const probeStaging = seat => {
+          trace('ProbeStaging');
+
+          const originalAlloc = seat.getCurrentAllocation().Ducats;
+          const one = AmountMath.make(originalAlloc.brand, 1n);
+          let result;
+          try {
+            stashSeat.incrementBy(seat.decrementBy({ Ducats: one }));
+            zcf.reallocate(seat, stashSeat);
+            result = true;
+          } catch (e) {
+            seat.clear();
+            stashSeat.clear();
+            result = false;
+          }
+
+          seat.exit();
+          return result;
+        };
+
+        return zcf.makeInvitation(probeStaging, 'probe staging');
+      },
+      getAllocation() {
+        const { stashSeat } = this.state;
+        trace('getAllocation');
+
+        return stashSeat.getCurrentAllocation();
+      },
+      makeFaucetInvitation() {
+        return zcf.makeInvitation(async seat => {
+          trace('faucet');
+          const { brand } = await probeMint.getIssuerRecord();
+
+          await probeMint.mintGains(
+            { Ducats: AmountMath.make(brand, 16n) },
+            seat,
+          );
+          seat.exit();
+          return 'minted 16n Ducats';
+        }, 'faucet');
+      },
+    },
+  );
+
+  const probe = await provide(baggage, 'probe', () => makeZcfProbe());
+  return harden({
+    creatorFacet: probe,
+  });
+};