Skip to content

feat: allow composite queries to call the management canister query methods - #10987

Open
mraszyk wants to merge 8 commits into
masterfrom
mraszyk/composite-query-ic00-calls
Open

feat: allow composite queries to call the management canister query methods#10987
mraszyk wants to merge 8 commits into
masterfrom
mraszyk/composite-query-ic00-calls

Conversation

@mraszyk

@mraszyk mraszyk commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Composite queries can now call the management canister methods that can be invoked by users as non-replicated query calls, i.e. the methods listed in QueryMethod: fetch_canister_logs, canister_status, list_canisters and canister_metrics. The calls are executed against the state of the own subnet on behalf of the calling canister, so they can only target canisters hosted by the own subnet and they are subject to the same access control as the corresponding queries sent by end users.

The feature is gated behind the (disabled by default) config flag composite_query_ic00_calls to enable a gradual rollout.

Implementation notes:

  • The execution of the management canister query methods is factored out of the user query path into the new subnet_query module which is shared by both the user query path and the new composite query path.
  • Requests to the management canister made by a composite query are no longer routed based on the method and the payload, but resolved to the own subnet and handled by the query handler.
  • The instructions consumed while producing the reply (applies to fetch_canister_logs and list_canisters) are charged towards the instruction limit of the whole call graph, in addition to the base overhead charged for every query call.
  • Query contexts calling the management canister are never cached: their results may depend on parts of the state that the query cache does not track, e.g. the cycles balance of a canister other than the queried one.

…ery methods

Composite queries can now call the management canister methods that can be
served from a state snapshot in the non-replicated mode, i.e. the methods
listed in `QueryMethod`: `fetch_canister_logs`, `canister_status`,
`list_canisters` and `canister_metrics`. The calls are executed against the
state of the own subnet on behalf of the calling canister, so they can only
target canisters hosted by the own subnet and they are subject to the same
access control as the corresponding queries sent by end users.

The feature is gated behind the (disabled by default) config flag
`composite_query_ic00_calls` to enable a gradual rollout.

Implementation notes:
- The execution of the management canister query methods is factored out of
  the user query path into the new `subnet_query` module which is shared by
  both the user query path and the new composite query path.
- Requests to ic:00 made by a composite query in the non-replicated mode are
  no longer routed based on the method and the payload, but resolved to the
  own subnet and handled by the query handler. Consequently, the flag telling
  `resolve_destination` about composite queries only refers to non-replicated
  composite queries now and is thus renamed accordingly. Composite queries
  executed in the replicated mode route their calls to ic:00 like any other
  replicated message, which also means that `fetch_canister_logs` is now
  accessible to them subject to `replicated_inter_canister_log_fetch`.
- The instructions consumed while producing the reply (`list_canisters` is
  linear in the number of canisters on the subnet) are charged towards the
  instruction limit of the whole call graph, in addition to the base overhead
  charged for every query call.
- Query contexts calling the management canister are never cached: their
  results may depend on parts of the state that the query cache does not
  track, e.g. the cycles balance of a canister other than the queried one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions github-actions Bot added the feat label Jul 31, 2026
mraszyk and others added 6 commits August 3, 2026 11:19
Requests to the management canister made by a composite query are now resolved
to the own subnet at the call site of `resolve_destination` instead of inside
it: `resolve_destination` no longer takes a flag telling it about composite
queries and is not called for composite queries at all.

Also fix comments to refer to the management canister instead of ic:00 and to
state that composite queries are always executed in the non-replicated mode
(a composite query called in the replicated mode is rejected before its
execution), rather than claiming that replicated composite queries route their
calls to the management canister like any other replicated message.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…mposite_query

Every composite query is executed in the non-replicated mode, so the qualifier
is redundant: the flag is now only used to decide whether a request to the
management canister is resolved to the own subnet instead of being routed based
on the method and the payload.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…e management canister

- Charge the base overhead of a query call to the management canister only
  after rejecting calls to methods that are not management canister query
  methods, in the same way as calls to non-existing methods of a canister are
  not charged.
- Reject calls to management canister methods that cannot be executed in the
  non-replicated mode with the error of `parse_query_method`, i.e. the same
  error as for such a query sent by an end user to the management canister.
- Charge the same number of instructions for `fetch_canister_logs` in the
  non-replicated mode as in the replicated mode by introducing the shared
  helper `fetch_canister_logs_reply` (analogously to `list_canisters`).
- Test that the result of a composite query is not cached if the management
  canister is called from a reply callback of a nested composite query call.
- Do not test `list_canisters` itself in the composite query test and tighten
  the instruction limit test to the number of calls the limit is set up for.
- Fix comments: query methods can also be executed in the replicated mode.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…omposite query call are not cached

Complements the test for a call to the management canister made from a reply
callback: here the call is made by the callee of a nested composite query call,
i.e. one level down in the call graph of the query context whose result must
not be cached.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…call to the management canister

Assert the exact reject message including the own subnet ID instead of just
checking that the message contains "not found": the latter would also pass if
the call failed because the canister whose logs are fetched was not found.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ry methods

The instructions consumed while producing the reply of a management canister
query method are still charged towards the instruction limit of the whole call
graph, but they are no longer added to the instruction observation and the
measurement scope:
- the instruction observation is only used to charge the instructions of a
  canister http transform, and a composite query cannot be used as a transform
  (see `QueryContext::run`), so the management canister cannot be called on
  that path at all;
- the measurement scope tracks the executions of canister messages, while the
  execution of a management canister query method is already observed by
  `observe_subnet_query_message`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR enables composite queries to call selected management canister query methods (fetch_canister_logs, canister_status, list_canisters, canister_metrics) by routing such calls to the caller’s own subnet and executing them against local subnet state, gated behind the disabled-by-default composite_query_ic00_calls flag.

Changes:

  • Factor management-canister query execution into a shared subnet_query module and reuse it from both end-user query handling and composite-query handling.
  • Route composite-query ic:00 calls to the local subnet and execute them in the query handler, including instruction accounting and metrics.
  • Ensure composite-query contexts that call the management canister are never cached; add/extend tests and metrics to cover the new behavior.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 4 comments.

Show a summary per file
File Description
rs/test_utilities/execution_environment/src/lib.rs Adds a test-builder helper to enable the composite_query_ic00_calls feature flag.
rs/execution_environment/tests/canister_logging.rs Updates state-machine tests for fetch_canister_logs behavior when composite-query ic00 calls are enabled/disabled.
rs/execution_environment/src/query_handler/tests.rs Adds query-handler tests covering composite-query calls into management canister query methods and instruction charging.
rs/execution_environment/src/query_handler/subnet_query.rs Introduces a shared implementation for executing management canister query methods against a local subnet state.
rs/execution_environment/src/query_handler/query_context.rs Adds composite-query handling for routed-to-subnet management calls, instruction charging, and tracks ic00_calls for cache bypass.
rs/execution_environment/src/query_handler/query_cache/tests.rs Adds tests asserting composite-query results are never cached when management canister is called (including nested/callback cases).
rs/execution_environment/src/query_handler/query_cache.rs Skips caching when ic00_calls > 0 and adds a dedicated invalidation metric.
rs/execution_environment/src/query_handler.rs Refactors management-canister query handling to use subnet_query and wires ic00_calls into cache insertion.
rs/execution_environment/src/metrics.rs Adjusts subnet-query observation to accept encoded replies (Vec<u8>) rather than WasmResult.
rs/execution_environment/src/execution/response.rs Removes composite-query origin checks in replicated response handling (composite queries handled via query handler).
rs/execution_environment/src/execution/call_or_task.rs Removes composite-query detection in replicated execution paths (composite queries are non-replicated).
rs/execution_environment/src/canister_logs.rs Factors out fetch_canister_logs_reply to share reply generation + instruction accounting across replicated/non-replicated paths.
rs/embedders/src/wasmtime_embedder/system_api/sandbox_safe_system_state.rs Routes composite-query management-canister requests to the local subnet instead of payload-based routing.
rs/embedders/src/wasmtime_embedder/system_api/routing.rs Simplifies management-canister routing API and removes composite-query special-casing from routing logic.
rs/config/src/execution_environment.rs Adds the composite_query_ic00_calls config flag (disabled by default) and documents it.
Suppressed comments (1)

rs/execution_environment/tests/canister_logging.rs:487

  • Typo in comment: "relatioship" → "relationship".
    // There are 3 actors with the following controller relatioship: user -> canister_a -> canister_b.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread rs/execution_environment/src/query_handler/subnet_query.rs
Comment thread rs/execution_environment/src/query_handler/query_cache/tests.rs
Comment thread rs/execution_environment/src/query_handler/tests.rs
Comment thread rs/execution_environment/tests/canister_logging.rs Outdated
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@mraszyk
mraszyk marked this pull request as ready for review August 3, 2026 15:47
@mraszyk
mraszyk requested a review from a team as a code owner August 3, 2026 15:47
@zeropath-ai

zeropath-ai Bot commented Aug 3, 2026

Copy link
Copy Markdown

No security or compliance issues detected. Reviewed everything up to ad9c3bf.

Security Overview
Detected Code Changes
Change Type Relevant files
Enhancement ► rs/config/src/execution_environment.rs
    Add composite_query_ic00_calls feature flag to Config and Default
Refactor ► rs/embedders/src/wasmtime_embedder/system_api/routing.rs
    Update doc comment to reference management canister (ic00) instead of ic:00
► rs/embedders/src/wasmtime_embedder/system_api/sandbox_safe_system_state.rs
    Route management canister destination based on composite query handling
► rs/execution_environment/src/canister_logs.rs
    Introduce fetch_canister_logs_reply helper returning reply and instructions
Enhancement ► rs/execution_environment/src/execution/call_or_task.rs
    Guard composite query handling by forcing false for is_composite_query in certain paths
Enhancement ► rs/execution_environment/src/execution/response.rs
    Disable composite query impact in response path by using false for is_composite_query in two spots; adjust related context usage
Enhancement ► rs/execution_environment/src/metrics.rs
    Add observe_subnet_query_message for management canister queries; adjust result type to handle Vec for encoded replies; minor imports adjustment
Enhancement ► rs/execution_environment/src/query_handler.rs
    Refactor to use subnet_query module and remove direct ic00/FetchCanisterLogs handling from here; integrate new subnet_query flow
Enhancement ► rs/execution_environment/src/query_handler/query_cache.rs
    Add invalidation metric for ic00 calls; modify cache eviction logic to invalidate on ic00_calls > 0; extend QueryCache constructor signature usage
Enhancement ► rs/execution_environment/src/query_handler/query_cache/tests.rs
    Add tests for composite query ic00 call behavior and cache invalidation metrics
Enhancement ► rs/execution_environment/src/query_handler/query_context.rs
    Integrate subnet_query method imports; extend QueryContext to carry ic00_calls counter and composite_query_ic00_calls flag; adapt constructors and usage
Enhancement ► rs/execution_environment/src/query_handler/query_context.rs (handle_ic00_request)
    Implement handling for composite query calls to ic00 within own subnet; track ic00_calls; adjust instruction accounting and metrics; return appropriate Payload responses
Enhancement ► rs/execution_environment/src/query_handler/query_context.rs (new method handle_ic00_request) mentioned in patch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants