@aztec/aztec-node 5.0.0-private.20260319 → 5.0.0-rc.2

package/dest/sentinel/sentinel.js

@@ -1,12 +1,12 @@
-import { BlockNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { CheckpointProposalHash, EpochNumber, SlotNumber } from '@aztec/foundation/branded-types';
 import { countWhile, filterAsync, fromEntries, getEntries, mapValues } from '@aztec/foundation/collection';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/running-promise';
-import { L2TipsMemoryStore } from '@aztec/kv-store/stores';
-import { OffenseType, WANT_TO_SLASH_EVENT } from '@aztec/slasher';
-import { L2BlockStream, getAttestationInfoFromPublishedCheckpoint } from '@aztec/stdlib/block';
+import { OffenseType, WANT_TO_SLASH_EVENT, getOffenseTypeName } from '@aztec/slasher';
+import { getAttestationInfoFromPublishedCheckpoint } from '@aztec/stdlib/block';
 import { getEpochAtSlot, getSlotRangeForEpoch, getTimestampForSlot } from '@aztec/stdlib/epoch-helpers';
+import { ConsensusPayload } from '@aztec/stdlib/p2p';
 import EventEmitter from 'node:events';
 /** Maps a validator status to its category: proposer or attestation. */ function statusToCategory(status) {
     switch(status){
@@ -17,26 +17,98 @@ import EventEmitter from 'node:events';
             return 'proposer';
     }
 }
-export class Sentinel extends EventEmitter {
+/**
+ * The Sentinel observes validator behaviour every L2 slot, classifies it into a per-slot status,
+ * aggregates those statuses into per-epoch performance once each epoch is fully observed, and
+ * emits inactivity slash payloads when a validator has been inactive for the configured number
+ * of consecutive epochs.
+ *
+ * ## Two cadences
+ *
+ * The sentinel runs `work()` every quarter L2 slot and drives two independent pipelines:
+ *
+ * 1. **Per-slot activity recording.** `processSlot(currentSlot - 2)` runs once per slot, with a
+ *    two-slot lag to let P2P attestations settle and the archiver catch up. It classifies each
+ *    committee member's behaviour for that slot via `getSlotActivity` and persists the result to
+ *    `SentinelStore.historyMap` (sliding window of `sentinelHistoryLengthInEpochs * epochDuration`
+ *    slots, default 24 epochs).
+ *
+ * 2. **Per-epoch evaluation.** `processEpochEnds(currentSlot)` runs every tick too. Once
+ *    `sentinelEpochEndBufferSlots` (default 2) has elapsed past an epoch's last slot AND the
+ *    per-slot recorder has covered that last slot, the sentinel calls `handleEpochEnd(epoch)`.
+ *    That aggregates the slot-level statuses for the epoch into per-validator `{missed, total}`,
+ *    persists it to `SentinelStore.epochMap` (default 2000-epoch window), and runs the slashing
+ *    decision.
+ *
+ * Triggering per-epoch evaluation off local L2 state — rather than waiting for L1 proof
+ * publication — decouples slashing from prover availability.
+ *
+ * ## Six-case taxonomy in `getSlotActivity`
+ *
+ * For each slot, the sentinel assigns the proposer one of six statuses, ranked highest-confidence
+ * first:
+ *
+ *  - `checkpoint-mined`        — a checkpoint covering this slot has landed on L1
+ *                                (fetched on demand via `archiver.getCheckpoint({ slot })`).
+ *  - `checkpoint-valid`        — the local node re-executed a checkpoint proposal for this slot
+ *                                successfully (consulted via `CheckpointReexecutionTracker`).
+ *  - `checkpoint-invalid`      — the local node re-executed a checkpoint proposal for this slot
+ *                                and rejected it (e.g. header/archive/out-hash mismatch, limit
+ *                                breach). Proposer-fault.
+ *  - `checkpoint-unvalidated`  — the local node observed a checkpoint proposal but could not
+ *                                validate it (missing blocks/txs, timeouts). Treated as
+ *                                proposer-fault for slashing.
+ *  - `checkpoint-missed`       — block proposals seen on P2P but no checkpoint proposal at all.
+ *  - `blocks-missed`           — no block proposals seen for this slot.
+ *
+ * Missing-attestor faults are recorded only in `checkpoint-mined` and `checkpoint-valid`, where
+ * the local node has positive evidence the checkpoint was canonical or valid. In the other four
+ * cases the proposer is at fault and no attestor penalty applies.
+ *
+ * ## Re-execution tracker
+ *
+ * `CheckpointReexecutionTracker` is populated by the validator client's checkpoint proposal
+ * handler. Every early return in `validateCheckpointProposal` records an outcome
+ * (`valid` / `invalid` / `unvalidated`) keyed by slot.
+ *
+ * ## Inactivity slashing
+ *
+ * `handleEpochPerformance` filters the epoch's per-validator stats by
+ * `slashInactivityTargetPercentage` and then calls `checkPastInactivity` to require
+ * `slashInactivityConsecutiveEpochThreshold` consecutive past epochs over the same threshold
+ * (read from `SentinelStore.epochMap`). Only validators meeting both conditions are emitted as
+ * `WANT_TO_SLASH_EVENT` with `OffenseType.INACTIVITY`. The slot-level counters that feed this —
+ * `missedProposals` and `missedAttestations` — include the four proposer-fault statuses plus
+ * `attestation-missed`.
+ *
+ * ## Escape hatch
+ *
+ * If `epochCache.getCommittee(slot)` reports `isEscapeHatchOpen`, per-slot recording is skipped
+ * (no history entries for that slot) and per-epoch evaluation writes an empty performance map
+ * (no slashing).
+ */ export class Sentinel extends EventEmitter {
     epochCache;
     archiver;
     p2p;
     store;
+    reexecutionTracker;
     config;
     logger;
     runningPromise;
-    blockStream;
-    l2TipsStore;
     initialSlot;
     lastProcessedSlot;
-    // eslint-disable-next-line aztec-custom/no-non-primitive-in-collections
-    slotNumberToCheckpoint;
-    constructor(epochCache, archiver, p2p, store, config, logger = createLogger('node:sentinel')){
-        super(), this.epochCache = epochCache, this.archiver = archiver, this.p2p = p2p, this.store = store, this.config = config, this.logger = logger, this.slotNumberToCheckpoint = new Map();
-        this.l2TipsStore = new L2TipsMemoryStore();
+    /** Largest epoch number for which the end-of-epoch aggregator has run. */ lastEvaluatedEpoch;
+    constructor(epochCache, archiver, p2p, store, reexecutionTracker, config, logger = createLogger('node:sentinel')){
+        super(), this.epochCache = epochCache, this.archiver = archiver, this.p2p = p2p, this.store = store, this.reexecutionTracker = reexecutionTracker, this.config = config, this.logger = logger;
         const interval = epochCache.getL1Constants().ethereumSlotDuration * 1000 / 4;
         this.runningPromise = new RunningPromise(this.work.bind(this), logger, interval);
     }
+    getSignatureContext() {
+        return {
+            chainId: this.config.l1ChainId,
+            rollupAddress: this.config.rollupAddress
+        };
+    }
     updateConfig(config) {
         this.config = {
             ...this.config,
@@ -47,69 +119,65 @@ export class Sentinel extends EventEmitter {
         await this.init();
         this.runningPromise.start();
     }
-    /** Loads initial slot and initializes blockstream. We will not process anything at or before the initial slot. */ async init() {
-        this.initialSlot = this.epochCache.getSlotNow();
-        const startingBlock = BlockNumber(await this.archiver.getBlockNumber());
-        this.logger.info(`Starting validator sentinel with initial slot ${this.initialSlot} and block ${startingBlock}`);
-        this.blockStream = new L2BlockStream(this.archiver, this.l2TipsStore, this, this.logger, {
-            startingBlock
-        });
+    /**
+   * Loads the initial slot. We will not process anything at or before the initial slot. Floors at the
+   * archiver's synced L2 slot so the sentinel keeps making forward progress when L1 is advancing but L2 has no
+   * activity (the synced slot is driven by L1 sync, not by L2 blocks). Falls back to the wallclock if the
+   * archiver isn't ready yet (cold start).
+   */ async init() {
+        this.initialSlot = await this.getCurrentSlot();
+        this.logger.info(`Starting validator sentinel with initial slot ${this.initialSlot}`);
+    }
+    /**
+   * Returns the L2 slot the sentinel should treat as "current": the archiver's last fully
+   * synced L2 slot, falling back to the wallclock slot when the archiver isn't ready yet
+   * (cold start). Anchoring to the synced slot keeps timing arithmetic (initial floor,
+   * per-slot lag, end-of-epoch buffer, stats-range fallback) from speculating ahead of where
+   * L1 actually is.
+   */ async getCurrentSlot() {
+        return await this.archiver.getSyncedL2SlotNumber() ?? this.epochCache.getSlotNow();
     }
     stop() {
         return this.runningPromise.stop();
     }
-    async handleBlockStreamEvent(event) {
-        await this.l2TipsStore.handleBlockStreamEvent(event);
-        if (event.type === 'chain-checkpointed') {
-            this.handleCheckpoint(event);
-        } else if (event.type === 'chain-proven') {
-            await this.handleChainProven(event);
-        }
-    }
-    handleCheckpoint(event) {
-        if (event.type !== 'chain-checkpointed') {
-            return;
+    /**
+   * Fetches the L1-confirmed checkpoint covering a slot (if any) and derives the slot-level data the
+   * activity classifier needs: the checkpoint number, archive root, consensus payload hash (used to fetch
+   * matching p2p attestations regardless of feeAssetPriceModifier variants), and the recovered attestor set.
+   * Reads on demand so the result is always against the canonical chain — a reorged-out checkpoint simply
+   * stops being returned, with no stale mapping to clean up.
+   */ async getCheckpointForSlot(slot) {
+        const checkpoint = await this.archiver.getCheckpoint({
+            slot
+        });
+        if (!checkpoint) {
+            return undefined;
         }
-        const checkpoint = event.checkpoint;
-        // Store mapping from slot to archive, checkpoint number, and attestors
-        this.slotNumberToCheckpoint.set(checkpoint.checkpoint.header.slotNumber, {
+        const signatureContext = this.getSignatureContext();
+        const proposalPayloadHash = CheckpointProposalHash.fromBuffer(ConsensusPayload.fromCheckpoint(checkpoint.checkpoint, signatureContext).getPayloadHash());
+        return {
             checkpointNumber: checkpoint.checkpoint.number,
             archive: checkpoint.checkpoint.archive.root.toString(),
-            attestors: getAttestationInfoFromPublishedCheckpoint(checkpoint).filter((a)=>a.status === 'recovered-from-signature').map((a)=>a.address)
-        });
-        // Prune the archive map to only keep at most N entries
-        const historyLength = this.store.getHistoryLength();
-        if (this.slotNumberToCheckpoint.size > historyLength) {
-            const toDelete = Array.from(this.slotNumberToCheckpoint.keys()).sort((a, b)=>Number(a - b)).slice(0, this.slotNumberToCheckpoint.size - historyLength);
-            for (const key of toDelete){
-                this.slotNumberToCheckpoint.delete(key);
-            }
-        }
+            proposalPayloadHash,
+            attestors: getAttestationInfoFromPublishedCheckpoint(checkpoint, signatureContext).filter((a)=>a.status === 'recovered-from-signature').map((a)=>a.address)
+        };
     }
-    async handleChainProven(event) {
-        if (event.type !== 'chain-proven') {
-            return;
-        }
-        const blockNumber = event.block.number;
-        const header = await this.archiver.getBlockHeader(blockNumber);
-        if (!header) {
-            this.logger.error(`Failed to get block header ${blockNumber}`);
-            return;
-        }
-        // TODO(palla/slash): We should only be computing proven performance if this is
-        // a full proof epoch and not a partial one, otherwise we'll end up with skewed stats.
-        const epoch = getEpochAtSlot(header.getSlot(), this.epochCache.getL1Constants());
-        this.logger.debug(`Computing proven performance for epoch ${epoch}`);
-        const performance = await this.computeProvenPerformance(epoch);
-        this.logger.info(`Computed proven performance for epoch ${epoch}`, performance);
-        await this.store.updateProvenPerformance(epoch, performance);
-        await this.handleProvenPerformance(epoch, performance);
+    /**
+   * Called once per epoch, after the configured end-of-epoch buffer has elapsed beyond the
+   * epoch's last slot. Computes per-epoch performance from the slot-level history collected
+   * by `processSlot` and emits any inactivity slash payloads.
+   */ async handleEpochEnd(epoch) {
+        this.logger.debug(`Computing epoch performance for epoch ${epoch}`);
+        const performance = await this.computeEpochPerformance(epoch);
+        this.logger.info(`Computed epoch performance for epoch ${epoch}`, performance);
+        await this.store.updateEpochPerformance(epoch, performance);
+        await this.handleEpochPerformance(epoch, performance);
     }
-    async computeProvenPerformance(epoch) {
+    async computeEpochPerformance(epoch) {
         const [fromSlot, toSlot] = getSlotRangeForEpoch(epoch, this.epochCache.getL1Constants());
         const { committee, isEscapeHatchOpen } = await this.epochCache.getCommittee(fromSlot);
         if (isEscapeHatchOpen) {
-            this.logger.info(`Skipping proven performance for epoch ${epoch} - escape hatch is open`);
+            this.logger.info(`Skipping epoch performance for epoch ${epoch} - escape hatch is open`);
             return {};
         }
         if (!committee) {
@@ -147,8 +215,8 @@ export class Sentinel extends EventEmitter {
         if (requiredConsecutiveEpochs === 0) {
             return true;
         }
-        // Get all historical performance for this validator
-        const allPerformance = await this.store.getProvenPerformance(validator);
+        // Get all historical per-epoch performance for this validator
+        const allPerformance = await this.store.getEpochPerformance(validator);
         // Sort by epoch descending to get most recent first, keep only epochs strictly before the current one, and get the first N
         const pastEpochs = allPerformance.sort((a, b)=>Number(b.epoch - a.epoch)).filter((p)=>p.epoch < currentEpoch);
         // If we don't have enough historical data, don't slash
@@ -157,13 +225,10 @@ export class Sentinel extends EventEmitter {
             return false;
         }
         // Check that we have at least requiredConsecutiveEpochs and that all of them are above the inactivity threshold
-        return pastEpochs.slice(0, requiredConsecutiveEpochs).every((p)=>p.missed / p.total >= this.config.slashInactivityTargetPercentage);
+        return pastEpochs.slice(0, requiredConsecutiveEpochs).every((p)=>p.total === 0 ? false : p.missed / p.total >= this.config.slashInactivityTargetPercentage);
     }
-    async handleProvenPerformance(epoch, performance) {
-        if (this.config.slashInactivityPenalty === 0n) {
-            return;
-        }
-        const inactiveValidators = getEntries(performance).filter(([_, { missed, total }])=>missed / total >= this.config.slashInactivityTargetPercentage).map(([address])=>address);
+    async handleEpochPerformance(epoch, performance) {
+        const inactiveValidators = getEntries(performance).filter(([_, { missed, total }])=>total > 0 && missed / total >= this.config.slashInactivityTargetPercentage).map(([address])=>address);
         this.logger.debug(`Found ${inactiveValidators.length} inactive validators in epoch ${epoch}`, {
             inactiveValidators,
             epoch,
@@ -178,8 +243,13 @@ export class Sentinel extends EventEmitter {
                 epochOrSlot: BigInt(epoch)
             }));
         if (criminals.length > 0) {
-            this.logger.verbose(`Identified ${criminals.length} validators to slash due to inactivity in at least ${epochThreshold} consecutive epochs`, {
-                ...args,
+            this.logger.info(`Identified ${criminals.length} inactivity offenses in at least ${epochThreshold} consecutive epochs`, {
+                offenses: args.map((arg)=>({
+                        validator: arg.validator.toString(),
+                        amount: arg.amount,
+                        offenseType: getOffenseTypeName(arg.offenseType),
+                        epochOrSlot: arg.epochOrSlot
+                    })),
                 epochThreshold
             });
             this.emit(WANT_TO_SLASH_EVENT, args);
@@ -189,23 +259,58 @@ export class Sentinel extends EventEmitter {
    * Process data for two L2 slots ago.
    * Note that we do not process historical data, since we rely on p2p data for processing,
    * and we don't have that data if we were offline during the period.
+   *
+   * `currentSlot` is anchored to the archiver's last synced L2 slot rather than the wallclock,
+   * so the per-slot lag (`isReadyToProcess`) and the end-of-epoch buffer (`processEpochEnds`)
+   * advance with archiver.
    */ async work() {
-        const currentSlot = this.epochCache.getSlotNow();
+        const currentSlot = await this.getCurrentSlot();
         try {
-            // Manually sync the block stream to ensure we have the latest data.
-            // Note we never `start` the blockstream, so it loops at the same pace as we do.
-            await this.blockStream.sync();
-            // Check if we are ready to process data for two L2 slots ago.
+            // Per-slot activity recording (lag = 2 slots for P2P attestation settlement).
             const targetSlot = await this.isReadyToProcess(currentSlot);
-            // And process it if we are.
             if (targetSlot !== false) {
                 await this.processSlot(targetSlot);
             }
+            // End-of-epoch evaluation (lag = sentinelEpochEndBufferSlots beyond the epoch's last slot).
+            await this.processEpochEnds(currentSlot);
         } catch (err) {
             this.logger.error(`Failed to process slot ${currentSlot}`, err);
         }
     }
     /**
+   * After the configured buffer has elapsed past an epoch's last slot, runs the end-of-epoch
+   * aggregator for that epoch. Catches up if multiple epochs become eligible at once.
+   */ async processEpochEnds(currentSlot) {
+        const constants = this.epochCache.getL1Constants();
+        const buffer = this.config.sentinelEpochEndBufferSlots;
+        if (currentSlot < buffer) {
+            return;
+        }
+        if (this.initialSlot === undefined) {
+            return;
+        }
+        // We can close epoch E iff:
+        //  - the per-slot recorder has covered the epoch's last slot (lastProcessedSlot ≥ toSlot(E))
+        //  - the buffer has elapsed past the epoch's last slot (currentSlot − buffer ≥ toSlot(E))
+        //  - the epoch is not in the past relative to when the sentinel started (toSlot(E) > initialSlot)
+        if (this.lastProcessedSlot === undefined) {
+            return;
+        }
+        const slotForBuffer = SlotNumber(currentSlot - buffer);
+        // First eligible epoch to close is the one after lastEvaluatedEpoch, or the epoch containing
+        // the initial slot if we haven't evaluated any yet (the initialSlot epoch may be partial — we
+        // don't try to evaluate it, we start from initialSlot's epoch + 1).
+        const startEpoch = this.lastEvaluatedEpoch !== undefined ? EpochNumber(this.lastEvaluatedEpoch + 1) : EpochNumber(getEpochAtSlot(this.initialSlot, constants) + 1);
+        for(let epoch = startEpoch;; epoch = EpochNumber(epoch + 1)){
+            const [, toSlot] = getSlotRangeForEpoch(epoch, constants);
+            if (toSlot > this.lastProcessedSlot || toSlot > slotForBuffer) {
+                break;
+            }
+            await this.handleEpochEnd(epoch);
+            this.lastEvaluatedEpoch = epoch;
+        }
+    }
+    /**
    * Check if we are ready to process data for two L2 slots ago, so we allow plenty of time for p2p to process all in-flight attestations.
    * We also don't move past the archiver last synced L2 slot, as we don't want to process data that is not yet available.
    * Last, we check the p2p is synced with the archiver, so it has pulled all attestations from it.
@@ -237,7 +342,7 @@ export class Sentinel extends EventEmitter {
             });
             return false;
         }
-        const archiverLastBlockHash = await this.l2TipsStore.getL2Tips().then((tip)=>tip.proposed.hash);
+        const archiverLastBlockHash = await this.archiver.getL2Tips().then((tip)=>tip.proposed.hash);
         const p2pLastBlockHash = await this.p2p.getL2Tips().then((tips)=>tips.proposed.hash);
         const isP2pSynced = archiverLastBlockHash === p2pLastBlockHash;
         if (!isP2pSynced) {
@@ -271,39 +376,53 @@ export class Sentinel extends EventEmitter {
         await this.updateValidators(slot, stats);
         this.lastProcessedSlot = slot;
     }
-    /** Computes activity for a given slot. */ async getSlotActivity(slot, epoch, proposer, committee) {
+    /**
+   * Computes activity for a given slot using the six-case taxonomy.
+   *
+   * Proposer status:
+   *  - case 6 `checkpoint-mined`        — a checkpoint covering this slot has landed on L1.
+   *  - case 5 `checkpoint-valid`        — the local node re-executed a checkpoint proposal for this
+   *                                       slot successfully.
+   *  - case 4 `checkpoint-invalid`      — the local node re-executed a checkpoint proposal for this
+   *                                       slot and rejected it.
+   *  - case 3 `checkpoint-unvalidated`  — the local node observed a checkpoint proposal for this
+   *                                       slot but could not validate it (missing data, timeouts).
+   *  - case 2 `checkpoint-missed`       — block proposals seen on P2P but no checkpoint proposal.
+   *  - case 1 `blocks-missed`           — no block proposals seen for this slot.
+   *
+   * Missing-attestor penalties apply only in cases 5 and 6, where the local node has positive
+   * evidence the checkpoint was valid or has been canonicalised on L1.
+   */ async getSlotActivity(slot, epoch, proposer, committee) {
         this.logger.debug(`Computing stats for slot ${slot} at epoch ${epoch}`, {
             slot,
             epoch,
             proposer,
             committee
         });
-        // Check if there is an L2 block in L1 for this L2 slot
-        // Here we get all checkpoint attestations for the checkpoint at the given slot,
-        // or all checkpoint attestations for all proposals in the slot if no checkpoint was mined.
-        // We gather from both p2p (contains the ones seen on the p2p layer) and archiver
-        // (contains the ones synced from mined checkpoints, which we may have missed from p2p).
-        const checkpoint = this.slotNumberToCheckpoint.get(slot);
-        const p2pAttested = await this.p2p.getCheckpointAttestationsForSlot(slot, checkpoint?.archive);
-        // Filter out attestations with invalid signatures
+        // Gather attestors from both p2p (live attestations) and the archiver (signers on the
+        // checkpoint if one has landed on L1). Fetched on demand so it always reflects the canonical chain.
+        // Used regardless of which case applies.
+        const checkpoint = await this.getCheckpointForSlot(slot);
+        const p2pAttested = await this.p2p.getCheckpointAttestationsForSlot(slot, checkpoint?.proposalPayloadHash);
         const p2pAttestors = p2pAttested.map((a)=>a.getSender()).filter((s)=>s !== undefined);
         const attestors = new Set([
             ...p2pAttestors.map((a)=>a.toString()),
             ...checkpoint?.attestors.map((a)=>a.toString()) ?? []
         ].filter((addr)=>proposer.toString() !== addr));
-        // We assume that there was a block proposal if at least one of the validators (other than the proposer) attested to it.
-        // It could be the case that every single validator failed, and we could differentiate it by having
-        // this node re-execute every block proposal it sees and storing it in the attestation pool.
-        // But we'll leave that corner case out to reduce pressure on the node.
-        // TODO(palla/slash): This breaks if a given node has more than one validator in the current committee,
-        // since they will attest to their own proposal it even if it's not re-executable.
+        // Determine the proposer status from the six-case taxonomy.
+        const reexecutionOutcome = this.reexecutionTracker.getOutcomeForSlot(slot);
         let status;
         if (checkpoint) {
             status = 'checkpoint-mined';
-        } else if (attestors.size > 0) {
-            status = 'checkpoint-proposed';
+        } else if (reexecutionOutcome === 'valid') {
+            status = 'checkpoint-valid';
+        } else if (reexecutionOutcome === 'invalid') {
+            status = 'checkpoint-invalid';
+        } else if (reexecutionOutcome === 'unvalidated') {
+            status = 'checkpoint-unvalidated';
         } else {
-            // No checkpoint on L1 and no checkpoint attestations seen. Check if block proposals were sent for this slot.
+            // No L1 checkpoint, no local re-execution outcome for this slot. Distinguish "proposer
+            // sent block proposals but never made a checkpoint" from "proposer sent nothing".
             const hasBlockProposals = await this.p2p.hasBlockProposalsForSlot(slot);
             status = hasBlockProposals ? 'checkpoint-missed' : 'blocks-missed';
         }
@@ -311,8 +430,9 @@ export class Sentinel extends EventEmitter {
             ...checkpoint,
             slot
         });
-        // Get attestors that failed their checkpoint attestation duties, but only if there was a checkpoint proposed or mined
-        const missedAttestors = new Set(status === 'blocks-missed' || status === 'checkpoint-missed' ? [] : committee.filter((v)=>!attestors.has(v.toString()) && !proposer.equals(v)).map((v)=>v.toString()));
+        // Missing-attestor faults only apply when we have positive evidence the proposal was valid.
+        const attestorsExpected = status === 'checkpoint-mined' || status === 'checkpoint-valid';
+        const missedAttestors = new Set(attestorsExpected ? committee.filter((v)=>!attestors.has(v.toString()) && !proposer.equals(v)).map((v)=>v.toString()) : []);
         this.logger.debug(`Retrieved ${attestors.size} attestors out of ${committee.length} for slot ${slot}`, {
             status,
             proposer: proposer.toString(),
@@ -351,7 +471,7 @@ export class Sentinel extends EventEmitter {
                 v.toString(),
                 await this.store.getHistory(v)
             ]))) : await this.store.getHistories();
-        const slotNow = this.epochCache.getSlotNow();
+        const slotNow = await this.getCurrentSlot();
         fromSlot ??= SlotNumber(Math.max((this.lastProcessedSlot ?? slotNow) - this.store.getHistoryLength(), 0));
         toSlot ??= this.lastProcessedSlot ?? slotNow;
         const stats = mapValues(histories, (history, address)=>this.computeStatsForValidator(address, history ?? [], fromSlot, toSlot));
@@ -367,7 +487,7 @@ export class Sentinel extends EventEmitter {
         if (!history || history.length === 0) {
             return undefined;
         }
-        const slotNow = this.epochCache.getSlotNow();
+        const slotNow = await this.getCurrentSlot();
         const effectiveFromSlot = fromSlot ?? SlotNumber(Math.max((this.lastProcessedSlot ?? slotNow) - this.store.getHistoryLength(), 0));
         const effectiveToSlot = toSlot ?? this.lastProcessedSlot ?? slotNow;
         const historyLength = BigInt(this.store.getHistoryLength());
@@ -377,7 +497,7 @@ export class Sentinel extends EventEmitter {
         const validator = this.computeStatsForValidator(validatorAddress.toString(), history, effectiveFromSlot, effectiveToSlot);
         return {
             validator,
-            allTimeProvenPerformance: await this.store.getProvenPerformance(validatorAddress),
+            allTimeEpochPerformance: await this.store.getEpochPerformance(validatorAddress),
             lastProcessedSlot: this.lastProcessedSlot,
             initialSlot: this.initialSlot,
             slotWindow: this.store.getHistoryLength()
@@ -386,7 +506,7 @@ export class Sentinel extends EventEmitter {
     computeStatsForValidator(address, allHistory, fromSlot, toSlot) {
         let history = fromSlot ? allHistory.filter((h)=>BigInt(h.slot) >= fromSlot) : allHistory;
         history = toSlot ? history.filter((h)=>BigInt(h.slot) <= toSlot) : history;
-        const lastProposal = history.filter((h)=>h.status === 'checkpoint-proposed' || h.status === 'checkpoint-mined').at(-1);
+        const lastProposal = history.filter((h)=>h.status === 'checkpoint-valid' || h.status === 'checkpoint-mined').at(-1);
         const lastAttestation = history.filter((h)=>h.status === 'attestation-sent').at(-1);
         return {
             address: EthAddress.fromString(address),
@@ -395,7 +515,9 @@ export class Sentinel extends EventEmitter {
             totalSlots: history.length,
             missedProposals: this.computeMissed(history, 'proposer', [
                 'checkpoint-missed',
-                'blocks-missed'
+                'blocks-missed',
+                'checkpoint-invalid',
+                'checkpoint-unvalidated'
             ]),
             missedAttestations: this.computeMissed(history, 'attestation', [
                 'attestation-missed'

package/dest/sentinel/store.d.ts

@@ -5,22 +5,22 @@ import type { ValidatorStatusHistory, ValidatorStatusInSlot, ValidatorsEpochPerf
 export declare class SentinelStore {
     private store;
     private config;
-    static readonly SCHEMA_VERSION = 3;
+    static readonly SCHEMA_VERSION = 4;
     private readonly historyMap;
-    private readonly provenMap;
+    private readonly epochMap;
     constructor(store: AztecAsyncKVStore, config: {
         historyLength: number;
-        historicProvenPerformanceLength: number;
+        historicEpochPerformanceLength: number;
     });
     getHistoryLength(): number;
-    getHistoricProvenPerformanceLength(): number;
-    updateProvenPerformance(epoch: EpochNumber, performance: ValidatorsEpochPerformance): Promise<void>;
-    getProvenPerformance(who: EthAddress): Promise<{
+    getHistoricEpochPerformanceLength(): number;
+    updateEpochPerformance(epoch: EpochNumber, performance: ValidatorsEpochPerformance): Promise<void>;
+    getEpochPerformance(who: EthAddress): Promise<{
         missed: number;
         total: number;
         epoch: EpochNumber;
     }[]>;
-    private pushValidatorProvenPerformanceForEpoch;
+    private pushValidatorEpochPerformance;
     updateValidators(slot: SlotNumber, statuses: Record<`0x${string}`, ValidatorStatusInSlot | undefined>): Promise<void>;
     private pushValidatorStatusForSlot;
     getHistories(): Promise<Record<`0x${string}`, ValidatorStatusHistory>>;
@@ -32,4 +32,4 @@ export declare class SentinelStore {
     private statusToNumber;
     private statusFromNumber;
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmUuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZW50aW5lbC9zdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUUzRCxPQUFPLEtBQUssRUFBRSxpQkFBaUIsRUFBaUIsTUFBTSxpQkFBaUIsQ0FBQztBQUN4RSxPQUFPLEtBQUssRUFDVixzQkFBc0IsRUFDdEIscUJBQXFCLEVBQ3JCLDBCQUEwQixFQUMzQixNQUFNLDBCQUEwQixDQUFDO0FBRWxDLHFCQUFhLGFBQWE7SUFXdEIsT0FBTyxDQUFDLEtBQUs7SUFDYixPQUFPLENBQUMsTUFBTTtJQVhoQixnQkFBdUIsY0FBYyxLQUFLO0lBRzFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUF1QztJQUlsRSxPQUFPLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBdUM7SUFFakUsWUFDVSxLQUFLLEVBQUUsaUJBQWlCLEVBQ3hCLE1BQU0sRUFBRTtRQUFFLGFBQWEsRUFBRSxNQUFNLENBQUM7UUFBQywrQkFBK0IsRUFBRSxNQUFNLENBQUE7S0FBRSxFQUluRjtJQUVNLGdCQUFnQixXQUV0QjtJQUVNLGtDQUFrQyxXQUV4QztJQUVZLHVCQUF1QixDQUFDLEtBQUssRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLDBCQUEwQixpQkFNL0Y7SUFFWSxvQkFBb0IsQ0FBQyxHQUFHLEVBQUUsVUFBVSxHQUFHLE9BQU8sQ0FBQztRQUFFLE1BQU0sRUFBRSxNQUFNLENBQUM7UUFBQyxLQUFLLEVBQUUsTUFBTSxDQUFDO1FBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQTtLQUFFLEVBQUUsQ0FBQyxDQUduSDtZQUVhLHNDQUFzQztJQTZCdkMsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLEtBQUssTUFBTSxFQUFFLEVBQUUscUJBQXFCLEdBQUcsU0FBUyxDQUFDLGlCQVFqSDtZQUVhLDBCQUEwQjtJQVEzQixZQUFZLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLE1BQU0sRUFBRSxFQUFFLHNCQUFzQixDQUFDLENBQUMsQ0FNbEY7SUFFWSxVQUFVLENBQUMsT0FBTyxFQUFFLFVBQVUsR0FBRyxPQUFPLENBQUMsc0JBQXNCLEdBQUcsU0FBUyxDQUFDLENBR3hGO0lBRUQsT0FBTyxDQUFDLG9CQUFvQjtJQU01QixPQUFPLENBQUMsc0JBQXNCO0lBYTlCLE9BQU8sQ0FBQyxnQkFBZ0I7SUFNeEIsT0FBTyxDQUFDLGtCQUFrQjtJQVcxQixPQUFPLENBQUMsY0FBYztJQXFCdEIsT0FBTyxDQUFDLGdCQUFnQjtDQWtCekIifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3RvcmUuZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9zZW50aW5lbC9zdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLFVBQVUsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQzFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUUzRCxPQUFPLEtBQUssRUFBRSxpQkFBaUIsRUFBaUIsTUFBTSxpQkFBaUIsQ0FBQztBQUN4RSxPQUFPLEtBQUssRUFDVixzQkFBc0IsRUFDdEIscUJBQXFCLEVBQ3JCLDBCQUEwQixFQUMzQixNQUFNLDBCQUEwQixDQUFDO0FBRWxDLHFCQUFhLGFBQWE7SUFXdEIsT0FBTyxDQUFDLEtBQUs7SUFDYixPQUFPLENBQUMsTUFBTTtJQVhoQixnQkFBdUIsY0FBYyxLQUFLO0lBRzFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUF1QztJQUlsRSxPQUFPLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBdUM7SUFFaEUsWUFDVSxLQUFLLEVBQUUsaUJBQWlCLEVBQ3hCLE1BQU0sRUFBRTtRQUFFLGFBQWEsRUFBRSxNQUFNLENBQUM7UUFBQyw4QkFBOEIsRUFBRSxNQUFNLENBQUE7S0FBRSxFQUlsRjtJQUVNLGdCQUFnQixXQUV0QjtJQUVNLGlDQUFpQyxXQUV2QztJQUVZLHNCQUFzQixDQUFDLEtBQUssRUFBRSxXQUFXLEVBQUUsV0FBVyxFQUFFLDBCQUEwQixpQkFNOUY7SUFFWSxtQkFBbUIsQ0FBQyxHQUFHLEVBQUUsVUFBVSxHQUFHLE9BQU8sQ0FBQztRQUFFLE1BQU0sRUFBRSxNQUFNLENBQUM7UUFBQyxLQUFLLEVBQUUsTUFBTSxDQUFDO1FBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQTtLQUFFLEVBQUUsQ0FBQyxDQUdsSDtZQUVhLDZCQUE2QjtJQTZCOUIsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLEtBQUssTUFBTSxFQUFFLEVBQUUscUJBQXFCLEdBQUcsU0FBUyxDQUFDLGlCQVFqSDtZQUVhLDBCQUEwQjtJQVEzQixZQUFZLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLE1BQU0sRUFBRSxFQUFFLHNCQUFzQixDQUFDLENBQUMsQ0FNbEY7SUFFWSxVQUFVLENBQUMsT0FBTyxFQUFFLFVBQVUsR0FBRyxPQUFPLENBQUMsc0JBQXNCLEdBQUcsU0FBUyxDQUFDLENBR3hGO0lBRUQsT0FBTyxDQUFDLG9CQUFvQjtJQU01QixPQUFPLENBQUMsc0JBQXNCO0lBYTlCLE9BQU8sQ0FBQyxnQkFBZ0I7SUFNeEIsT0FBTyxDQUFDLGtCQUFrQjtJQVcxQixPQUFPLENBQUMsY0FBYztJQXlCdEIsT0FBTyxDQUFDLGdCQUFnQjtDQXNCekIifQ==

package/dest/sentinel/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sentinel/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAElC,qBAAa,aAAa;IAWtB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAXhB,gBAAuB,cAAc,KAAK;IAG1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAIlE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;IAEjE,YACU,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,+BAA+B,EAAE,MAAM,CAAA;KAAE,EAInF;IAEM,gBAAgB,WAEtB;IAEM,kCAAkC,WAExC;IAEY,uBAAuB,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,0BAA0B,iBAM/F;IAEY,oBAAoB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,WAAW,CAAA;KAAE,EAAE,CAAC,CAGnH;YAEa,sCAAsC;IA6BvC,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,MAAM,EAAE,EAAE,qBAAqB,GAAG,SAAS,CAAC,iBAQjH;YAEa,0BAA0B;IAQ3B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAMlF;IAEY,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAGxF;IAED,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,sBAAsB;IAa9B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,gBAAgB;CAkBzB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sentinel/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAiB,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EACV,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAElC,qBAAa,aAAa;IAWtB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,MAAM;IAXhB,gBAAuB,cAAc,KAAK;IAG1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAIlE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAEhE,YACU,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,8BAA8B,EAAE,MAAM,CAAA;KAAE,EAIlF;IAEM,gBAAgB,WAEtB;IAEM,iCAAiC,WAEvC;IAEY,sBAAsB,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,0BAA0B,iBAM9F;IAEY,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,WAAW,CAAA;KAAE,EAAE,CAAC,CAGlH;YAEa,6BAA6B;IA6B9B,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,MAAM,EAAE,EAAE,qBAAqB,GAAG,SAAS,CAAC,iBAQjH;YAEa,0BAA0B;IAQ3B,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAMlF;IAEY,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAGxF;IAED,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,sBAAsB;IAa9B,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,cAAc;IAyBtB,OAAO,CAAC,gBAAgB;CAsBzB"}