feat(protocol_feature): ASSERT_RECOVER_KEY_ACCOUNT builtin (id=24)

Adds new builtin protocol feature that whitelists assert_recover_key_account
intrinsic on activation. Required for existing chains (testnet/mainnet) where
this intrinsic is not in whitelisted_intrinsics state — they cannot accept
WASM that imports env.assert_recover_key_account until the feature is
preactivated + activated via eosio::activate.

on_activation handler is idempotent: на свежем genesis intrinsic уже
добавлен через genesis_intrinsics, на действующих цепочках добавляется
здесь.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

libraries/chain/controller.cpp

@@ -3869,6 +3869,17 @@ void controller_impl::on_activation<builtin_protocol_feature_t::bls_primitives>(
    } );
 }
 
+template<>
+void controller_impl::on_activation<builtin_protocol_feature_t::assert_recover_key_account>() {
+   db.modify( db.get<protocol_state_object>(), [&]( auto& ps ) {
+      // idempotent: на свежем genesis intrinsic уже в whitelist через genesis_intrinsics,
+      // на существующих цепочках добавляем здесь при активации фичи.
+      if( !is_intrinsic_whitelisted( ps.whitelisted_intrinsics, "assert_recover_key_account" ) ) {
+         add_intrinsic_to_whitelist( ps.whitelisted_intrinsics, "assert_recover_key_account" );
+      }
+   } );
+}
+
 template<>
 void controller_impl::on_activation<builtin_protocol_feature_t::disable_deferred_trxs_stage_2>() {
    const auto& idx = db.get_index<generated_transaction_multi_index, by_trx_id>();

libraries/chain/include/eosio/chain/protocol_feature_manager.hpp

@@ -38,6 +38,7 @@ enum class builtin_protocol_feature_t : uint32_t {
    bls_primitives = 21,
    disable_deferred_trxs_stage_1 = 22,
    disable_deferred_trxs_stage_2 = 23,
+   assert_recover_key_account = 24,
    reserved_private_fork_protocol_features = 500000,
 };
 

libraries/chain/protocol_feature_manager.cpp

@@ -308,6 +308,20 @@ retires a deferred transaction is invalid.
 */
             {builtin_protocol_feature_t::disable_deferred_trxs_stage_1}
          } )
+         (  builtin_protocol_feature_t::assert_recover_key_account, builtin_protocol_feature_spec{
+            "ASSERT_RECOVER_KEY_ACCOUNT",
+            fc::variant("2ad6b7aabba8edbc87b46f3340df4d0db0e4b65474db3e1cd5db33fb685a506b").as<digest_type>(),
+            // SHA256 hash of the raw message below within the comment delimiters (do not modify message below).
+/*
+Builtin protocol feature: ASSERT_RECOVER_KEY_ACCOUNT
+
+Adds new cryptographic host function assert_recover_key_account which verifies
+that a signature over a given digest was produced by a key currently bound to
+a specific permission of an account on chain. Allows smart contracts to verify
+signatures against on-chain account authorities, not only raw public keys.
+*/
+            {}
+         } )
    ;