@aztec/stdlib 0.0.1-commit.4d79d1f2d → 0.0.1-commit.4d9804df

package/src/interfaces/prover-node.ts

@@ -1,54 +1,69 @@
+import { createSafeJsonRpcClient, defaultFetch } from '@aztec/foundation/json-rpc/client';
+
 import { z } from 'zod';
 
-import { type L2Tips, L2TipsSchema } from '../block/l2_block_source.js';
 import { type ApiSchemaFor, schemas } from '../schemas/index.js';
-import { type WorldStateSyncStatus, WorldStateSyncStatusSchema } from './world_state.js';
+import { type ComponentsVersions, getVersioningResponseHandler } from '../versioning/index.js';
 
 const EpochProvingJobState = [
   'initialized',
-  'processing',
-  'awaiting-prover',
+  'awaiting-checkpoints',
+  'awaiting-root',
+  'awaiting-predecessor',
   'publishing-proof',
   'completed',
+  'superseded',
   'failed',
   'stopped',
+  'cancelled',
   'timed-out',
-  'reorg',
 ] as const;
 
 export type EpochProvingJobState = (typeof EpochProvingJobState)[number];
 
 export const EpochProvingJobTerminalState: EpochProvingJobState[] = [
   'completed',
+  'superseded',
   'failed',
   'stopped',
+  'cancelled',
   'timed-out',
-  'reorg',
 ] as const;
 
 export type EpochProvingJobTerminalState = (typeof EpochProvingJobTerminalState)[number];
 
-/** JSON RPC public interface to a prover node. */
+/** JSON RPC admin interface to a prover node. */
 export interface ProverNodeApi {
   getJobs(): Promise<{ uuid: string; status: EpochProvingJobState; epochNumber: number }[]>;
 
-  startProof(epochNumber: number): Promise<void>;
-
-  getL2Tips(): Promise<L2Tips>;
-
-  getWorldStateSyncStatus(): Promise<WorldStateSyncStatus>;
+  /**
+   * Schedules proving for the given epoch and returns the job id immediately, without waiting for
+   * the proof to complete (proving can take far longer than an HTTP request). Poll `getJobs()` to
+   * track the returned job's progress.
+   */
+  startProof(epochNumber: number): Promise<string>;
 }
 
 /** Schemas for prover node API functions. */
 export const ProverNodeApiSchema: ApiSchemaFor<ProverNodeApi> = {
-  getJobs: z
-    .function()
-    .args()
-    .returns(z.array(z.object({ uuid: z.string(), status: z.enum(EpochProvingJobState), epochNumber: z.number() }))),
-
-  startProof: z.function().args(schemas.Integer).returns(z.void()),
+  getJobs: z.function({
+    input: z.tuple([]),
+    output: z.array(z.object({ uuid: z.string(), status: z.enum(EpochProvingJobState), epochNumber: z.number() })),
+  }),
 
-  getL2Tips: z.function().args().returns(L2TipsSchema),
-
-  getWorldStateSyncStatus: z.function().args().returns(WorldStateSyncStatusSchema),
+  startProof: z.function({ input: z.tuple([schemas.Integer]), output: z.string() }),
 };
+
+export function createProverNodeAdminClient(
+  url: string,
+  versions: Partial<ComponentsVersions> = {},
+  fetch = defaultFetch,
+  apiKey?: string,
+): ProverNodeApi {
+  return createSafeJsonRpcClient<ProverNodeApi>(url, ProverNodeApiSchema, {
+    namespaceMethods: 'prover',
+    fetch,
+    onResponse: getVersioningResponseHandler(versions),
+    ...(apiKey ? { extraHeaders: { 'x-api-key': apiKey } } : {}),
+  });
+}

package/src/interfaces/proving-job-source.ts

@@ -33,8 +33,8 @@ export interface ProvingJobSource {
 }
 
 export const ProvingJobSourceSchema: ApiSchemaFor<ProvingJobSource> = {
-  getProvingJob: z.function().args().returns(ProvingJob.optional()),
-  heartbeat: z.function().args(ProvingJobId).returns(z.void()),
-  resolveProvingJob: z.function().args(ProvingJobId, ProvingJobResult).returns(z.void()),
-  rejectProvingJob: z.function().args(ProvingJobId, z.string()).returns(z.void()),
+  getProvingJob: z.function({ input: z.tuple([]), output: ProvingJob.optional() }),
+  heartbeat: z.function({ input: z.tuple([ProvingJobId]), output: z.void() }),
+  resolveProvingJob: z.function({ input: z.tuple([ProvingJobId, ProvingJobResult]), output: z.void() }),
+  rejectProvingJob: z.function({ input: z.tuple([ProvingJobId, z.string()]), output: z.void() }),
 };

package/src/interfaces/proving-job.ts

@@ -1,5 +1,5 @@
 import {
-  AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED,
+  AVM_V2_PROOF_LENGTH_IN_FIELDS,
   NESTED_RECURSIVE_PROOF_LENGTH,
   NESTED_RECURSIVE_ROLLUP_HONK_PROOF_LENGTH,
   RECURSIVE_PROOF_LENGTH,
@@ -204,7 +204,7 @@ export type ProvingJobInputsMap = {
 export const ProvingJobResult = z.discriminatedUnion('type', [
   z.object({
     type: z.literal(ProvingRequestType.PUBLIC_VM),
-    result: RecursiveProof.schemaFor(AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED),
+    result: RecursiveProof.schemaFor(AVM_V2_PROOF_LENGTH_IN_FIELDS),
   }),
   z.object({
     type: z.literal(ProvingRequestType.PUBLIC_CHONK_VERIFIER),
@@ -319,7 +319,7 @@ export const ProvingJobResult = z.discriminatedUnion('type', [
 ]);
 export type ProvingJobResult = z.infer<typeof ProvingJobResult>;
 export type ProvingJobResultsMap = {
-  [ProvingRequestType.PUBLIC_VM]: RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED>;
+  [ProvingRequestType.PUBLIC_VM]: RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS>;
   [ProvingRequestType.PUBLIC_CHONK_VERIFIER]: PublicInputsAndRecursiveProof<
     PublicChonkVerifierPublicInputs,
     typeof NESTED_RECURSIVE_ROLLUP_HONK_PROOF_LENGTH
@@ -388,8 +388,8 @@ export type ProvingRequestResultFor<T extends ProvingRequestType> = { type: T; r
 
 export const ProvingJobId = z.string();
 
-export const ProofUri = z.string().brand('ProvingJobUri');
-export type ProofUri = z.infer<typeof ProofUri>;
+export type ProofUri = string & z.$brand<'ProvingJobUri'>;
+export const ProofUri: ZodFor<ProofUri> = z.string().transform(value => value as ProofUri);
 
 export type ProvingJobId = z.infer<typeof ProvingJobId>;
 
@@ -400,7 +400,7 @@ type ProvingJobShape = {
   inputsUri: ProofUri;
 };
 
-export const ProvingJob: z.ZodType<ProvingJobShape, z.ZodTypeDef, any> = z.object({
+export const ProvingJob: z.ZodType<ProvingJobShape, any> = z.object({
   id: ProvingJobId,
   type: z.nativeEnum(ProvingRequestType),
   epochNumber: EpochNumberSchema,

package/src/interfaces/public_storage_override.ts

@@ -0,0 +1,26 @@
+import type { Fr } from '@aztec/foundation/curves/bn254';
+
+import { z } from 'zod';
+
+import type { AztecAddress } from '../aztec-address/index.js';
+import { schemas } from '../schemas/schemas.js';
+
+/**
+ * A single public-storage override to inject before simulation. Identifies a slot in
+ * (contract, raw slot) space, not by leafSlot — the simulator computes the leafSlot internally
+ * via `computePublicDataTreeLeafSlot`.
+ */
+export type PublicStorageOverride = {
+  /** Contract that owns the storage slot. */
+  contract: AztecAddress;
+  /** Raw storage slot within the contract (not yet hashed into a tree key). */
+  slot: Fr;
+  /** Value to place at that slot for the duration of the simulation. */
+  value: Fr;
+};
+
+export const PublicStorageOverrideSchema = z.object({
+  contract: schemas.AztecAddress,
+  slot: schemas.Fr,
+  value: schemas.Fr,
+});

package/src/interfaces/server.ts

@@ -2,9 +2,13 @@ export * from './allowed_element.js';
 export * from './api_limit.js';
 export * from './archiver.js';
 export * from './aztec-node.js';
+export * from './block_response.js';
+export * from './chain_tips.js';
+export * from './checkpoint_parameter.js';
+export * from './checkpoint_response.js';
+export * from './l1_publish_info.js';
 export * from './block-builder.js';
 export * from './configs.js';
-export * from './epoch-prover.js';
 export * from './l2_logs_source.js';
 export * from './merkle_tree_operations.js';
 export * from './p2p-bootstrap.js';
@@ -13,7 +17,6 @@ export * from './processed-tx-handler.js';
 export * from './prover-agent.js';
 export * from './prover-broker.js';
 export * from './prover-client.js';
-export * from './prover-coordination.js';
 export * from './prover-node.js';
 export * from './proving-job-source.js';
 export * from './proving-job.js';

package/src/interfaces/server_circuit_prover.ts

@@ -1,5 +1,5 @@
 import type {
-  AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED,
+  AVM_V2_PROOF_LENGTH_IN_FIELDS,
   NESTED_RECURSIVE_PROOF_LENGTH,
   NESTED_RECURSIVE_ROLLUP_HONK_PROOF_LENGTH,
   RECURSIVE_PROOF_LENGTH,
@@ -189,7 +189,7 @@ export interface ServerCircuitProver {
     inputs: AvmCircuitInputs,
     signal?: AbortSignal,
     epochNumber?: number,
-  ): Promise<RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS_PADDED>>;
+  ): Promise<RecursiveProof<typeof AVM_V2_PROOF_LENGTH_IN_FIELDS>>;
 }
 
 export type IVCProofVerificationResult = {

package/src/interfaces/slasher.ts

@@ -3,25 +3,28 @@ import { schemas, zodFor } from '@aztec/foundation/schemas';
 
 import { z } from 'zod';
 
-export type SlasherClientType = 'empire' | 'tally';
-
 export interface SlasherConfig {
   slashOverridePayload?: EthAddress;
-  slashMinPenaltyPercentage: number;
-  slashMaxPenaltyPercentage: number;
   slashSelfAllowed?: boolean; // Whether to allow slashes to own validators
   slashValidatorsAlways: EthAddress[]; // Array of validator addresses
   slashValidatorsNever: EthAddress[]; // Array of validator addresses
   slashInactivityTargetPercentage: number; // 0-1, 0.9 means 90%. Must be greater than 0
   slashInactivityConsecutiveEpochThreshold: number; // Number of consecutive epochs a validator must be inactive before slashing
-  slashPrunePenalty: bigint;
   slashDataWithholdingPenalty: bigint;
+  /**
+   * Number of full L2 slots that must elapse after a checkpoint's slot before declaring its
+   * txs missing and slashing the checkpoint's attesters for data withholding. With tolerance
+   * = N and checkpoint slot S, the check fires at the start of slot `S + N + 1`.
+   */
+  slashDataWithholdingToleranceSlots: number;
   slashInactivityPenalty: bigint;
   slashBroadcastedInvalidBlockPenalty: bigint;
+  slashBroadcastedInvalidCheckpointProposalPenalty: bigint;
   slashDuplicateProposalPenalty: bigint;
   slashDuplicateAttestationPenalty: bigint;
   slashProposeInvalidAttestationsPenalty: bigint;
-  slashAttestDescendantOfInvalidPenalty: bigint;
+  slashProposeDescendantOfCheckpointWithInvalidAttestationsPenalty: bigint;
+  slashAttestInvalidCheckpointProposalPenalty: bigint;
   slashUnknownPenalty: bigint;
   slashOffenseExpirationRounds: number; // Number of rounds after which pending offenses expire
   slashMaxPayloadSize: number; // Maximum number of offenses to include in a single slash payload
@@ -32,19 +35,23 @@ export interface SlasherConfig {
 export const SlasherConfigSchema = zodFor<SlasherConfig>()(
   z.object({
     slashOverridePayload: schemas.EthAddress.optional(),
-    slashMinPenaltyPercentage: z.number(),
-    slashMaxPenaltyPercentage: z.number(),
     slashValidatorsAlways: z.array(schemas.EthAddress),
     slashValidatorsNever: z.array(schemas.EthAddress),
-    slashPrunePenalty: schemas.BigInt,
     slashDataWithholdingPenalty: schemas.BigInt,
+    // Tolerated as undefined to allow validating responses from older node images that
+    // predate the per-slot data-withholding watcher (PR #23116).
+    slashDataWithholdingToleranceSlots: z.number().default(3),
     slashInactivityTargetPercentage: z.number(),
     slashInactivityConsecutiveEpochThreshold: z.number(),
     slashInactivityPenalty: schemas.BigInt,
     slashProposeInvalidAttestationsPenalty: schemas.BigInt,
+    // Tolerated as undefined to allow validating responses from older node images that
+    // predate this slasher penalty being added.
+    slashBroadcastedInvalidCheckpointProposalPenalty: schemas.BigInt.default(0n),
     slashDuplicateProposalPenalty: schemas.BigInt,
     slashDuplicateAttestationPenalty: schemas.BigInt,
-    slashAttestDescendantOfInvalidPenalty: schemas.BigInt,
+    slashProposeDescendantOfCheckpointWithInvalidAttestationsPenalty: schemas.BigInt,
+    slashAttestInvalidCheckpointProposalPenalty: schemas.BigInt,
     slashUnknownPenalty: schemas.BigInt,
     slashOffenseExpirationRounds: z.number(),
     slashMaxPayloadSize: z.number(),

package/src/interfaces/tx_provider.ts

@@ -7,6 +7,12 @@ import type { PeerId } from '@libp2p/interface';
 export interface ITxProvider {
   getAvailableTxs(txHashes: TxHash[]): Promise<{ txs: Tx[]; missingTxs: TxHash[] }>;
 
+  /**
+   * Checks whether each tx hash is currently held by the local tx pool. Returns a parallel
+   * boolean array (one entry per input hash). Does not fetch from the network.
+   */
+  hasTxs(txHashes: TxHash[]): Promise<boolean[]>;
+
   getTxsForBlockProposal(
     blockProposal: BlockProposal,
     blockNumber: number,

package/src/interfaces/validator.ts

@@ -1,4 +1,4 @@
-import type { BlockNumber, CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import type { CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
 import type { SecretValue } from '@aztec/foundation/config';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
@@ -9,99 +9,141 @@ import type {
   BlockProposal,
   BlockProposalOptions,
   CheckpointAttestation,
-  CheckpointLastBlockData,
   CheckpointProposal,
   CheckpointProposalOptions,
 } from '@aztec/stdlib/p2p';
 import type { CheckpointHeader } from '@aztec/stdlib/rollup';
 import type { BlockHeader, Tx } from '@aztec/stdlib/tx';
-import { type ValidatorHASignerConfig, ValidatorHASignerConfigSchema } from '@aztec/validator-ha-signer/config';
 
 import type { PeerId } from '@libp2p/interface';
 import { z } from 'zod';
 
 import type { CommitteeAttestationsAndSigners } from '../block/index.js';
+import type { ChainConfig } from '../config/chain-config.js';
+import {
+  type LocalSignerConfig,
+  LocalSignerConfigSchema,
+  type ValidatorHASignerConfig,
+  ValidatorHASignerConfigSchema,
+} from '../ha-signing/index.js';
 import { AllowedElementSchema } from './allowed_element.js';
 
 /**
  * Validator client configuration
  */
-export type ValidatorClientConfig = ValidatorHASignerConfig & {
-  /** The private keys of the validators participating in attestation duties */
-  validatorPrivateKeys?: SecretValue<`0x${string}`[]>;
+export type ValidatorClientConfig = ValidatorHASignerConfig &
+  LocalSignerConfig & {
+    /** The L1 chain id used for EIP-712 proposal-path signing. */
+    l1ChainId: ChainConfig['l1ChainId'];
 
-  /** The addresses of the validators to use with remote signers */
-  validatorAddresses?: EthAddress[];
+    /** The private keys of the validators participating in attestation duties */
+    validatorPrivateKeys?: SecretValue<`0x${string}`[]>;
 
-  /** Do not run the validator */
-  disableValidator: boolean;
+    /** The addresses of the validators to use with remote signers */
+    validatorAddresses?: EthAddress[];
 
-  /** Temporarily disable these specific validator addresses */
-  disabledValidators: EthAddress[];
+    /** Do not run the validator */
+    disableValidator: boolean;
 
-  /** Interval between polling for new attestations from peers */
-  attestationPollingIntervalMs: number;
+    /** Temporarily disable these specific validator addresses */
+    disabledValidators: EthAddress[];
 
-  /** Whether to re-execute transactions in a block proposal before attesting */
-  validatorReexecute: boolean;
+    /** Interval between polling for new attestations from peers */
+    attestationPollingIntervalMs: number;
 
-  /** Whether to always reexecute block proposals, even for non-validator nodes or when out of the currnet committee */
-  alwaysReexecuteBlockProposals?: boolean;
+    /** Whether to always reexecute block proposals, even for non-validator nodes or when out of the current committee */
+    alwaysReexecuteBlockProposals?: boolean;
 
-  /** Whether to run in fisherman mode: validates all proposals and attestations but does not broadcast attestations or participate in consensus */
-  fishermanMode?: boolean;
+    /** Whether to run in fisherman mode: validates all proposals and attestations but does not broadcast attestations or participate in consensus */
+    fishermanMode?: boolean;
 
-  /** Skip checkpoint proposal validation and always attest (default: false) */
-  skipCheckpointProposalValidation?: boolean;
+    /** Skip checkpoint proposal validation and always attest (default: false) */
+    skipCheckpointProposalValidation?: boolean;
 
-  /** Skip pushing re-executed blocks to archiver (default: false) */
-  skipPushProposedBlocksToArchiver?: boolean;
+    /** Skip pushing re-executed blocks to archiver (default: false) */
+    skipPushProposedBlocksToArchiver?: boolean;
 
-  /** Agree to attest to equivocated checkpoint proposals (for testing purposes only) */
-  attestToEquivocatedProposals?: boolean;
-};
+    /** Agree to attest to equivocated checkpoint proposals (for testing purposes only) */
+    attestToEquivocatedProposals?: boolean;
+
+    /** Accept proposal validation regardless of slot timing (for testing only) */
+    skipProposalSlotValidation?: boolean;
+
+    /** Maximum L2 gas per block for validation. Proposals exceeding this limit are rejected. */
+    validateMaxL2BlockGas?: number;
+
+    /** Maximum DA gas per block for validation. Proposals exceeding this limit are rejected. */
+    validateMaxDABlockGas?: number;
+
+    /** Maximum transactions per block for validation. Proposals exceeding this limit are rejected. */
+    validateMaxTxsPerBlock?: number;
+
+    /** Maximum transactions per checkpoint for validation. Proposals exceeding this limit are rejected. */
+    validateMaxTxsPerCheckpoint?: number;
+  };
 
 export type ValidatorClientFullConfig = ValidatorClientConfig &
-  Pick<SequencerConfig, 'txPublicSetupAllowList' | 'broadcastInvalidBlockProposal'> &
+  Pick<SequencerConfig, 'txPublicSetupAllowListExtend' | 'broadcastInvalidBlockProposal' | 'maxBlocksPerCheckpoint'> &
+  // `blockDurationMs` is optional on the loose `SequencerConfig` but is always populated via the shared
+  // `numberConfigHelper(3000)` mapping, so it is required on the fully-resolved validator config.
+  Required<Pick<SequencerConfig, 'blockDurationMs'>> &
   Pick<
     SlasherConfig,
-    'slashBroadcastedInvalidBlockPenalty' | 'slashDuplicateProposalPenalty' | 'slashDuplicateAttestationPenalty'
+    | 'slashBroadcastedInvalidBlockPenalty'
+    | 'slashBroadcastedInvalidCheckpointProposalPenalty'
+    | 'slashDuplicateProposalPenalty'
+    | 'slashDuplicateAttestationPenalty'
+    | 'slashAttestInvalidCheckpointProposalPenalty'
   > & {
     /**
      * Whether transactions are disabled for this node
      * @remarks This should match the property in P2PConfig. It's not picked from there to avoid circular dependencies.
      */
     disableTransactions?: boolean;
+
+    /**
+     * Maximum clock-disparity tolerance (ms) applied to proposal/attestation receive windows.
+     * @remarks Mirrors the property in P2PConfig. It's not picked from there to avoid circular dependencies.
+     */
+    maxGossipClockDisparityMs?: number;
   };
 
 export const ValidatorClientConfigSchema = zodFor<Omit<ValidatorClientConfig, 'validatorPrivateKeys'>>()(
-  ValidatorHASignerConfigSchema.extend({
+  ValidatorHASignerConfigSchema.merge(LocalSignerConfigSchema).extend({
+    l1ChainId: z.number().int().nonnegative(),
     validatorAddresses: z.array(schemas.EthAddress).optional(),
     disableValidator: z.boolean(),
     disabledValidators: z.array(schemas.EthAddress),
     attestationPollingIntervalMs: z.number().min(0),
-    validatorReexecute: z.boolean(),
     alwaysReexecuteBlockProposals: z.boolean().optional(),
     fishermanMode: z.boolean().optional(),
     skipCheckpointProposalValidation: z.boolean().optional(),
     skipPushProposedBlocksToArchiver: z.boolean().optional(),
     attestToEquivocatedProposals: z.boolean().optional(),
+    skipProposalSlotValidation: z.boolean().optional(),
+    validateMaxL2BlockGas: z.number().optional(),
+    validateMaxDABlockGas: z.number().optional(),
+    validateMaxTxsPerBlock: z.number().optional(),
+    validateMaxTxsPerCheckpoint: z.number().optional(),
   }),
 );
 
 export const ValidatorClientFullConfigSchema = zodFor<Omit<ValidatorClientFullConfig, 'validatorPrivateKeys'>>()(
   ValidatorClientConfigSchema.extend({
-    txPublicSetupAllowList: z.array(AllowedElementSchema).optional(),
+    txPublicSetupAllowListExtend: z.array(AllowedElementSchema).optional(),
     broadcastInvalidBlockProposal: z.boolean().optional(),
+    blockDurationMs: z.number().positive(),
+    maxBlocksPerCheckpoint: z.number().positive().optional(),
     slashBroadcastedInvalidBlockPenalty: schemas.BigInt,
+    slashBroadcastedInvalidCheckpointProposalPenalty: schemas.BigInt,
     slashDuplicateProposalPenalty: schemas.BigInt,
     slashDuplicateAttestationPenalty: schemas.BigInt,
+    slashAttestInvalidCheckpointProposalPenalty: schemas.BigInt,
     disableTransactions: z.boolean().optional(),
+    maxGossipClockDisparityMs: z.number().optional(),
   }),
 );
 
-export type CreateCheckpointProposalLastBlockData = Omit<CheckpointLastBlockData, 'txHashes'> & { txs: Tx[] };
-
 export interface Validator {
   start(): Promise<void>;
   updateConfig(config: Partial<ValidatorClientFullConfig>): void;
@@ -109,6 +151,7 @@ export interface Validator {
   // Block validation responsibilities
   createBlockProposal(
     blockHeader: BlockHeader,
+    checkpointNumber: CheckpointNumber,
     indexWithinCheckpoint: number,
     inHash: Fr,
     archive: Fr,
@@ -121,7 +164,9 @@ export interface Validator {
   createCheckpointProposal(
     checkpointHeader: CheckpointHeader,
     archive: Fr,
-    lastBlockInfo: CreateCheckpointProposalLastBlockData | undefined,
+    checkpointNumber: CheckpointNumber,
+    feeAssetPriceModifier: bigint,
+    lastBlockProposal: BlockProposal | undefined,
     proposerAddress: EthAddress | undefined,
     options: CheckpointProposalOptions,
   ): Promise<CheckpointProposal>;
@@ -145,15 +190,23 @@ export interface Validator {
   broadcastBlockProposal(proposal: BlockProposal): Promise<void>;
 
   /** Collect own attestations for a checkpoint proposal (used when skipping p2p attestation collection) */
-  collectOwnAttestations(proposal: CheckpointProposal): Promise<CheckpointAttestation[]>;
+  collectOwnAttestations(
+    proposal: CheckpointProposal,
+    checkpointNumber: CheckpointNumber,
+  ): Promise<CheckpointAttestation[]>;
 
   /** Collect attestations from the p2p network for a checkpoint proposal */
-  collectAttestations(proposal: CheckpointProposal, required: number, deadline: Date): Promise<CheckpointAttestation[]>;
+  collectAttestations(
+    proposal: CheckpointProposal,
+    required: number,
+    deadline: Date,
+    checkpointNumber: CheckpointNumber,
+  ): Promise<CheckpointAttestation[]>;
 
   signAttestationsAndSigners(
     attestationsAndSigners: CommitteeAttestationsAndSigners,
     proposer: EthAddress,
     slot: SlotNumber,
-    blockNumber: BlockNumber | CheckpointNumber,
+    checkpointNumber: CheckpointNumber,
   ): Promise<Signature>;
 }

package/src/interfaces/world_state.ts

@@ -3,6 +3,7 @@ import type { PromiseWithResolvers } from '@aztec/foundation/promise';
 
 import { z } from 'zod';
 
+import type { BlockHash } from '../block/block_hash.js';
 import type { SnapshotDataKeys } from '../snapshots/types.js';
 import type { MerkleTreeReadOperations, MerkleTreeWriteOperations } from './merkle_tree_operations.js';
 
@@ -64,6 +65,20 @@ export interface ReadonlyWorldStateAccess {
 
 /** Defines the interface for a world state synchronizer. */
 export interface WorldStateSynchronizer extends ReadonlyWorldStateAccess, ForkMerkleTreeOperations {
+  /**
+   * Returns a read handle to the world state at `blockNumber`, but only after verifying that the block at that
+   * height is on the fork identified by `blockHash`. This pins the returned view to a specific fork so a reorg
+   * that replaced the block at `blockNumber` cannot be served silently, closing the gap between resolving a query
+   * and reading its snapshot.
+   *
+   * Rejects if the block at `blockNumber` does not match `blockHash` (a reorg), or if the block's hash cannot be
+   * read from the requested view. Both are transient from a caller's perspective: re-resolving the query against
+   * the current chain and retrying may succeed or produce a more precise error. However, if the block's history
+   * has been pruned away (it predates the oldest historical block kept by world state), the rejection is terminal:
+   * retrying cannot bring the data back.
+   */
+  getVerifiedSnapshot(blockNumber: BlockNumber, blockHash: BlockHash): Promise<MerkleTreeReadOperations>;
+
   /** Starts the synchronizer. */
   start(): Promise<void | PromiseWithResolvers<void>>;
 
@@ -80,18 +95,18 @@ export interface WorldStateSynchronizer extends ReadonlyWorldStateAccess, ForkMe
   resumeSync(): void;
 
   /**
-   * Forces an immediate sync to an optionally provided minimum block number
+   * Forces an immediate sync to an optionally provided minimum block number.
    * @param targetBlockNumber - The target block number that we must sync to. Will download unproven blocks if needed to reach it.
-   * @param skipThrowIfTargetNotReached - Whether to skip throwing if the target block number is not reached.
+   * @param blockHash - If provided, verifies the block at targetBlockNumber matches this hash. On mismatch, triggers a resync (reorg detection).
    * @returns A promise that resolves with the block number the world state was synced to
    */
-  syncImmediate(minBlockNumber?: BlockNumber, skipThrowIfTargetNotReached?: boolean): Promise<BlockNumber>;
+  syncImmediate(minBlockNumber?: BlockNumber, blockHash?: BlockHash): Promise<BlockNumber>;
 
   /** Deletes the db */
   clear(): Promise<void>;
 }
 
-export const WorldStateSyncStatusSchema: z.ZodType<WorldStateSyncStatus, z.ZodTypeDef, any> = z.object({
+export const WorldStateSyncStatusSchema: z.ZodType<WorldStateSyncStatus, any> = z.object({
   finalizedBlockNumber: BlockNumberSchema,
   latestBlockNumber: BlockNumberSchema,
   latestBlockHash: z.string(),

package/src/kernel/hints/build_note_hash_read_request_hints.ts

@@ -11,7 +11,6 @@ import type { ScopedNoteHash } from '../note_hash.js';
 import { NoteHashReadRequestHintsBuilder } from './note_hash_read_request_hints.js';
 import type { ScopedReadRequest } from './read_request.js';
 import { PendingReadHint, ReadRequestActionEnum, ReadRequestResetActions } from './read_request_hints.js';
-import { ScopedValueCache } from './scoped_value_cache.js';
 
 export function isValidNoteHashReadRequest(readRequest: ScopedReadRequest, noteHash: ScopedNoteHash) {
   return (
@@ -24,7 +23,6 @@ export function isValidNoteHashReadRequest(readRequest: ScopedReadRequest, noteH
 export function getNoteHashReadRequestResetActions(
   noteHashReadRequests: ClaimedLengthArray<ScopedReadRequest, typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX>,
   noteHashes: ClaimedLengthArray<ScopedNoteHash, typeof MAX_NOTE_HASHES_PER_TX>,
-  futureNoteHashes: ScopedNoteHash[],
 ): ReadRequestResetActions<typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX> {
   const resetActions = ReadRequestResetActions.empty(MAX_NOTE_HASH_READ_REQUESTS_PER_TX);
 
@@ -36,24 +34,23 @@ export function getNoteHashReadRequestResetActions(
     noteHashMap.set(value, arr);
   });
 
-  const futureNoteHashMap = new ScopedValueCache(futureNoteHashes);
-
   for (let i = 0; i < noteHashReadRequests.claimedLength; ++i) {
     const readRequest = noteHashReadRequests.array[i];
 
-    const pendingNoteHash = noteHashMap
-      .get(readRequest.value.toBigInt())
-      ?.find(n => isValidNoteHashReadRequest(readRequest, n.noteHash));
-
-    if (pendingNoteHash !== undefined) {
-      resetActions.actions[i] = ReadRequestActionEnum.READ_AS_PENDING;
-      resetActions.pendingReadHints.push(new PendingReadHint(i, pendingNoteHash.index));
-    } else if (
-      !futureNoteHashMap
-        .get(readRequest)
-        .find(futureNoteHash => isValidNoteHashReadRequest(readRequest, futureNoteHash))
-    ) {
+    if (readRequest.contractAddress.isZero()) {
+      // Settled read: empty contract address means resolve against the note hash tree.
       resetActions.actions[i] = ReadRequestActionEnum.READ_AS_SETTLED;
+    } else {
+      // Pending read: non-empty contract address means match against a pending note hash.
+      const pendingNoteHash = noteHashMap
+        .get(readRequest.value.toBigInt())
+        ?.find(n => isValidNoteHashReadRequest(readRequest, n.noteHash));
+
+      if (pendingNoteHash) {
+        resetActions.actions[i] = ReadRequestActionEnum.READ_AS_PENDING;
+        resetActions.pendingReadHints.push(new PendingReadHint(i, pendingNoteHash.index));
+      }
+      // Otherwise, the read request may be resolved by a future note hash. Leave as NOOP.
     }
   }
 
@@ -115,11 +112,10 @@ export async function buildNoteHashReadRequestHints<PENDING extends number, SETT
   },
   noteHashReadRequests: ClaimedLengthArray<ScopedReadRequest, typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX>,
   noteHashes: ClaimedLengthArray<ScopedNoteHash, typeof MAX_NOTE_HASHES_PER_TX>,
-  futureNoteHashes: ScopedNoteHash[],
   maxPending: PENDING = MAX_NOTE_HASH_READ_REQUESTS_PER_TX as PENDING,
   maxSettled: SETTLED = MAX_NOTE_HASH_READ_REQUESTS_PER_TX as SETTLED,
 ) {
-  const resetActions = getNoteHashReadRequestResetActions(noteHashReadRequests, noteHashes, futureNoteHashes);
+  const resetActions = getNoteHashReadRequestResetActions(noteHashReadRequests, noteHashes);
   return await buildNoteHashReadRequestHintsFromResetActions(
     oracle,
     noteHashReadRequests,