feat(rpc): implement ChallengeUpdate P2P broadcast from sudo endpoint

- Add RpcP2PCommand enum for RPC -> P2P communication
- Add RpcServer::with_p2p() constructor with P2P channel
- Implement full signature verification against SUDO_KEY_BYTES
- Broadcast ChallengeUpdate via P2P when sudo request received
- Store WASM locally after broadcast
- Fix platform-sudo to sign with correct message format
- Remove unused imports and dead code

Author: echobt

Cargo.lock

@@ -3,8 +3,7 @@
 use anyhow::{Context, Result};
 use base64::Engine;
 use clap::{Parser, Subcommand};
-use platform_core::{ChallengeId, Hotkey};
-use platform_p2p_consensus::messages::ChallengeUpdateMessage;
+use platform_core::ChallengeId;
 use reqwest::Client;
 use rustyline::DefaultEditor;
 use serde::{Deserialize, Serialize};
@@ -144,14 +143,6 @@ impl SudoCli {
         Ok(keypair.sign(data).0.to_vec())
     }
 
-    fn hotkey(&self) -> Result<Hotkey> {
-        let keypair = self
-            .keypair
-            .as_ref()
-            .ok_or_else(|| anyhow::anyhow!("Sudo key not configured"))?;
-        Ok(Hotkey(keypair.public().0))
-    }
-
     async fn upload_wasm(
         &self,
         file: &PathBuf,
@@ -170,19 +161,9 @@ impl SudoCli {
 
         let timestamp = chrono::Utc::now().timestamp_millis();
 
-        // Create the update message
-        let update = ChallengeUpdateMessage {
-            challenge_id,
-            updater: self.hotkey()?,
-            update_type: "wasm_upload".to_string(),
-            data: wasm_bytes.clone(),
-            timestamp,
-            signature: vec![],
-        };
-
-        // Sign the message
-        let msg_bytes = serde_json::to_vec(&update)?;
-        let signature = self.sign(&msg_bytes)?;
+        // Sign the message (format must match server: "sudo:{action}:{challenge_id}:{timestamp}")
+        let msg_to_sign = format!("sudo:wasm_upload:{}:{}", challenge_id, timestamp);
+        let signature = self.sign(msg_to_sign.as_bytes())?;
 
         // Send via RPC
         let request = SudoRequest {
@@ -224,17 +205,9 @@ impl SudoCli {
 
         let challenge_id = ChallengeId::from_string(challenge_id);
 
-        let update = ChallengeUpdateMessage {
-            challenge_id,
-            updater: self.hotkey()?,
-            update_type: action.to_string(),
-            data: vec![],
-            timestamp,
-            signature: vec![],
-        };
-
-        let msg_bytes = serde_json::to_vec(&update)?;
-        let signature = self.sign(&msg_bytes)?;
+        // Sign the message (format must match server: "sudo:{action}:{challenge_id}:{timestamp}")
+        let msg_to_sign = format!("sudo:{}:{}:{}", action, challenge_id, timestamp);
+        let signature = self.sign(msg_to_sign.as_bytes())?;
 
         let request = SudoRequest {
             action: action.to_string(),

bins/platform-sudo/src/main.rs

@@ -544,6 +544,10 @@ async fn main() -> Result<()> {
             }
         };
 
+    // Create channel for RPC -> P2P communication
+    let (rpc_p2p_tx, mut rpc_p2p_rx) =
+        tokio::sync::mpsc::channel::<platform_rpc::RpcP2PCommand>(64);
+
     // Start RPC server (enabled by default)
     if !args.no_rpc {
         let rpc_addr: std::net::SocketAddr =
@@ -560,7 +564,8 @@ async fn main() -> Result<()> {
             cors_enabled: true,
         };
 
-        let rpc_server = RpcServer::new(rpc_config, chain_state_for_rpc, bans);
+        let rpc_server =
+            RpcServer::with_p2p(rpc_config, chain_state_for_rpc, bans, rpc_p2p_tx.clone());
 
         tokio::spawn(async move {
             if let Err(e) = rpc_server.run().await {
@@ -623,6 +628,66 @@ async fn main() -> Result<()> {
                 ).await;
             }
 
+            // RPC -> P2P commands (challenge updates from sudo)
+            Some(cmd) = rpc_p2p_rx.recv() => {
+                match cmd {
+                    platform_rpc::RpcP2PCommand::BroadcastChallengeUpdate { challenge_id, update_type, data } => {
+                        info!(
+                            challenge_id = %challenge_id,
+                            update_type = %update_type,
+                            data_bytes = data.len(),
+                            "Broadcasting ChallengeUpdate from RPC"
+                        );
+
+                        // Create and sign the message
+                        let timestamp = chrono::Utc::now().timestamp_millis();
+                        let msg_to_sign = format!("challenge_update:{}:{}:{}", challenge_id, update_type, timestamp);
+                        let signature = keypair.sign(msg_to_sign.as_bytes());
+
+                        let update_msg = platform_p2p_consensus::ChallengeUpdateMessage {
+                            challenge_id,
+                            updater: keypair.hotkey(),
+                            update_type: update_type.clone(),
+                            data: data.clone(),
+                            timestamp,
+                            signature: signature.signature.to_vec(),
+                        };
+
+                        let msg = P2PMessage::ChallengeUpdate(update_msg);
+                        if let Err(e) = p2p_broadcast_tx.send(platform_p2p_consensus::P2PCommand::Broadcast(msg)).await {
+                            error!("Failed to broadcast ChallengeUpdate: {}", e);
+                        } else {
+                            info!(
+                                challenge_id = %challenge_id,
+                                update_type = %update_type,
+                                "ChallengeUpdate broadcast successful"
+                            );
+
+                            // Also handle locally (store WASM if it's an upload)
+                            if update_type == "wasm_upload" && !data.is_empty() {
+                                let wasm_key = StorageKey::new("wasm", &challenge_id.to_string());
+                                match storage.put(wasm_key, data, PutOptions::default()).await {
+                                    Ok(metadata) => {
+                                        info!(
+                                            challenge_id = %challenge_id,
+                                            version = metadata.version,
+                                            "WASM stored locally in distributed storage"
+                                        );
+                                    }
+                                    Err(e) => {
+                                        error!(
+                                            challenge_id = %challenge_id,
+                                            error = %e,
+                                            "Failed to store WASM locally"
+                                        );
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
             // Heartbeat - broadcast to other validators (skip in bootnode mode)
             _ = heartbeat_interval.tick() => {
                 if !is_bootnode {

bins/validator-node/src/main.rs

@@ -26,6 +26,7 @@ bincode = { workspace = true }
 # Crypto
 sp-core = { version = "31.0", default-features = false, features = ["std"] }
 hex = { workspace = true }
+base64 = "0.22"
 
 # Utils
 tracing = { workspace = true }