feat(node): add GovDAO-based chain halt via r/sys/params

examples/gno.land/r/sys/params/halt.gno

@@ -0,0 +1,51 @@
+package params
+
+import (
+	"strconv"
+
+	"chain"
+	prms "sys/params"
+
+	"gno.land/r/gov/dao"
+)
+
+const (
+	nodeModulePrefix  = "node"
+	haltHeightKey     = "halt_height"
+	haltMinVersionKey = "halt_min_version"
+)
+
+// NewSetHaltRequest creates a GovDAO proposal to halt all chain nodes at the given block height.
+// Once approved and executed, nodes will gracefully stop after committing the specified block,
+// enabling coordinated chain upgrades.
+//
+// minVersion, if non-empty, sets the minimum binary version required to resume after the halt.
+// Nodes will refuse to restart unless their version satisfies the minimum requirement,
+// preventing old binaries from accidentally resuming a chain halted for an upgrade.
+// Example: minVersion="chain/gnoland1.1" prevents gnoland1.0 from resuming.
+//
+// Use height=0 to cancel a previously scheduled halt.
+func NewSetHaltRequest(height int64, minVersion string) dao.ProposalRequest {
+	callback := func(cur realm) error {
+		prms.SetSysParamInt64(nodeModulePrefix, "p", haltHeightKey, height)
+		prms.SetSysParamString(nodeModulePrefix, "p", haltMinVersionKey, minVersion)
+		chain.Emit("set_halt",
+			"height", strconv.FormatInt(height, 10),
+			"min_version", minVersion,
+		)
+		return nil
+	}
+
+	var desc string
+	if height == 0 {
+		desc = "Cancel the scheduled chain halt and clear the minimum version requirement."
+	} else {
+		desc = "Halt the chain at block " + strconv.FormatInt(height, 10) + "."
+		if minVersion != "" {
+			desc += " Requires binary version >= " + minVersion + " to resume."
+		}
+	}
+
+	e := dao.NewSimpleExecutor(callback, "")
+	return dao.NewProposalRequest("Set node halt height", desc, e)
+}

examples/gno.land/r/sys/params/params_test.gno

@@ -15,3 +15,24 @@ func TestNewStringPropRequest(t *testing.T) {
 		t.Errorf("executor shouldn't be nil")
 	}
 }
+
+func TestNewSetHaltRequest(t *testing.T) {
+	pr := NewSetHaltRequest(100_000, "chain/gnoland1.1")
+	if pr.Title() == "" {
+		t.Errorf("proposal title shouldn't be empty")
+	}
+}
+
+func TestNewSetHaltRequestNoVersion(t *testing.T) {
+	pr := NewSetHaltRequest(100_000, "")
+	if pr.Title() == "" {
+		t.Errorf("proposal title shouldn't be empty")
+	}
+}
+
+func TestNewSetHaltRequestCancel(t *testing.T) {
+	pr := NewSetHaltRequest(0, "")
+	if pr.Title() == "" {
+		t.Errorf("proposal title shouldn't be empty")
+	}
+}

gno.land/cmd/gnoland/start.go

@@ -264,6 +264,7 @@ func execStart(ctx context.Context, c *startCfg, io commands.IO) error {
 		cfg.Application,
 		evsw,
 		logger,
+		cfg.BaseConfig.SkipUpgradeHeight,
 	)
 	if err != nil {
 		return fmt.Errorf("unable to create the Gnoland app, %w", err)

gno.land/pkg/gnoland/app.go

@@ -42,6 +42,7 @@ type AppOptions struct {
 	EventSwitch                events.EventSwitch // required
 	VMOutput                   io.Writer          // optional
 	SkipGenesisSigVerification bool               // default to verify genesis transactions
+	SkipUpgradeHeight          int64              // if set, skip the halt_min_version check at this height
 	InitChainerConfig                             // options related to InitChainer
 	MinGasPrices               string             // optional
 	PruneStrategy              types.PruneStrategy
@@ -115,6 +116,7 @@ func NewAppWithOptions(cfg *AppOptions) (abci.Application, error) {
 	prmk.Register(auth.ModuleName, acck)
 	prmk.Register(bank.ModuleName, bankk)
 	prmk.Register(vm.ModuleName, vmk)
+	prmk.Register("node", nodeParamsKeeper{})
 
 	// Set InitChainer
 	icc := cfg.InitChainerConfig
@@ -213,6 +215,7 @@ func NewAppWithOptions(cfg *AppOptions) (abci.Application, error) {
 			acck,
 			gpk,
 			vmk,
+			prmk,
 			baseApp,
 		),
 	)
@@ -233,6 +236,11 @@ func NewAppWithOptions(cfg *AppOptions) (abci.Application, error) {
 	vmk.Initialize(cfg.Logger, ms)
 	ms.MultiWrite() // XXX why was't this needed?
 
+	// Verify node startup constraints set by governance halt proposals.
+	if err := checkNodeStartupParams(prmk, baseApp.GetCacheMultiStore(), baseApp.LastBlockHeight(), cfg.SkipUpgradeHeight); err != nil {
+		return nil, err
+	}
+
 	return baseApp, nil
 }
 
@@ -258,6 +266,7 @@ func NewApp(
 	appCfg *sdkCfg.AppConfig,
 	evsw events.EventSwitch,
 	logger *slog.Logger,
+	skipUpgradeHeight int64,
 ) (abci.Application, error) {
 	var err error
 
@@ -270,6 +279,7 @@ func NewApp(
 		},
 		MinGasPrices:               appCfg.MinGasPrices,
 		SkipGenesisSigVerification: genesisCfg.SkipSigVerification,
+		SkipUpgradeHeight:          skipUpgradeHeight,
 		PruneStrategy:              appCfg.PruneStrategy,
 	}
 	if genesisCfg.SkipFailingTxs {
@@ -475,22 +485,26 @@ type endBlockerApp interface {
 
 	// Logger returns the logger reference
 	Logger() *slog.Logger
+
+	// SetHaltHeight sets the block height at which the node will halt.
+	SetHaltHeight(uint64)
 }
 
 // EndBlocker defines the logic executed after every block.
 // Currently, it parses events that happened during execution to calculate
-// validator set changes
+// validator set changes, and checks for a governance-requested chain halt.
 func EndBlocker(
 	collector *collector[validatorUpdate],
 	acck auth.AccountKeeperI,
 	gpk auth.GasPriceKeeperI,
 	vmk vm.VMKeeperI,
+	prmk params.ParamsKeeperI,
 	app endBlockerApp,
 ) func(
 	ctx sdk.Context,
 	req abci.RequestEndBlock,
 ) abci.ResponseEndBlock {
-	return func(ctx sdk.Context, _ abci.RequestEndBlock) abci.ResponseEndBlock {
+	return func(ctx sdk.Context, req abci.RequestEndBlock) abci.ResponseEndBlock {
 		// set the auth params value in the ctx.  The EndBlocker will use InitialGasPrice in
 		// the params to calculate the updated gas price.
 		if acck != nil {
@@ -500,6 +514,24 @@ func EndBlocker(
 			auth.EndBlocker(ctx, gpk)
 		}
 
+		// Check if GovDAO has requested a halt at this height.
+		// Use == (not >=) so we only trigger once: at the exact halt height.
+		// SetHaltHeight causes BeginBlock of the *next* block to panic, ensuring
+		// this block is fully committed before the node stops.
+		// On restart, req.Height > halt_height, so == never re-fires — no infinite loop.
+		if prmk != nil {
+			var haltHeight int64
+			prmk.GetInt64(ctx, nodeParamHaltHeight, &haltHeight)
+			if haltHeight > 0 && req.Height == haltHeight {
+				app.Logger().Info(
+					"GovDAO halt height reached, will halt after this block",
+					"height", req.Height,
+					"halt_height", haltHeight,
+				)
+				app.SetHaltHeight(uint64(haltHeight))
+			}
+		}
+
 		// Check if there was a valset change
 		if len(collector.getEvents()) == 0 {
 			// No valset updates