Whitelist `System.authorizeUpgrade` for Nexus runtime v7000

Summary

Whitelist the authorize_upgrade preimage on the Nexus runtime so it can be dispatched via the Whitelisted Caller track, applying runtime upgrade nexus-v7000.

Whitelist call

Preimage (encoded System.authorizeUpgrade): 0x000946a0b6173cb02e48236a0d20ab03ecceec6e25414b4f168a4e5da5d49eb2f84f
Preimage call hash (keccak-256, value passed to Whitelist.whitelist_call): 0x5fe7ee1d534554fc63e56ad5490c9ae8696265d932896651c387a8ad7a798b38
Decoded call: System.authorizeUpgrade(codeHash = 0x46a0b6173cb02e48236a0d20ab03ecceec6e25414b4f168a4e5da5d49eb2f84f)

Runtime info

Release: nexus-v7000 (published 2026-05-20)
Spec: nexus-7000 (nexus-0.tx1.au1), Metadata V14
WASM: nexus_runtime-v7000.compact.compressed.wasm — 2,008,082 bytes (1.92 MiB)
WASM Keccak-256: 0x46a0b6173cb02e48236a0d20ab03ecceec6e25414b4f168a4e5da5d49eb2f84f
Toolchain: rustc 1.91.1 (ed61e7d7e 2025-11-07)

Changes in this release (31 PRs)

#834 Fix ABI encoding/decoding in pallet-bandwidth
#835 Remove token gateway pallets
#836 Introduce pallet-beefy-consensus proofs to Nexus runtime
#840 Switch to abi.encode and remove PostResponse
#841 Authenticate proofs with request source & dest in pallet-state-coprocessor
#842 Read timestamp from digest
#843 Multiple requests in batch must share a single delivery address
#845 Fix supermajority checks in consensus clients
#846 All ISMP handlers dedup messages at runtime
#849 Enforce epoch state proof on every verifier state update
#850 Subtract from bonded ledger in collator-manager
#851 Redesign EvmHost dispatch fees
#853 Dedup commitments in accumulate_fees
#855 Bind terminal leaf to queried key's path in Pharos non-existence proofs
#856 Implement verify_non_membership on IsmpStateMachineClient
#859 Nexus migration — bump ISMP child trie prefix
#860 Charge BandwidthGate by ABI-encoded request/response size
#861 Fix ABI encoding mismatch
#863 Store SP1 vkey as H256 instead of ASCII hex Vec
#868 Compare header hashes in fraud proof
#869 Fix accumulate_fees regression
#872 Tighten fee refund execution
#874 Verify proof values count matches supplied keys
#875 Tighten GRANDPA fraud proof predicate
#878 Tighten BEEFY participation threshold to named authority set
#881 Bind source chain to relayer redirect signature
#884 pallet-hyperfungible-token improvements
#885 Tighten input checks in call decompressor
#886 StateMachineClient::verify_state_proof now takes H256 trie root
#891 Fix consensus verifier panics
#893 Bump Nexus runtime spec

Motivation

Major maintenance and security hardening release. Key highlights: tightened BEEFY/GRANDPA fraud proof predicates, fee deduplication and refund correctness fixes, ABI encoding alignment across Rust/Solidity, proof authentication enforcement, ISMP child trie migration, and a batch of consensus verifier correctness fixes.

Reproducibility

git checkout nexus-v7000
./scripts/build_release_runtime.sh nexus-runtime
# verify keccak-256 of the produced .compact.compressed.wasm matches
# 0x46a0b6173cb02e48236a0d20ab03ecceec6e25414b4f168a4e5da5d49eb2f84f

Enactment plan

Submit this preimage and Whitelist.whitelist_call(0x5fe7ee1d…98b38) via the Fellowship / Whitelisted Caller track.
Once whitelisted, dispatch the preimage via the companion referendum below.
Submit System.applyAuthorizedUpgrade(code) with the released WASM blob to enact.