Make `UserSeat`, `ZCFSeat`, into ownables

https://github.com/Agoric/agoric-sdk/pull/8745 defined Ownables, implemented at https://github.com/Agoric/agoric-sdk/blob/master/packages/zoe/src/contractSupport/prepare-ownable.js with expository example at https://github.com/Agoric/agoric-sdk/blob/master/packages/zoe/test/unitTests/contracts/ownable-counter.js . This is designed so that we can often retrofit existing exos to be ownables.

See #8745 PR comment for best current explanation. In general, if holding an object confers valuable rights to do things, making those objects into ownables may usefully make that value ownable and thereby exclusively tradable, if

the right is cleanly revoked by denying access to the object
the object's own description of its state at that time is adequate for invitation legibility, i.e., that it can be used in a proposal want pattern to express a right that is meaningfully wanted.

https://github.com/Agoric/agoric-sdk/pull/4080 explains a plan to refactor the essence of Zoe to have a separable escrow service into a new Zoe2 design. As applied to current Zoe, we can think of the result of making an offer as creating two distinct bundles of rights:

UserSeat: The right to collect the outcome of the offer, with guaranteed offer safety + the right to request exit, subject to the offer's exit terms. This is already represented by the UserSeat. Making the UserSeat into an ownable means that the right to collect the outcome becomes exclusively tradable. As a tradable asset it has much in common with trading the right to collect on a loan -- where the outcome will be either the lent amount or the collateral as of the deadline, where someone else (the borrower) is in control of which one. If the offer's want is unsatisfiable, this degenerates into a covered-call option.
ZCFSeat: The right to determine how a live offer resolves, subject to offer safety + the right to exit the offer at any time. This is already represented by the ZCFSeat. Making the ZCFSeat into an ownable means that the right to determine the outcome, initially exclusively held by the contract, can be transferred by the contract to other contracts that might better satisfy the offer. This lets the first contract act as a router, routing the offer to the place it is likely to be best satisfied. Unlike offerTo, such order-routing does not have to duplicate the escrowed give amount, avoiding the capital costs of our current offer-delegation mechanism.

It is interesting to compare this with "intents", which also try to provide offer-safety constrained order-routing, but without the expressiveness of interacting with behavioral contracts along the way. Hopefully, we can bridge between these two worlds, giving each a window into the other.

Working prototype

As part of #8184, I got something that works in 1 case.

2024-11-09 03:40 f28d7a1f4c feat: ownable seat, resolver (lightly tested)

It's lightly tested using manual mutation testing:

diff --git a/packages/zoe/test/z2spec/escrow-exo.test.js b/packages/zoe/test/z2spec/escrow-exo.test.js
index 0806866854..223927377a 100644
--- a/packages/zoe/test/z2spec/escrow-exo.test.js
+++ b/packages/zoe/test/z2spec/escrow-exo.test.js
@@ -59,6 +59,8 @@ test('escrowExchange: Alice and Bob do simpleExchange ', async t => {
       const { seat, resolver } = await ex1.makeEscrowSeatKit(proposal, pmts);
       t.log(name, 'got seat, resolver', seat);

+      await resolver.makeTransferInvitation();
+
       const participate = simpleExchange(resolver);

       const deposit = E.when(seat.getPayouts(), payouts =>

results:

    ℹ REJECTED from ava test("escrowExchange: Alice and Bob do simpleExchange "): (Error#1)
    ℹ Error#1: OwnableSeatResolver_caretaker revoked
    ℹ     at makeError (file:///home/connolly/projects/ag-escrow-formal/node_modules/ses/src/error/assert.js:350:61)
          at fail (file:///home/connolly/projects/ag-escrow-formal/node_modules/ses/src/error/assert.js:482:20)
          at Fail (file:///home/connolly/projects/ag-escrow-formal/node_modules/ses/src/error/assert.js:492:39)
          at Object.readOnly (file:///home/connolly/projects/ag-escrow-formal/packages/base-zone/src/prepare-revocable.js:128:23)
          at In "readOnly" method of (OwnableSeatResolver_caretaker revocable) [as readOnly] (file:///home/connolly/projects/ag-escrow-formal/node_modules/@endo/exo/src/exo-tools.js:171:24)
          at simpleExchange (file:///home/connolly/projects/ag-escrow-formal/packages/zoe/test/z2spec/escrow-exo.test.js:19:35)
          at Object.go (file:///home/connolly/projects/ag-escrow-formal/packages/zoe/test/z2spec/escrow-exo.test.js:64:27)

invoked a la:

$ cd packages/zoe
$ yarn test test/z2spec/

Agoric / agoric-sdk

Make `UserSeat`, `ZCFSeat`, into ownables #9606

Working prototype