Add Aptos local CRE read/write support with write CI coverage

.changeset/aptos-local-cre-support.md

@@ -0,0 +1,7 @@
+---
+"chainlink": patch
+---
+
+#internal
+
+Add Aptos local CRE read/write support, including Capabilities Registry OCR config for Aptos write and CI coverage for the Aptos write roundtrip and expected-failure scenarios.

.github/workflows/cre-system-tests.yaml

@@ -75,6 +75,9 @@ jobs:
 
           # Add list of tests with certain topologies
           PER_TEST_TOPOLOGIES_JSON=${PER_TEST_TOPOLOGIES_JSON:-'{
+            "Test_CRE_V2_Aptos_Suite": [
+               {"topology":"workflow-gateway-aptos","configs":"configs/workflow-gateway-don-aptos.toml"}
+             ],
             "Test_CRE_V2_Solana_Suite": [
                {"topology":"workflow","configs":"configs/workflow-don-solana.toml"}
              ],
@@ -213,6 +216,35 @@ jobs:
           chmod +x bin/ctf
           echo "::endgroup::"
 
+      - name: Install Aptos CLI
+        if: ${{ matrix.tests.test_name == 'Test_CRE_V2_Aptos_Suite' }}
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          APTOS_CLI_TAG: "aptos-cli-v7.8.0"
+        run: |
+          echo "::startgroup::Install Aptos CLI"
+          bin_dir="$HOME/.local/bin"
+          mkdir -p "$bin_dir"
+
+          gh release download "${APTOS_CLI_TAG}" \
+            --pattern "aptos-cli-*-Ubuntu-24.04-x86_64.zip" \
+            --clobber \
+            --repo aptos-labs/aptos-core \
+            -O aptos-cli.zip
+
+          unzip -o aptos-cli.zip -d aptos-cli-extract >/dev/null
+          aptos_path="$(find aptos-cli-extract -type f -name aptos | head -n1)"
+          if [[ -z "$aptos_path" ]]; then
+            echo "failed to locate aptos binary in release archive"
+            exit 1
+          fi
+
+          install -m 0755 "$aptos_path" "$bin_dir/aptos"
+          echo "$bin_dir" >> "$GITHUB_PATH"
+          "$bin_dir/aptos" --version
+          echo "::endgroup::"
+
       - name: Start local CRE${{ matrix.tests.cre_version }}
         shell: bash
         id: start-local-cre

core/cmd/shell_local.go

@@ -552,6 +552,19 @@ func (s *Shell) runNode(c *cli.Context) error {
 		}
 	}
 	if s.Config.AptosEnabled() {
+		for _, k := range s.Config.ImportedAptosKeys().List() {
+			lggr.Debug("Importing aptos key")
+			_, err2 := app.GetKeyStore().Aptos().Import(rootCtx, []byte(k.JSON()), k.Password())
+			if err2 != nil {
+				if errors.Is(err2, keystore.ErrKeyExists) {
+					lggr.Debugf("Aptos key %s already exists for chain %v", k.JSON(), k.ChainDetails())
+					continue
+				}
+				return s.errorOut(fmt.Errorf("error importing aptos key: %w", err2))
+			}
+			lggr.Debugf("Imported aptos key %s for chain %v", k.JSON(), k.ChainDetails())
+		}
+
 		err2 := app.GetKeyStore().Aptos().EnsureKey(rootCtx)
 		if err2 != nil {
 			return fmt.Errorf("failed to ensure aptos key: %w", err2)

core/config/toml/types.go

@@ -146,6 +146,7 @@ type Secrets struct {
 	Threshold  ThresholdKeyShareSecrets `toml:",omitempty"`
 	EVM        EthKeys                  `toml:",omitempty"` // choose EVM as the TOML field name to align with relayer config convention
 	Solana     SolKeys                  `toml:",omitempty"` // choose Solana as the TOML field name to align with relayer config convention
+	Aptos      AptosKeys                `toml:",omitempty"` // choose Aptos as the TOML field name to align with relayer config convention
 
 	P2PKey          P2PKey          `toml:",omitempty"`
 	DKGRecipientKey DKGRecipientKey `toml:",omitempty"`
@@ -164,6 +165,16 @@ type SolKey struct {
 	Password *models.Secret
 }
 
+type AptosKeys struct {
+	Keys []*AptosKey
+}
+
+type AptosKey struct {
+	JSON     *models.Secret
+	ID       *uint64
+	Password *models.Secret
+}
+
 func (s *SolKeys) SetFrom(f *SolKeys) error {
 	err := s.validateMerge(f)
 	if err != nil {
@@ -245,6 +256,85 @@ func (e *SolKey) ValidateConfig() (err error) {
 	return err
 }
 
+func (a *AptosKeys) SetFrom(f *AptosKeys) error {
+	err := a.validateMerge(f)
+	if err != nil {
+		return err
+	}
+	if f == nil || len(f.Keys) == 0 {
+		return nil
+	}
+	a.Keys = make([]*AptosKey, len(f.Keys))
+	copy(a.Keys, f.Keys)
+	return nil
+}
+
+func (a *AptosKeys) validateMerge(f *AptosKeys) (err error) {
+	have := make(map[uint64]struct{})
+	if a != nil && f != nil {
+		for _, aptosKey := range a.Keys {
+			have[*aptosKey.ID] = struct{}{}
+		}
+		for _, aptosKey := range f.Keys {
+			if _, ok := have[*aptosKey.ID]; ok {
+				err = errors.Join(err, configutils.ErrOverride{Name: fmt.Sprintf("AptosKeys: %d", *aptosKey.ID)})
+			}
+		}
+	}
+	return err
+}
+
+func (a *AptosKeys) ValidateConfig() (err error) {
+	for i, aptosKey := range a.Keys {
+		if err2 := aptosKey.ValidateConfig(); err2 != nil {
+			err = errors.Join(err, configutils.ErrInvalid{Name: fmt.Sprintf("AptosKeys[%d]", i), Value: aptosKey, Msg: "invalid AptosKey"})
+		}
+	}
+	return err
+}
+
+func (p *AptosKey) SetFrom(f *AptosKey) (err error) {
+	err = p.validateMerge(f)
+	if err != nil {
+		return err
+	}
+	if v := f.JSON; v != nil {
+		p.JSON = v
+	}
+	if v := f.ID; v != nil {
+		p.ID = v
+	}
+	if v := f.Password; v != nil {
+		p.Password = v
+	}
+	return nil
+}
+
+func (p *AptosKey) validateMerge(f *AptosKey) (err error) {
+	if p.JSON != nil && f.JSON != nil {
+		err = errors.Join(err, configutils.ErrOverride{Name: "JSON"})
+	}
+	if p.ID != nil && f.ID != nil {
+		err = errors.Join(err, configutils.ErrOverride{Name: "ID"})
+	}
+	if p.Password != nil && f.Password != nil {
+		err = errors.Join(err, configutils.ErrOverride{Name: "Password"})
+	}
+	return err
+}
+
+func (p *AptosKey) ValidateConfig() (err error) {
+	if (p.JSON != nil) != (p.Password != nil) || (p.Password != nil) != (p.ID != nil) {
+		err = errors.Join(err, configutils.ErrInvalid{Name: "AptosKey", Value: p.JSON, Msg: "all fields must be nil or non-nil"})
+	}
+	if p.ID != nil {
+		if _, ok := chain_selectors.AptosChainIdToChainSelector()[*p.ID]; !ok {
+			err = errors.Join(err, configutils.ErrInvalid{Name: "ID", Value: p.ID, Msg: "invalid chain id"})
+		}
+	}
+	return err
+}
+
 type EthKeys struct {
 	Keys []*EthKey
 }

core/scripts/cre/environment/configs/capability_defaults.toml

@@ -130,6 +130,17 @@
   # FromAddress = "0x0000000000000000000000000000000000000000"
   # ForwarderAddress = "0x0000000000000000000000000000000000000000"
 
+# Aptos chain capability plugin (View + WriteReport). Runtime values are injected per chain.
+[capability_configs.aptos]
+  binary_name = "aptos"
+
+[capability_configs.aptos.values]
+  # These values build the Aptos capability config registered in CapReg.
+  # ChainID and forwarder address are injected separately at job proposal time.
+  # They are not emitted as top-level worker job-spec fields.
+  RequestTimeout = "30s"
+  DeltaStage = "1500ms"
+
 [capability_configs.solana.values]
   TxAcceptanceState = 3
   TxRetentonTimeout = "120s"

core/scripts/cre/environment/configs/workflow-gateway-don-aptos.toml

@@ -0,0 +1,79 @@
+# Same as workflow-gateway-don.toml but with Aptos chain and a single Aptos capability.
+# Anvil 1337: registry and gateway. Aptos: local devnet (chain_id 4). Run: env config path <this file>, then env start.
+
+[[blockchains]]
+  type = "anvil"
+  chain_id = "1337"
+  container_name = "anvil-1337"
+  docker_cmd_params = ["-b", "0.5", "--mixed-mining"]
+
+[[blockchains]]
+  type = "aptos"
+  chain_id = "4"
+
+[jd]
+  csa_encryption_key = "d1093c0060d50a3c89c189b2e485da5a3ce57f3dcb38ab7e2c0d5f0bb2314a44"
+  # change to your version
+  image = "job-distributor:0.22.1"
+
+#[s3provider]
+#  # use all defaults
+#  port = 9000
+#  console_port = 9001
+
+[infra]
+  # either "docker" or "kubernetes"
+  type = "docker"
+
+[[nodesets]]
+  nodes = 4
+  name = "workflow"
+  don_types = ["workflow"]
+  override_mode = "all"
+  http_port_range_start = 10100
+
+  # Keep the registry chain (1337) in node TOML even though this DON's chain-scoped
+  # capability is Aptos-only; the workflow stack still needs the EVM registry chain.
+  supported_evm_chains = [1337]
+  # Workflow runtime limits still need both the EVM registry chain and the Aptos chain selector.
+  env_vars = { CL_CRE_SETTINGS_DEFAULT = '{"PerWorkflow":{"CapabilityCallTimeout":"5m0s","ChainAllowed":{"Default":"false","Values":{"1337":"true","4457093679053095497":"true"}}}}' }
+  capabilities = ["cron", "consensus", "aptos-4"]
+  registry_based_launch_allowlist = ["cron-trigger@1.0.0"]
+
+  [nodesets.db]
+    image = "postgres:12.0"
+    port = 13000
+
+  [[nodesets.node_specs]]
+    roles = ["plugin"]
+    [nodesets.node_specs.node]
+      docker_ctx = "../../../.."
+      docker_file = "core/chainlink.Dockerfile"
+      docker_build_args = { "CL_IS_PROD_BUILD" = "false" }
+      # image = "chainlink-tmp:latest"
+      user_config_overrides = ""
+
+[[nodesets]]
+  nodes = 1
+  name = "bootstrap-gateway"
+  don_types = ["bootstrap", "gateway"]
+  override_mode = "each"
+  http_port_range_start = 10300
+
+  supported_evm_chains = [1337]
+
+  [nodesets.db]
+    image = "postgres:12.0"
+    port = 13200
+
+  [[nodesets.node_specs]]
+    roles = ["bootstrap", "gateway"]
+    [nodesets.node_specs.node]
+      docker_ctx = "../../../.."
+      docker_file = "core/chainlink.Dockerfile"
+      docker_build_args = { "CL_IS_PROD_BUILD" = "false" }
+      # 5002 is the web API capabilities port for incoming requests
+      # 15002 is the vault port for incoming requests
+      custom_ports = ["5002:5002", "15002:15002"]
+      # image = "chainlink-tmp:latest"
+      user_config_overrides = ""

core/scripts/cre/environment/environment/environment.go

@@ -330,8 +330,16 @@ func startCmd() *cobra.Command {
 			}
 
 			features := feature_set.New()
+			extraAllowedPorts := append([]int(nil), extraAllowedGatewayPorts...)
+			if in.Fake != nil {
+				extraAllowedPorts = append(extraAllowedPorts, in.Fake.Port)
+			}
+			if in.FakeHTTP != nil {
+				extraAllowedPorts = append(extraAllowedPorts, in.FakeHTTP.Port)
+			}
+
 			gatewayWhitelistConfig := gateway.WhitelistConfig{
-				ExtraAllowedPorts:   append(extraAllowedGatewayPorts, in.Fake.Port, in.FakeHTTP.Port),
+				ExtraAllowedPorts:   extraAllowedPorts,
 				ExtraAllowedIPsCIDR: []string{"0.0.0.0/0"},
 			}
 			output, startErr := StartCLIEnvironment(cmdContext, relativePathToRepoRoot, in, nil, features, nil, envDependencies, gatewayWhitelistConfig)

core/scripts/cre/environment/mock/trigger_types.go

@@ -5,9 +5,10 @@ import (
 	"time"
 
 	"github.com/google/uuid"
-	cron2 "github.com/smartcontractkit/cre-sdk-go/capabilities/scheduler/cron"
 	"google.golang.org/protobuf/types/known/anypb"
 
+	crontypedapi "github.com/smartcontractkit/chainlink-common/pkg/capabilities/v2/triggers/cron"
+
 	pb2 "github.com/smartcontractkit/chainlink/system-tests/lib/cre/mock/pb"
 )
 
@@ -24,7 +25,7 @@ func getTriggerRequest(triggerType TriggerType) (*pb2.SendTriggerEventRequest, e
 	switch triggerType {
 	case TriggerTypeCron:
 		// First create the payload
-		payload := &cron2.LegacyPayload{ //nolint:staticcheck // legacy
+		payload := &crontypedapi.LegacyPayload{ //nolint:staticcheck // legacy
 			ScheduledExecutionTime: time.Now().Format(time.RFC3339Nano),
 		}
 

core/scripts/go.mod

@@ -53,13 +53,12 @@ require (
 	github.com/smartcontractkit/chainlink-evm/gethwrappers v0.0.0-20260119171452-39c98c3b33cd
 	github.com/smartcontractkit/chainlink-protos/cre/go v0.0.0-20260326111235-8c09d1a4491f
 	github.com/smartcontractkit/chainlink-protos/job-distributor v0.18.0
-	github.com/smartcontractkit/chainlink-testing-framework/framework v0.15.8
+	github.com/smartcontractkit/chainlink-testing-framework/framework v0.15.9-0.20260330164022-15e89dd1431f
 	github.com/smartcontractkit/chainlink-testing-framework/framework/components/dockercompose v0.1.20
 	github.com/smartcontractkit/chainlink-testing-framework/lib v1.54.5
 	github.com/smartcontractkit/chainlink-testing-framework/seth v1.51.5
 	github.com/smartcontractkit/chainlink/core/scripts/cre/environment/examples/workflows/v2/proof-of-reserve/cron-based v0.0.0-00010101000000-000000000000
-	github.com/smartcontractkit/chainlink/system-tests/lib v0.0.0-20251020210257-0a6ec41648b4
-	github.com/smartcontractkit/cre-sdk-go/capabilities/scheduler/cron v1.3.0
+	github.com/smartcontractkit/chainlink/system-tests/lib v0.0.0-00010101000000-000000000000
 	github.com/smartcontractkit/libocr v0.0.0-20260304194147-a03701e2c02e
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -483,7 +482,7 @@ require (
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
 	github.com/smartcontractkit/ccip-contract-examples/chains/evm v0.0.0-20260129135848-c86808ba5cb9 // indirect
 	github.com/smartcontractkit/ccip-owner-contracts v0.1.0 // indirect
-	github.com/smartcontractkit/chainlink-aptos v0.0.0-20260318173523-755cafb24200 // indirect
+	github.com/smartcontractkit/chainlink-aptos v0.0.0-20260324144720-484863604698 // indirect
 	github.com/smartcontractkit/chainlink-ccip/ccv/chains/evm v0.0.0-20260323224438-d819cb3228e1 // indirect
 	github.com/smartcontractkit/chainlink-ccip/chains/evm/deployment v0.0.0-20260317185256-d5f7db87ae70 // indirect
 	github.com/smartcontractkit/chainlink-ccip/chains/solana v0.0.0-20260310183131-8d0f0e383288 // indirect
@@ -519,7 +518,6 @@ require (
 	github.com/smartcontractkit/chainlink-ton v0.0.0-20260331005855-7b5a4b3384f8 // indirect
 	github.com/smartcontractkit/chainlink-ton/deployment v0.0.0-20260326230916-bcfdbe85f221 // indirect
 	github.com/smartcontractkit/chainlink-tron/relayer v0.0.11-0.20260218133534-cbd44da2856b // indirect
-	github.com/smartcontractkit/cre-sdk-go v1.5.0 // indirect
 	github.com/smartcontractkit/freeport v0.1.3-0.20250828155247-add56fa28aad // indirect
 	github.com/smartcontractkit/grpc-proxy v0.0.0-20240830132753-a7e17fec5ab7 // indirect
 	github.com/smartcontractkit/mcms v0.38.2 // indirect

core/services/chainlink/config.go

@@ -417,6 +417,10 @@ func (s *Secrets) SetFrom(f *Secrets) (err error) {
 		err = errors.Join(err, commonconfig.NamedMultiErrorList(err2, "Solana"))
 	}
 
+	if err2 := s.Aptos.SetFrom(&f.Aptos); err2 != nil {
+		err = errors.Join(err, commonconfig.NamedMultiErrorList(err2, "Aptos"))
+	}
+
 	if err2 := s.DKGRecipientKey.SetFrom(&f.DKGRecipientKey); err2 != nil {
 		err = errors.Join(err, commonconfig.NamedMultiErrorList(err2, "DKGRecipientKey"))
 	}