@aztec/sequencer-client 0.0.1-commit.b9865e97 → 0.0.1-commit.be03c316

package/src/publisher/write_json.ts

@@ -0,0 +1,78 @@
+import { AztecAddress } from '@aztec/aztec.js/addresses';
+import { Fr } from '@aztec/aztec.js/fields';
+import { BatchedBlob, Blob, getEthBlobEvaluationInputs, getPrefixedEthBlobCommitments } from '@aztec/blob-lib';
+import { EthAddress } from '@aztec/foundation/eth-address';
+import { L2Block } from '@aztec/stdlib/block';
+import { CheckpointHeader } from '@aztec/stdlib/rollup';
+
+import { writeFile } from 'fs/promises';
+
+const AZTEC_GENERATE_TEST_DATA = !!process.env.AZTEC_GENERATE_TEST_DATA;
+
+/**
+ * Creates a json object that can be used to test the solidity contract.
+ * The json object must be put into
+ */
+export async function writeJson(
+  fileName: string,
+  checkpointHeader: CheckpointHeader,
+  block: L2Block,
+  l1ToL2Content: Fr[],
+  blobs: Blob[],
+  batchedBlob: BatchedBlob,
+  recipientAddress: AztecAddress,
+  deployerAddress: `0x${string}`,
+): Promise<void> {
+  if (!AZTEC_GENERATE_TEST_DATA) {
+    return;
+  }
+  // Path relative to the package.json in the end-to-end folder
+  const path = `../../l1-contracts/test/fixtures/${fileName}.json`;
+
+  const asHex = (value: Fr | Buffer | EthAddress | AztecAddress, size = 64) => {
+    const buffer = Buffer.isBuffer(value) ? value : value.toBuffer();
+    return `0x${buffer.toString('hex').padStart(size, '0')}`;
+  };
+
+  const jsonObject = {
+    populate: {
+      l1ToL2Content: l1ToL2Content.map(value => asHex(value)),
+      recipient: asHex(recipientAddress.toField()),
+      sender: deployerAddress,
+    },
+    messages: {
+      l2ToL1Messages: block.body.txEffects.flatMap(txEffect => txEffect.l2ToL1Msgs).map(value => asHex(value)),
+    },
+    checkpoint: {
+      // The json formatting in forge is a bit brittle, so we convert Fr to a number in the few values below.
+      // This should not be a problem for testing as long as the values are not larger than u32.
+      archive: asHex(block.archive.root),
+      blobCommitments: getPrefixedEthBlobCommitments(blobs),
+      batchedBlobInputs: getEthBlobEvaluationInputs(batchedBlob),
+      checkpointNumber: block.number,
+      body: `0x${block.body.toBuffer().toString('hex')}`,
+      header: {
+        lastArchiveRoot: asHex(checkpointHeader.lastArchiveRoot),
+        blockHeadersHash: asHex(checkpointHeader.blockHeadersHash),
+        blobsHash: asHex(checkpointHeader.blobsHash),
+        inHash: asHex(checkpointHeader.inHash),
+        outHash: asHex(checkpointHeader.epochOutHash),
+        slotNumber: Number(checkpointHeader.slotNumber),
+        timestamp: Number(checkpointHeader.timestamp),
+        coinbase: asHex(checkpointHeader.coinbase, 40),
+        feeRecipient: asHex(checkpointHeader.feeRecipient),
+        gasFees: {
+          feePerDaGas: Number(checkpointHeader.gasFees.feePerDaGas),
+          feePerL2Gas: Number(checkpointHeader.gasFees.feePerL2Gas),
+        },
+        totalManaUsed: checkpointHeader.totalManaUsed.toNumber(),
+        accumulatedFees: checkpointHeader.accumulatedFees.toNumber(),
+      },
+      headerHash: asHex(checkpointHeader.hash()),
+      numTxs: block.body.txEffects.length,
+    },
+  };
+
+  const output = JSON.stringify(jsonObject, null, 2);
+  await writeFile(path, output, 'utf8');
+}

package/src/sequencer/automine/README.md

@@ -19,11 +19,11 @@ Compared to the production `Sequencer`:
 - No validator orchestration, attestation collection, or P2P proposal gossip.
 - No slashing, no governance votes, no `SequencerEvents`.
 
-Consumers (archiver, world-state, `EpochTestSettler`) observe L1 and the archiver tip directly rather than listening for sequencer events.
+Consumers (archiver, world-state) observe L1 and the archiver tip directly rather than listening for sequencer events.
 
 ## Serial-queue invariant
 
-Every operation — mempool-driven block builds, explicit empty-block builds, time warps, and reorgs — is serialized through a single `SerialQueue`. They never interleave.
+Every operation — mempool-driven block builds, explicit empty-block builds, time warps, reorgs, and synthetic epoch proving — is serialized through a single `SerialQueue`. They never interleave.
 
 Public entry points:
 
@@ -32,15 +32,29 @@ Public entry points:
 | `buildIfPending()` | Enqueues a mempool-driven build. Coalesces bursts into one job. |
 | `buildEmptyBlock()` | Enqueues a forced empty-block build. |
 | `warpTo(ts)` / `warpBy(delta)` | Advances L1 time to a slot boundary. |
+| `prove(upToCheckpoint?)` | Synthetically proves epochs up to a checkpoint (default: the latest checkpointed): writes the epoch out hashes into the L1 Outbox so L2-to-L1 messages become consumable, then advances the proven tip. No real proof. Clamps to the checkpointed tip and no-ops when already proven. |
 | `revertToCheckpoint(n)` | Rolls L1 back to the block that published checkpoint `n`, then resets archiver, world-state, and P2P pool. |
 | `syncPoint()` | Awaits the queue reaching idle. |
 
+## Time control
+
+The AutomineSequencer owns L1 time in the local network (replacing the deleted `AnvilTestWatcher`). It builds and publishes each checkpoint at the next aztec-slot boundary, and `warpTo` / `warpBy` advance the clock by publishing an empty checkpoint at the target slot. Before every build, warp, and prove it reconciles the injected `TestDateProvider` to the latest *mined* L1 timestamp, so node-side consumers of `dateProvider.now()` stay aligned with L1 even when an unrelated L1 tx mines a block between our builds. It never advances the clock to the pending, un-mined timestamp.
+
+## Publish-failure recovery
+
+A failed propose mines no checkpoint on L1 (it reverts inside the multicall or is never sent), so recovery is purely local — there is **no L1 reorg**. The optimistic archiver insert (the proposed block plus its proposed checkpoint) is rolled back via `archiver.removeUncheckpointedBlocksAfter`, which removes the uncheckpointed block and evicts the proposed checkpoint that referenced it. `p2pClient.sync()` then observes the lowered proposed tip and returns the block's txs to the pending pool, `worldState.syncImmediate()` drops any applied effects, and the L1 nonce is reset. The build is not retried inline; the mempool poller re-enqueues one once the txs are back in the pool.
+
 ## Entry points
 
 **Factory** — `createAutomineSequencer` in `automine_factory.ts` wires up all dependencies (publisher manager, keystore, cheat codes, etc.), starts the `PublisherManager`, and returns an unstarted `AutomineSequencer`. The caller (`AztecNodeService.createAndSync` in `aztec-node/src/aztec-node/server.ts`) invokes `AutomineSequencer.start()` separately. It is called by the full node when `aztecTargetCommitteeSize == 0`.
 
 **Test fixture** — `AUTOMINE_E2E_OPTS` in `end-to-end/src/fixtures/fixtures.ts` is the test-side entry point. Pass it to `setup()` to get a node + `AutomineSequencer` instead of the production sequencer stack.
 
-## Epoch proving caveat
+## Epoch proving
+
+There is no real prover in the automine setup, so epochs are settled synthetically: the epoch out hash is written into the L1 Outbox via cheat codes and the rollup's proven tip is advanced — the local-network equivalent of an epoch proof landing on L1. The grouping/out-hash logic lives in the shared `settleEpochOutbox` helper in `@aztec/prover-client/test`, used by both proving drivers below.
+
+Who drives proving depends on the `automineEnableProveEpoch` config flag:
 
-Epoch proving remains manual under `AUTOMINE_E2E_OPTS`. The e2e `setup()` fixture does NOT wire an `EpochTestSettler` — that observer is only attached in `local-network.ts`. Tests that cross epoch boundaries must therefore advance the proven anchor explicitly via `cheatCodes.rollup.markAsProven(...)`. See `e2e_lending_contract.test.ts` (which calls `progressSlots` in `simulators/lending_simulator.ts`) and `e2e_pruned_blocks.test.ts` for real examples.
+- **Local network / sandbox** (`automineEnableProveEpoch: true`): the AutomineSequencer runs an auto-prove loop that calls `prove()` as checkpoints land, through the same serial queue as its builds. This replaces the standalone `EpochTestSettler`, which used to race the build loop. The loop also reconciles the clock on each tick.
+- **e2e tests** (`AUTOMINE_E2E_OPTS`, flag off): proving is manual so tests stay deterministic. Cross-epoch tests advance the proven anchor explicitly via `node.prove(...)`, `cheatCodes.rollup.markAsProven(...)`, or a hand-driven `EpochTestSettler`. See `e2e_pruned_blocks.test.ts` and `e2e_epochs/epochs_partial_proof_multi_root.test.ts` for real examples.

package/src/sequencer/automine/automine_factory.ts

@@ -40,9 +40,14 @@ export type CreateAutomineSequencerArgs = {
   worldStateSynchronizer: WorldStateSynchronizer;
   archiver: L2BlockSource &
     L1ToL2MessageSource &
-    Pick<Archiver, 'rollbackTo' | 'addBlock' | 'addProposedCheckpoint' | 'syncImmediate'>;
+    Pick<
+      Archiver,
+      'rollbackTo' | 'addBlock' | 'addProposedCheckpoint' | 'syncImmediate' | 'removeUncheckpointedBlocksAfter'
+    >;
   p2pClient: P2P & Pick<ConcreteP2PClient, 'sync'>;
   l1Constants: { l1GenesisTime: bigint; slotDuration: number; ethereumSlotDuration: number; rollupManaLimit: number };
+  /** When true, run the auto-settle / clock-reconcile loop (local-network only). */
+  autoSettle?: boolean;
   log: Logger;
 };
 
@@ -71,6 +76,7 @@ export async function createAutomineSequencer({
   archiver,
   p2pClient,
   l1Constants,
+  autoSettle,
   log,
 }: CreateAutomineSequencerArgs): Promise<AutomineSequencer> {
   const publisherManager = new PublisherManager(l1TxUtils, getPublisherConfigFromSequencerConfig(config), {
@@ -136,6 +142,7 @@ export async function createAutomineSequencer({
     config,
     archiver,
     l1TxUtils: reorgResetL1TxUtils,
+    autoSettle,
     stopExtras: () => publisherManager.stop(),
     log: log.createChild('automine-sequencer'),
   });

package/src/sequencer/automine/automine_sequencer.ts

@@ -1,7 +1,7 @@
 import type { Archiver } from '@aztec/archiver';
 import type { L1TxUtils } from '@aztec/ethereum/l1-tx-utils';
-import type { EthCheatCodes } from '@aztec/ethereum/test';
-import { BlockNumber, CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { type EthCheatCodes, RollupCheatCodes } from '@aztec/ethereum/test';
+import { BlockNumber, CheckpointNumber, EpochNumber, SlotNumber } from '@aztec/foundation/branded-types';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import { Signature } from '@aztec/foundation/eth-signature';
 import { type Logger, createLogger } from '@aztec/foundation/log';
@@ -10,6 +10,7 @@ import { RunningPromise } from '@aztec/foundation/running-promise';
 import type { TestDateProvider } from '@aztec/foundation/timer';
 import { isErrorClass } from '@aztec/foundation/types';
 import type { P2PClient as ConcreteP2PClient, P2P } from '@aztec/p2p';
+import { settleEpochOutbox } from '@aztec/prover-client/test';
 import type { AztecAddress } from '@aztec/stdlib/aztec-address';
 import { CommitteeAttestationsAndSigners, type L2Block, type L2BlockSource } from '@aztec/stdlib/block';
 import { getPreviousCheckpointOutHashes } from '@aztec/stdlib/checkpoint';
@@ -65,7 +66,10 @@ export type AutomineSequencerDeps = {
    * Archiver used to push locally-built blocks and proposed checkpoints into the in-memory
    * store, force an immediate L1 sync after publishing, and roll back state during reorgs.
    */
-  archiver: Pick<Archiver, 'rollbackTo' | 'addBlock' | 'addProposedCheckpoint' | 'syncImmediate'>;
+  archiver: Pick<
+    Archiver,
+    'rollbackTo' | 'addBlock' | 'addProposedCheckpoint' | 'syncImmediate' | 'removeUncheckpointedBlocksAfter'
+  >;
   /** L1 tx utils whose cached nonces must be reset after an L1 reorg. */
   l1TxUtils: Pick<L1TxUtils, 'resetNonce'>[];
   /**
@@ -75,6 +79,14 @@ export type AutomineSequencerDeps = {
   stopExtras?: () => Promise<void>;
   /** How often to poll the mempool for new txs while running. Defaults to 50ms. */
   pollIntervalMs?: number;
+  /**
+   * When true, run a loop that synthetically settles epochs (writes outbox roots and advances the
+   * proven tip) as checkpoints land, replacing the standalone `EpochTestSettler`. Local-network only;
+   * e2e tests leave this off and drive proving explicitly.
+   */
+  autoSettle?: boolean;
+  /** How often the auto-settle / clock-reconcile loop runs while {@link autoSettle} is enabled. Defaults to 200ms. */
+  settlePollIntervalMs?: number;
   log?: Logger;
 };
 
@@ -106,6 +118,8 @@ export class AutomineSequencer {
   private stopped = false;
   private paused = false;
   private mempoolPoller?: RunningPromise;
+  /** Loop that settles epochs and reconciles the clock while {@link AutomineSequencerDeps.autoSettle} is set. */
+  private settler?: RunningPromise;
   private publisher?: SequencerPublisher;
   private attestorAddress?: EthAddress;
 
@@ -115,6 +129,9 @@ export class AutomineSequencer {
   /** Last L2 slot we published a checkpoint for (-1 means none yet). */
   private lastBuiltSlot: number = -1;
 
+  /** Lazily-built cheat codes for synthetic epoch settlement (outbox roots + proven tip). */
+  private rollupCheatCodes?: RollupCheatCodes;
+
   constructor(deps: AutomineSequencerDeps) {
     this.deps = deps;
     this.log = deps.log ?? createLogger('sequencer:automine');
@@ -122,6 +139,14 @@ export class AutomineSequencer {
     this.pollIntervalMs = deps.pollIntervalMs ?? 50;
   }
 
+  /** Cheat codes for the rollup, built from the same EthCheatCodes the sequencer uses for time control. */
+  private getRollupCheatCodes(): RollupCheatCodes {
+    this.rollupCheatCodes ??= new RollupCheatCodes(this.deps.ethCheatCodes, {
+      rollupAddress: this.deps.config.rollupAddress,
+    });
+    return this.rollupCheatCodes;
+  }
+
   /**
    * Starts the sequencer. Switches anvil into automine mode (no interval mining),
    * acquires a publisher, and begins polling the mempool for pending txs.
@@ -149,6 +174,13 @@ export class AutomineSequencer {
     // notification. Tests can also call `buildIfPending()` directly to skip the poll wait.
     this.mempoolPoller = new RunningPromise(() => this.maybeEnqueueBuild(), this.log, this.pollIntervalMs);
     this.mempoolPoller.start();
+
+    // Local-network only: settle epochs and reconcile the clock to L1 as checkpoints land. Both run
+    // through the same serial queue as builds/warps, so they never interleave with a checkpoint build.
+    if (this.deps.autoSettle) {
+      this.settler = new RunningPromise(() => this.maybeSettle(), this.log, this.deps.settlePollIntervalMs ?? 200);
+      this.settler.start();
+    }
   }
 
   /**
@@ -163,6 +195,7 @@ export class AutomineSequencer {
     this.stopped = true;
     this.running = false;
     await this.mempoolPoller?.stop();
+    await this.settler?.stop();
     await this.queue.end();
     await this.deps.stopExtras?.();
     this.log.info('AutomineSequencer stopped');
@@ -241,14 +274,22 @@ export class AutomineSequencer {
   /**
    * Warps L1 timestamp to `targetTimestampSec`. Rounded up to the next aztec-slot
    * boundary so the next build lands on a fresh slot. Atomic with respect to builds —
-   * the queue ensures no build is in flight while the warp executes.
+   * the queue ensures no build is in flight while the warp executes. A no-op when the
+   * target is already at or behind the current L1 time (see {@link runWarp}).
    */
   public warpTo(targetTimestampSec: number): Promise<void> {
     return this.queue.put(() => this.runWarp(targetTimestampSec));
   }
 
-  /** Warps L1 timestamp forward by `deltaSec` seconds from the current L1 time. */
+  /**
+   * Warps L1 timestamp forward by `deltaSec` seconds from the current L1 time, rounded up to the next
+   * aztec-slot boundary. Throws if `deltaSec` is not positive (warping "by" a non-positive amount is a
+   * caller bug — unlike {@link warpTo}, which no-ops on a past target).
+   */
   public warpBy(deltaSec: number): Promise<void> {
+    if (deltaSec <= 0) {
+      throw new Error(`warpL2TimeAtLeastBy: duration must be positive, got ${deltaSec} seconds.`);
+    }
     return this.queue.put(async () => {
       const current = await this.deps.ethCheatCodes.lastBlockTimestamp();
       await this.runWarp(current + deltaSec);
@@ -271,14 +312,57 @@ export class AutomineSequencer {
     return this.queue.syncPoint();
   }
 
+  /**
+   * Synthetically "proves" the L2 chain up to `upToCheckpoint` (default: the latest checkpointed
+   * checkpoint). For every epoch newly covered — including a partial final epoch — the epoch out hash
+   * is written into the L1 Outbox so the L2-to-L1 messages in those checkpoints become consumable,
+   * then the rollup's proven tip is advanced to the target. There is no real proof; this is the
+   * local-network equivalent of an epoch proof landing on L1.
+   *
+   * Clamps the target down to the latest checkpointed checkpoint and no-ops when it is already proven.
+   * Runs inside the serial queue so it never interleaves with a build or warp.
+   *
+   * @returns The proven checkpoint after the call (the target, or the existing proven tip on no-op).
+   */
+  public prove(upToCheckpoint?: CheckpointNumber): Promise<CheckpointNumber> {
+    return this.queue.put(() => this.runProve(upToCheckpoint));
+  }
+
+  /**
+   * Auto-settle tick (local-network only). Proving up to the latest checkpointed checkpoint also
+   * reconciles the clock at the head of {@link runProve}, so this single tick keeps both the
+   * proven tip and the date provider current even when no build is happening.
+   */
+  private async maybeSettle(): Promise<void> {
+    if (!this.running) {
+      return;
+    }
+    try {
+      await this.prove();
+    } catch (err) {
+      this.log.warn('Automine auto-settle tick failed', { err: err instanceof Error ? err.message : String(err) });
+    }
+  }
+
+  /**
+   * Advances the injected date provider to the latest *mined* L1 timestamp when it has fallen behind
+   * (e.g. an unrelated L1 tx mined a block between our builds). Never advances to the pending, un-mined
+   * timestamp. Keeps node-side consumers of `dateProvider.now()` aligned with L1 without our own builds.
+   */
+  private async reconcileDateProvider(): Promise<void> {
+    const lastTsMs = (await this.deps.ethCheatCodes.lastBlockTimestamp()) * 1000;
+    if (lastTsMs > this.deps.dateProvider.now()) {
+      this.deps.dateProvider.setTime(lastTsMs);
+    }
+  }
+
   /** Called from the mempool poller. Enqueues a build if there are pending txs. */
   private async maybeEnqueueBuild(): Promise<void> {
     if (!this.running || this.paused || this.buildQueued) {
       return;
     }
     try {
-      const pending = await this.deps.p2pClient.getPendingTxCount();
-      if (pending > 0) {
+      if (await this.deps.p2pClient.hasEligiblePendingTxs(1)) {
         // Fire-and-forget; the build result is delivered via `buildIfPending()` callers,
         // not via the poller.
         void this.buildIfPending().catch(err => {
@@ -290,19 +374,27 @@ export class AutomineSequencer {
     }
   }
 
-  /** Builds one checkpoint with a single block, publishes it, syncs the date provider. */
+  /**
+   * Builds and publishes one checkpoint, returning the built block — or `undefined` when there was
+   * nothing to build or the propose failed. A failed propose mines no checkpoint on L1 (it reverts
+   * inside the multicall or is never sent), so recovery is purely local: the optimistic archiver insert
+   * is rolled back, the block's txs return to the pending pool, and the L1 nonce is reset. No L1 reorg
+   * is performed, and the build is not retried inline — once the txs are back in the pending pool the
+   * mempool poller re-enqueues a build on its next tick (see {@link maybeEnqueueBuild}).
+   */
   private async runBuild({ allowEmpty }: { allowEmpty: boolean }): Promise<L2Block | undefined> {
     if (!this.running || !this.publisher || !this.attestorAddress) {
       return undefined;
     }
+    await this.reconcileDateProvider();
 
-    const txCount = await this.deps.p2pClient.getPendingTxCount();
-    // For mempool-driven builds, wait for at least `minTxsPerBlock` pending txs (or 1 if not set)
+    // For mempool-driven builds, wait for at least `minTxsPerBlock` age-eligible txs (or 1 if not set)
     // before building. This mirrors the production sequencer's `waitForMinTxs` behavior, and is
     // required for tests that bundle multiple txs into one block via `setConfig({ minTxsPerBlock })`.
-    // Explicit empty-block / warp paths pass `allowEmpty: true` and bypass this gate.
+    // Explicit empty-block / warp paths pass `allowEmpty: true`, giving minRequired 0, which
+    // hasEligiblePendingTxs treats as always satisfied so the gate is bypassed.
     const minRequired = allowEmpty ? 0 : Math.max(this.deps.config.minTxsPerBlock ?? 1, 1);
-    if (txCount < minRequired) {
+    if (!(await this.deps.p2pClient.hasEligiblePendingTxs(minRequired))) {
       return undefined;
     }
 
@@ -324,7 +416,10 @@ export class AutomineSequencer {
       await this.deps.ethCheatCodes.setNextBlockTimestamp(slotBoundaryTs);
     }
 
-    const tips = await this.deps.l2BlockSource.getL2Tips();
+    const [tips, proposedCheckpoint] = await Promise.all([
+      this.deps.l2BlockSource.getL2Tips(),
+      this.deps.l2BlockSource.getProposedCheckpointData(),
+    ]);
     const syncedToBlockNumber = tips.proposed.number;
 
     // Ensure world state has processed the archiver's tip before forking. Without this,
@@ -334,7 +429,8 @@ export class AutomineSequencer {
     await this.deps.worldState.syncImmediate(BlockNumber(syncedToBlockNumber));
 
     const nextBlockNumber = BlockNumber(syncedToBlockNumber + 1);
-    const checkpointNumber = CheckpointNumber(tips.proposedCheckpoint.checkpoint.number + 1);
+    const parentCheckpointNumber = proposedCheckpoint?.checkpointNumber ?? tips.checkpointed.checkpoint.number;
+    const checkpointNumber = CheckpointNumber(parentCheckpointNumber + 1);
     const targetEpoch = getEpochAtSlot(SlotNumber(targetSlot), this.deps.l1Constants);
 
     this.log.verbose(`Building automine checkpoint`, {
@@ -342,7 +438,6 @@ export class AutomineSequencer {
       blockNumber: nextBlockNumber,
       slot: targetSlot,
       slotTimestamp: slotBoundaryTs,
-      txCount,
       allowEmpty,
     });
 
@@ -377,7 +472,8 @@ export class AutomineSequencer {
       this.log.getBindings(),
     );
 
-    const pendingTxs = this.deps.p2pClient.iterateEligiblePendingTxs();
+    // Block building only executes txs, and automine publishes straight to L1, so the proofs are never needed.
+    const pendingTxs = this.deps.p2pClient.iterateEligiblePendingTxs({ includeProof: false });
 
     const buildResult = await this.tryBuildBlock(
       checkpointBuilder,
@@ -419,15 +515,16 @@ export class AutomineSequencer {
     // offset — automine is the deliberate non-pipelined exception and builds/publishes in place.
     const result = await this.publisher.sendRequests(SlotNumber(targetSlot));
 
-    const successful = result?.successfulActions?.find(a => a === 'propose');
-    if (!successful) {
-      this.log.error('Propose action did not succeed under automine', {
+    const proposeSucceeded = !!result?.successfulActions?.some(action => action === 'propose');
+    if (!proposeSucceeded) {
+      this.log.warn('Automine propose did not succeed; rolled back optimistic insert, will rebuild from the poller', {
         slot: targetSlot,
         checkpointNumber,
         successful: result?.successfulActions,
         failed: result?.failedActions,
       });
-      throw new Error(`AutomineSequencer: propose did not succeed for slot ${targetSlot}`);
+      await this.rollbackOptimisticInsert(syncedToBlockNumber);
+      return undefined;
     }
 
     // Force one full L1-sync cycle synchronously. The local addBlock/addProposedCheckpoint
@@ -439,6 +536,17 @@ export class AutomineSequencer {
     const newL1Ts = await this.deps.ethCheatCodes.lastBlockTimestamp();
     this.deps.dateProvider.setTime(newL1Ts * 1000);
 
+    // A successful propose is validated on-chain against the mined L1 block's slot, so the mined slot
+    // should equal our target; warn (without rolling back — the checkpoint is on L1) if it ever differs.
+    const minedSlot = Number(getSlotAtTimestamp(BigInt(newL1Ts), this.deps.l1Constants));
+    if (minedSlot !== targetSlot) {
+      this.log.warn(`Automine checkpoint mined in slot ${minedSlot} but targeted ${targetSlot}`, {
+        minedSlot,
+        targetSlot,
+        checkpointNumber,
+      });
+    }
+
     this.lastBuiltSlot = targetSlot;
 
     this.log.verbose(`Automine checkpoint published`, {
@@ -452,6 +560,23 @@ export class AutomineSequencer {
     return buildResult.block;
   }
 
+  /**
+   * Undoes an optimistic archiver insert (uncheckpointed block + proposed checkpoint) without reorging
+   * L1: removes the uncheckpointed block and evicts the proposed checkpoint that referenced it, so the
+   * proposed tip drops back to `toBlockNumber`. `p2pClient.sync()` then observes the lowered tip and
+   * restores the block's txs to the pending pool; `worldState.syncImmediate()` drops any applied effects;
+   * and the L1 nonce is reset (a reverted-but-mined propose consumes one) so the build can be retried.
+   *
+   * Note: `archiver.rollbackTo` is NOT usable here — it is checkpoint-granular and no-ops on a
+   * proposed-only tip (the inserted checkpoint is not yet in the checkpointed set).
+   */
+  private async rollbackOptimisticInsert(toBlockNumber: BlockNumber): Promise<void> {
+    await this.deps.archiver.removeUncheckpointedBlocksAfter(toBlockNumber);
+    await this.deps.p2pClient.sync();
+    await this.deps.worldState.syncImmediate();
+    this.deps.l1TxUtils.forEach(utils => utils.resetNonce());
+  }
+
   /**
    * Warps L1 timestamp to (or past) `targetTimestampSec`, rounded up to the next aztec-slot
    * boundary, by queuing an empty-checkpoint build at that slot. Mines exactly one L1 block
@@ -459,6 +584,7 @@ export class AutomineSequencer {
    * the mined block lands on the slot boundary.
    */
   private async runWarp(targetTimestampSec: number): Promise<void> {
+    await this.reconcileDateProvider();
     const currentL1Ts = await this.deps.ethCheatCodes.lastBlockTimestamp();
     if (targetTimestampSec <= currentL1Ts) {
       this.log.debug(`Warp target ${targetTimestampSec} is not in the future of current L1 ts ${currentL1Ts}`);
@@ -536,6 +662,81 @@ export class AutomineSequencer {
     });
   }
 
+  /**
+   * Writes outbox roots for every epoch newly covered up to `maybeCheckpoint` and advances the proven
+   * tip. Settles each fully-covered epoch in full and the final epoch only up to the target checkpoint
+   * (a partial epoch, which the AZIP-14 Outbox supports via per-`numCheckpointsInEpoch` roots).
+   */
+  private async runProve(upToCheckpoint?: CheckpointNumber): Promise<CheckpointNumber> {
+    await this.reconcileDateProvider();
+    const rollupCheatCodes = this.getRollupCheatCodes();
+    const tips = await this.deps.l2BlockSource.getL2Tips();
+    const checkpointedTip = tips.checkpointed.checkpoint.number;
+
+    // Never prove beyond what the archiver has actually checkpointed; default to that tip.
+    const target = CheckpointNumber(Math.min(upToCheckpoint ?? checkpointedTip, checkpointedTip));
+
+    const { proven } = await rollupCheatCodes.getTips();
+    if (target <= proven) {
+      this.log.debug(`Checkpoint ${target} already proven`, { target, proven, checkpointedTip });
+      return proven;
+    }
+
+    const startEpoch = await this.getEpochOfCheckpoint(CheckpointNumber(proven + 1));
+    const endEpoch = await this.getEpochOfCheckpoint(target);
+    if (startEpoch === undefined || endEpoch === undefined) {
+      this.log.warn(`Cannot resolve epoch range to prove up to checkpoint ${target}`, {
+        target,
+        proven,
+        startEpoch,
+        endEpoch,
+      });
+      return proven;
+    }
+
+    for (let epoch = startEpoch; epoch <= endEpoch; epoch++) {
+      const lastCovered = await settleEpochOutbox({
+        rollupCheatCodes,
+        l2BlockSource: this.deps.l2BlockSource,
+        epoch: EpochNumber(epoch),
+        maxCheckpoint: epoch === endEpoch ? target : undefined,
+        log: this.log,
+      });
+      if (lastCovered === undefined) {
+        // An epoch in (proven, target] with no checkpointed blocks — expected when warps skip a whole
+        // epoch. Logged so it's distinguishable from the archiver failing to serve the epoch's blocks.
+        this.log.debug(`No checkpointed blocks to settle for epoch ${epoch} while proving to ${target}`, {
+          epoch,
+          target,
+        });
+      }
+    }
+
+    await rollupCheatCodes.markAsProven(target);
+    // Settlement is a direct L1 storage write that mines no block, unlike a real epoch proof landing
+    // on L1. The archiver's L1 sync short-circuits while the L1 block hash is unchanged, so it would
+    // never re-read the proven tip until the next build/warp mines a block. Mine one L1 block so the
+    // block hash advances, then force an immediate sync that observes the new proven checkpoint. Use
+    // evmMine (not mineEmptyBlock): mineEmptyBlock drops+re-adds the mempool non-atomically, which can
+    // silently lose a test's concurrently-submitted direct L1 tx. evm_mine just includes whatever is
+    // pending, which is fine here — we only need the block hash to advance.
+    await this.deps.ethCheatCodes.evmMine();
+    await this.deps.archiver.syncImmediate();
+
+    this.log.verbose(`Proved up to checkpoint ${target}`, { target, proven, startEpoch, endEpoch });
+    return target;
+  }
+
+  /** Resolves the epoch a checkpoint belongs to from its slot, or undefined if the archiver lacks it. */
+  private async getEpochOfCheckpoint(checkpointNumber: CheckpointNumber): Promise<number | undefined> {
+    const checkpointData = await this.deps.l2BlockSource.getCheckpointData({ number: checkpointNumber });
+    if (!checkpointData) {
+      return undefined;
+    }
+    const slot = SlotNumber(Number(checkpointData.header.slotNumber));
+    return Number(getEpochAtSlot(slot, this.deps.l1Constants));
+  }
+
   /**
    * Wraps `checkpointBuilder.buildBlock` with the failed-tx handling shared by both error
    * and success paths: drops the failed txs from the P2P mempool, and returns `undefined`

package/src/sequencer/automine/index.ts

@@ -0,0 +1,6 @@
+export {
+  AutomineSequencer,
+  type AutomineSequencerConstants,
+  type AutomineSequencerDeps,
+} from './automine_sequencer.js';
+export { createAutomineSequencer, type CreateAutomineSequencerArgs } from './automine_factory.js';