Error upgrading parachain on Kusama: `parachainSystem.ProhibitedByPolkadot`

Question

As a sudo of a parachain on Kusama, I am making the first runtime upgrade.

Initially, I made the upgrade as a sudo unchecked weight and setCode without checks. The transaction looked successful it went "in block". But the the runtime didn't upgrade, and the spec version stayed the same.

Then I went the correct route creating an hash and going to parachainSystem -> AuthorizeUpgrade and then enactAuthorizeUpgrade, but I got this error: parachainSystem.ProhibitedByPolkadot...

sudo.Sudid
A sudo just took place. [result] 
sudoResult: Result<Null, SpRuntimeDispatchError>
Err
DispatchError
{
  Module: {
    index: 1
    error: 1
  }
}
type
parachainSystem.ProhibitedByPolkadot
details
Polkadot currently prohibits this parachain from upgrading its validation function

Are we blocked out for a period of time? How can we successfully make an upgrade?

Answer 1

The answer to this question is about how the relaychain and the parachain reach consensus as to the correct validation code that should be used.

The process is that when you first authorize the upgrade, what actually happens is that the collators include the hash in a block, and then pass the block to the relaychain validators to validate. Once they have validated it, the hash will be stored in the relaychain blockchain.

The impact of this is that you must wait to enact the upgrade on the parachain side. If you don't wait, then it is possible that the relaychain has not yet stored the new hash (i.e. it has not yet been stored in a block), and is therefore rejecting an attempt to replace the existing validation code, with a new one.

But that's not the end of the story.

Firstly anyone can enact the upgrade - you do not need the Sudo user to do that, so it can be done as soon as the relaychain is aware that a new validation code is coming, and as long as the sender sends the correct validation code, with the enactment transaction.

Secondly, you will have to wait one hour for the code to be enacted even after you send a successful transaction - this delay is set by the relaychain, so that the collators and relaychain are prepared to start using the new validation code at the same block/time.

One last point to make is that - at least on Polkadot - your parachain cannot be upgraded for a further 13800 blocks, approximately 23 hours. This is what is known as the upgrade cooldown period. Once that cooldown period is over, you can upgrade again, but you must follow this process again with all the same delays.