hlmailbox package

Package hlmailbox is the gno.land end of the bridge's message layer (bridge/PLAN.md §5.1): realms send messages to other chains through it and take the messages other chains send them from it. Messages, ids and the merkle tree are Hyperlane's byte for byte (gno.land/p/…/hyperlane/v0), so the Solana side runs Hyperlane's own programs.

Out. Dispatch takes a message from the realm that calls it, numbers it, puts its id in the merkle tree, keeps the message, and emits the Dispatch event the Solana light client proves from LastResultsHash (§13: id, nonce, origin, destination, sender, recipient, hash). Reemit emits it again from a fresh block, by anyone.

In. A recipient realm pulls its own messages: it calls Process with the message and the verifier's metadata; Process checks the caller is the recipient, that the message is for this chain and was never delivered, marks it delivered, and only then asks the active verifier — a realm that registered itself here, chosen by GovDAO by pkgpath — whether the message is genuine; a verifier's error is a panic, so the transaction and the mark revert together and a refused message stays deliverable.

Who may change what. Nobody holds an admin key: every setting moves by a decision made with this realm's builders (gov.gno), at once or after 7 days (§5.3), and nothing but Launch and cancel before the one-shot Launch. Who decides is the governor's (M1k): the compiled launchGovernor alone, by its own call through Govern, until it yields (Yield, once, for every bridge realm at once), and GovDAO's proposals from then on — or from the first block, when no governor was compiled. The guardians and watch keys (flags.gno) can only pause: three flags per key per route — sends, credits, payouts — which the routes ask about with Paused. Every launch value is compiled in below and written by init.