@aztec/stdlib 0.0.1-commit.c7c42ec → 0.0.1-commit.f295ac2

package/src/interfaces/validator.ts

@@ -1,23 +1,32 @@
+import type { BlockNumber, CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
 import type { SecretValue } from '@aztec/foundation/config';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import type { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
 import { schemas, zodFor } from '@aztec/foundation/schemas';
 import type { SequencerConfig, SlasherConfig } from '@aztec/stdlib/interfaces/server';
-import type { BlockAttestation, BlockProposal, BlockProposalOptions } from '@aztec/stdlib/p2p';
-import type { Tx } from '@aztec/stdlib/tx';
+import type {
+  BlockProposal,
+  BlockProposalOptions,
+  CheckpointAttestation,
+  CheckpointLastBlockData,
+  CheckpointProposal,
+  CheckpointProposalOptions,
+} from '@aztec/stdlib/p2p';
+import type { CheckpointHeader } from '@aztec/stdlib/rollup';
+import type { BlockHeader, Tx } from '@aztec/stdlib/tx';
+import { type ValidatorHASignerConfig, ValidatorHASignerConfigSchema } from '@aztec/validator-ha-signer/config';
 
 import type { PeerId } from '@libp2p/interface';
 import { z } from 'zod';
 
 import type { CommitteeAttestationsAndSigners } from '../block/index.js';
-import type { CheckpointHeader } from '../rollup/checkpoint_header.js';
 import { AllowedElementSchema } from './allowed_element.js';
 
 /**
  * Validator client configuration
  */
-export interface ValidatorClientConfig {
+export type ValidatorClientConfig = ValidatorHASignerConfig & {
   /** The private keys of the validators participating in attestation duties */
   validatorPrivateKeys?: SecretValue<`0x${string}`[]>;
 
@@ -36,15 +45,20 @@ export interface ValidatorClientConfig {
   /** Whether to re-execute transactions in a block proposal before attesting */
   validatorReexecute: boolean;
 
-  /** Will re-execute until this many milliseconds are left in the slot */
-  validatorReexecuteDeadlineMs: number;
-
   /** Whether to always reexecute block proposals, even for non-validator nodes or when out of the currnet committee */
   alwaysReexecuteBlockProposals?: boolean;
 
   /** Whether to run in fisherman mode: validates all proposals and attestations but does not broadcast attestations or participate in consensus */
   fishermanMode?: boolean;
-}
+
+  // TODO(palla/mbps): Change default to false once checkpoint validation is stable
+  /** Skip checkpoint proposal validation and always attest (default: true) */
+  skipCheckpointProposalValidation?: boolean;
+
+  // TODO(palla/mbps): Change default to false once block sync is stable
+  /** Skip pushing re-executed blocks to archiver (default: true) */
+  skipPushProposedBlocksToArchiver?: boolean;
+};
 
 export type ValidatorClientFullConfig = ValidatorClientConfig &
   Pick<SequencerConfig, 'txPublicSetupAllowList' | 'broadcastInvalidBlockProposal'> &
@@ -57,15 +71,16 @@ export type ValidatorClientFullConfig = ValidatorClientConfig &
   };
 
 export const ValidatorClientConfigSchema = zodFor<Omit<ValidatorClientConfig, 'validatorPrivateKeys'>>()(
-  z.object({
+  ValidatorHASignerConfigSchema.extend({
     validatorAddresses: z.array(schemas.EthAddress).optional(),
     disableValidator: z.boolean(),
     disabledValidators: z.array(schemas.EthAddress),
     attestationPollingIntervalMs: z.number().min(0),
     validatorReexecute: z.boolean(),
-    validatorReexecuteDeadlineMs: z.number().min(0),
     alwaysReexecuteBlockProposals: z.boolean().optional(),
     fishermanMode: z.boolean().optional(),
+    skipCheckpointProposalValidation: z.boolean().optional(),
+    skipPushProposedBlocksToArchiver: z.boolean().optional(),
   }),
 );
 
@@ -78,25 +93,60 @@ export const ValidatorClientFullConfigSchema = zodFor<Omit<ValidatorClientFullCo
   }),
 );
 
+export type CreateCheckpointProposalLastBlockData = Omit<CheckpointLastBlockData, 'txHashes'> & { txs: Tx[] };
+
 export interface Validator {
   start(): Promise<void>;
   updateConfig(config: Partial<ValidatorClientFullConfig>): void;
 
   // Block validation responsibilities
   createBlockProposal(
-    blockNumber: number,
-    header: CheckpointHeader,
+    blockHeader: BlockHeader,
+    indexWithinCheckpoint: number,
+    inHash: Fr,
     archive: Fr,
     txs: Tx[],
     proposerAddress: EthAddress | undefined,
     options: BlockProposalOptions,
   ): Promise<BlockProposal | undefined>;
-  attestToProposal(proposal: BlockProposal, sender: PeerId): Promise<BlockAttestation[] | undefined>;
+
+  /** Creates a checkpoint proposal for the last block in a checkpoint */
+  createCheckpointProposal(
+    checkpointHeader: CheckpointHeader,
+    archive: Fr,
+    lastBlockInfo: CreateCheckpointProposalLastBlockData | undefined,
+    proposerAddress: EthAddress | undefined,
+    options: CheckpointProposalOptions,
+  ): Promise<CheckpointProposal>;
+
+  /**
+   * Validate a block proposal from a peer.
+   * Note: Validators do NOT attest to individual blocks - attestations are only for checkpoint proposals.
+   * @returns true if the proposal is valid, false otherwise
+   */
+  validateBlockProposal(proposal: BlockProposal, sender: PeerId): Promise<boolean>;
+
+  /**
+   * Validate and attest to a checkpoint proposal from a peer.
+   * @returns Checkpoint attestations if valid, undefined otherwise
+   */
+  attestToCheckpointProposal(
+    proposal: CheckpointProposal,
+    sender: PeerId,
+  ): Promise<CheckpointAttestation[] | undefined>;
 
   broadcastBlockProposal(proposal: BlockProposal): Promise<void>;
-  collectAttestations(proposal: BlockProposal, required: number, deadline: Date): Promise<BlockAttestation[]>;
+
+  /** Collect own attestations for a checkpoint proposal (used when skipping p2p attestation collection) */
+  collectOwnAttestations(proposal: CheckpointProposal): Promise<CheckpointAttestation[]>;
+
+  /** Collect attestations from the p2p network for a checkpoint proposal */
+  collectAttestations(proposal: CheckpointProposal, required: number, deadline: Date): Promise<CheckpointAttestation[]>;
+
   signAttestationsAndSigners(
     attestationsAndSigners: CommitteeAttestationsAndSigners,
     proposer: EthAddress,
+    slot: SlotNumber,
+    blockNumber: BlockNumber | CheckpointNumber,
   ): Promise<Signature>;
 }

package/src/kernel/hints/build_note_hash_read_request_hints.ts

@@ -3,6 +3,7 @@ import {
   MAX_NOTE_HASH_READ_REQUESTS_PER_TX,
   type NOTE_HASH_TREE_HEIGHT,
 } from '@aztec/constants';
+import type { Fr } from '@aztec/foundation/curves/bn254';
 import type { MembershipWitness } from '@aztec/foundation/trees';
 
 import type { ClaimedLengthArray } from '../claimed_length_array.js';
@@ -61,12 +62,11 @@ export function getNoteHashReadRequestResetActions(
 
 export async function buildNoteHashReadRequestHintsFromResetActions<PENDING extends number, SETTLED extends number>(
   oracle: {
-    getNoteHashMembershipWitness(leafIndex: bigint): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT>>;
+    getNoteHashMembershipWitness(noteHash: Fr): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT> | undefined>;
   },
   noteHashReadRequests: ClaimedLengthArray<ScopedReadRequest, typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX>,
   noteHashes: ClaimedLengthArray<ScopedNoteHash, typeof MAX_NOTE_HASHES_PER_TX>,
   resetActions: ReadRequestResetActions<typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX>,
-  noteHashLeafIndexMap: Map<bigint, bigint>,
   maxPending: PENDING = MAX_NOTE_HASH_READ_REQUESTS_PER_TX as PENDING,
   maxSettled: SETTLED = MAX_NOTE_HASH_READ_REQUESTS_PER_TX as SETTLED,
 ) {
@@ -76,18 +76,28 @@ export async function buildNoteHashReadRequestHintsFromResetActions<PENDING exte
     builder.addPendingReadRequest(hint.readRequestIndex, hint.pendingValueIndex);
   });
 
+  // Collect all settled read requests
+  const settledRequests: { index: number; readRequest: ScopedReadRequest }[] = [];
   for (let i = 0; i < resetActions.actions.length; i++) {
     if (resetActions.actions[i] === ReadRequestActionEnum.READ_AS_SETTLED) {
-      const readRequest = noteHashReadRequests.array[i];
-      const leafIndex = noteHashLeafIndexMap.get(readRequest.value.toBigInt());
-      if (leafIndex === undefined) {
-        throw new Error('Read request is reading an unknown note hash.');
-      }
-      const membershipWitness = await oracle.getNoteHashMembershipWitness(leafIndex);
-      builder.addSettledReadRequest(i, membershipWitness, readRequest.value);
+      settledRequests.push({ index: i, readRequest: noteHashReadRequests.array[i] });
     }
   }
 
+  // Fetch all membership witnesses in parallel
+  const membershipWitnesses = await Promise.all(
+    settledRequests.map(({ readRequest }) => oracle.getNoteHashMembershipWitness(readRequest.value)),
+  );
+
+  // Add settled read requests to builder
+  for (let i = 0; i < settledRequests.length; i++) {
+    const membershipWitness = membershipWitnesses[i];
+    if (!membershipWitness) {
+      throw new Error('Read request is reading an unknown note hash.');
+    }
+    builder.addSettledReadRequest(settledRequests[i].index, membershipWitness, settledRequests[i].readRequest.value);
+  }
+
   const noteHashMap: Map<bigint, { noteHash: ScopedNoteHash; index: number }[]> = new Map();
   noteHashes.getActiveItems().forEach((noteHash, index) => {
     const value = noteHash.value.toBigInt();
@@ -101,11 +111,10 @@ export async function buildNoteHashReadRequestHintsFromResetActions<PENDING exte
 
 export async function buildNoteHashReadRequestHints<PENDING extends number, SETTLED extends number>(
   oracle: {
-    getNoteHashMembershipWitness(leafIndex: bigint): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT>>;
+    getNoteHashMembershipWitness(noteHash: Fr): Promise<MembershipWitness<typeof NOTE_HASH_TREE_HEIGHT>>;
   },
   noteHashReadRequests: ClaimedLengthArray<ScopedReadRequest, typeof MAX_NOTE_HASH_READ_REQUESTS_PER_TX>,
   noteHashes: ClaimedLengthArray<ScopedNoteHash, typeof MAX_NOTE_HASHES_PER_TX>,
-  noteHashLeafIndexMap: Map<bigint, bigint>,
   futureNoteHashes: ScopedNoteHash[],
   maxPending: PENDING = MAX_NOTE_HASH_READ_REQUESTS_PER_TX as PENDING,
   maxSettled: SETTLED = MAX_NOTE_HASH_READ_REQUESTS_PER_TX as SETTLED,
@@ -116,7 +125,6 @@ export async function buildNoteHashReadRequestHints<PENDING extends number, SETT
     noteHashReadRequests,
     noteHashes,
     resetActions,
-    noteHashLeafIndexMap,
     maxPending,
     maxSettled,
   );

package/src/kernel/hints/build_nullifier_read_request_hints.ts

@@ -82,21 +82,33 @@ export async function buildNullifierReadRequestHintsFromResetActions<PENDING ext
     builder.addPendingReadRequest(hint.readRequestIndex, hint.pendingValueIndex);
   });
 
+  // Collect all settled read requests
+  const settledRequests: { index: number; readRequest: ScopedReadRequest }[] = [];
   for (let i = 0; i < resetActions.actions.length; i++) {
     if (resetActions.actions[i] === ReadRequestActionEnum.READ_AS_SETTLED) {
-      const readRequest = nullifierReadRequests.array[i];
-      const siloedValue = siloed
-        ? readRequest.value
-        : await siloNullifier(readRequest.contractAddress, readRequest.value);
-      const membershipWitnessWithPreimage = await oracle.getNullifierMembershipWitness(siloedValue);
-      builder.addSettledReadRequest(
-        i,
-        membershipWitnessWithPreimage.membershipWitness,
-        membershipWitnessWithPreimage.leafPreimage,
-      );
+      settledRequests.push({ index: i, readRequest: nullifierReadRequests.array[i] });
     }
   }
 
+  // Compute siloed values in parallel (if not already siloed)
+  const siloedValues = siloed
+    ? settledRequests.map(({ readRequest }) => readRequest.value)
+    : await Promise.all(
+        settledRequests.map(({ readRequest }) => siloNullifier(readRequest.contractAddress, readRequest.value)),
+      );
+
+  // Fetch all membership witnesses in parallel
+  const membershipWitnesses = await Promise.all(siloedValues.map(value => oracle.getNullifierMembershipWitness(value)));
+
+  // Add settled read requests to builder
+  for (let i = 0; i < settledRequests.length; i++) {
+    builder.addSettledReadRequest(
+      settledRequests[i].index,
+      membershipWitnesses[i].membershipWitness,
+      membershipWitnesses[i].leafPreimage,
+    );
+  }
+
   return builder.toHints();
 }
 

package/src/messaging/in_hash.ts

@@ -3,7 +3,9 @@ import { padArrayEnd } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { computeBalancedShaRoot } from '@aztec/foundation/trees';
 
-/** Computes the inHash for a block's ContentCommitment given its l1 to l2 messages. */
+/**
+ * Computes the inHash for a checkpoint (or the first block in a checkpoint) given its l1 to l2 messages.
+ */
 export function computeInHashFromL1ToL2Messages(unpaddedL1ToL2Messages: Fr[]): Fr {
   const l1ToL2Messages = padArrayEnd<Fr, number>(unpaddedL1ToL2Messages, Fr.ZERO, NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP);
   return new Fr(computeBalancedShaRoot(l1ToL2Messages.map(msg => msg.toBuffer())));

package/src/messaging/l2_to_l1_membership.ts

@@ -1,9 +1,99 @@
-import type { BlockNumber } from '@aztec/foundation/branded-types';
+import { OUT_HASH_TREE_LEAF_COUNT } from '@aztec/constants';
+import type { EpochNumber } from '@aztec/foundation/branded-types';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { SiblingPath, UnbalancedMerkleTreeCalculator, computeUnbalancedShaRoot } from '@aztec/foundation/trees';
 
+/**
+ * # L2-to-L1 Message Tree Structure and Leaf IDs
+ *
+ * ## Overview
+ * L2-to-L1 messages are organized in a hierarchical 4-level tree structure within each epoch:
+ *   Epoch → Checkpoints → Blocks → Transactions → Messages
+ *
+ * Each level uses an unbalanced Merkle tree, and some levels use compression (skipping zero hashes).
+ *
+ * ## Tree Levels
+ *
+ * 1. **Message Tree (TX Out Hash)**
+ *    - Leaves: Individual L2-to-L1 messages within a transaction
+ *    - Root: TX out hash
+ *    - Type: Unbalanced, non-compressed (the circuits ensure that all messages are not empty.)
+ *
+ * 2. **Block Tree**
+ *    - Leaves: TX out hashes from all transactions in a block
+ *    - Root: Block out hash
+ *    - Type: Unbalanced, compressed (zero hashes are skipped)
+ *    - Compression: If a tx has no messages (out hash = 0), that branch is ignored
+ *
+ * 3. **Checkpoint Tree**
+ *    - Leaves: Block out hashes from all blocks in a checkpoint
+ *    - Root: Checkpoint out hash
+ *    - Type: Unbalanced, compressed (zero hashes are skipped)
+ *    - Compression: If a block has no messages (out hash = 0), that branch is ignored
+ *
+ * 4. **Epoch Tree**
+ *    - Leaves: Checkpoint out hashes from all checkpoints in an epoch (padded to AZTEC_MAX_EPOCH_DURATION)
+ *    - Root: Epoch out hash (set in the root rollup's public inputs and inserted into the Outbox on L1 when the epoch is proven)
+ *    - Type: Unbalanced, non-compressed
+ *    - **Important**: Padded with zeros up to AZTEC_MAX_EPOCH_DURATION to allow for proofs of partial epochs
+ *
+ * ## Combined Membership Proof
+ * To prove a message exists in an epoch, we combine the sibling paths from all 4 trees:
+ *   [message siblings] + [tx siblings] + [block siblings] + [checkpoint siblings]
+ *
+ * ## Leaf ID: Stable Message Identification
+ *
+ * Each message gets a unique, stable **leaf ID** that identifies its position in the combined tree.
+ * The leaf ID is computed as:
+ *   leafId = 2^pathSize + leafIndex
+ *
+ * Where:
+ * - `pathSize`: Total length of the combined sibling path (from all 4 tree levels)
+ * - `leafIndex`: The message's index in a balanced tree representation at that height
+ *
+ * ### Why Leaf IDs Are Stable
+ *
+ * The leaf ID is based on the message's position in the tree structure, which is determined by:
+ * - The checkpoint index within the epoch
+ * - The block index within the checkpoint
+ * - The transaction index within the block
+ * - The message index within the transaction
+ *
+ * These indices are structural and do NOT depend on the total number of blocks/checkpoints in the epoch.
+ *
+ * ### Critical Property: Preserving Consumed Status
+ *
+ * **Problem**: On L1, epoch proofs can be submitted incrementally. For example:
+ * - First, a proof for checkpoints 1-10 of epoch 0 is submitted (proves the first 10 checkpoints)
+ * - Later, a proof for checkpoints 1-20 of epoch 0 is submitted (proves all 20 checkpoints)
+ *
+ * When the longer proof is submitted, it updates the epoch's out hash root on L1 to reflect the complete epoch (all 20
+ * checkpoints). However, some messages from checkpoints 1-10 may have already been consumed.
+ *
+ * **Solution**: The Outbox on L1 tracks consumed messages using a bitmap indexed by leaf ID.
+ * Because leaf IDs are stable (they don't change when more checkpoints are added to the epoch), messages that were consumed
+ * under the shorter proof remain marked as consumed under the longer proof.
+ *
+ * This prevents double-spending of L2-to-L1 messages when longer epoch proofs are submitted.
+ */
+
+/**
+ * Computes the unique leaf ID for an L2-to-L1 message.
+ *
+ * The leaf ID is stable across different epoch proof lengths and is used by the Outbox
+ * on L1 to track which messages have been consumed.
+ *
+ * @param membershipWitness - Contains the leafIndex and siblingPath for the message
+ * @returns The unique leaf ID used for tracking message consumption on L1
+ */
+export function getL2ToL1MessageLeafId(
+  membershipWitness: Pick<L2ToL1MembershipWitness, 'leafIndex' | 'siblingPath'>,
+): bigint {
+  return 2n ** BigInt(membershipWitness.siblingPath.pathSize) + membershipWitness.leafIndex;
+}
+
 export interface MessageRetrieval {
-  getL2ToL1Messages(l2BlockNumber: BlockNumber): Promise<Fr[][] | undefined>;
+  getL2ToL1Messages(epoch: EpochNumber): Promise<Fr[][][][]>;
 }
 
 export type L2ToL1MembershipWitness = {
@@ -14,76 +104,101 @@ export type L2ToL1MembershipWitness = {
 
 export async function computeL2ToL1MembershipWitness(
   messageRetriever: MessageRetrieval,
-  l2BlockNumber: BlockNumber,
+  epoch: EpochNumber,
   message: Fr,
 ): Promise<L2ToL1MembershipWitness | undefined> {
-  const messagesForAllTxs = await messageRetriever.getL2ToL1Messages(l2BlockNumber);
-  if (!messagesForAllTxs) {
+  const messagesInEpoch = await messageRetriever.getL2ToL1Messages(epoch);
+  if (messagesInEpoch.length === 0) {
     return undefined;
   }
 
-  return computeL2ToL1MembershipWitnessFromMessagesForAllTxs(messagesForAllTxs, message);
+  return computeL2ToL1MembershipWitnessFromMessagesInEpoch(messagesInEpoch, message);
 }
 
 // TODO: Allow to specify the message to consume by its index or by an offset, in case there are multiple messages with
 // the same value.
-export function computeL2ToL1MembershipWitnessFromMessagesForAllTxs(
-  messagesForAllTxs: Fr[][],
+export function computeL2ToL1MembershipWitnessFromMessagesInEpoch(
+  messagesInEpoch: Fr[][][][],
   message: Fr,
 ): L2ToL1MembershipWitness {
-  // Find index of message in subtree and index of tx in a block.
+  // Find the index of the message in the tx, index of the tx in the block, and index of the block in the epoch.
   let messageIndexInTx = -1;
-  const txIndex = messagesForAllTxs.findIndex(messages => {
-    messageIndexInTx = messages.findIndex(msg => msg.equals(message));
-    return messageIndexInTx !== -1;
+  let txIndex = -1;
+  let blockIndex = -1;
+  const checkpointIndex = messagesInEpoch.findIndex(messagesInCheckpoint => {
+    blockIndex = messagesInCheckpoint.findIndex(messagesInBlock => {
+      txIndex = messagesInBlock.findIndex(messagesInTx => {
+        messageIndexInTx = messagesInTx.findIndex(msg => msg.equals(message));
+        return messageIndexInTx !== -1;
+      });
+      return txIndex !== -1;
+    });
+    return blockIndex !== -1;
   });
 
-  if (txIndex === -1) {
+  if (checkpointIndex === -1) {
     throw new Error('The L2ToL1Message you are trying to prove inclusion of does not exist');
   }
 
-  // Get the txOutHash and the sibling path of the message in the tx subtree.
-  const txMessages = messagesForAllTxs[txIndex];
-  const txOutHashTree = UnbalancedMerkleTreeCalculator.create(txMessages.map(msg => msg.toBuffer()));
-  const txOutHash = txOutHashTree.getRoot();
-  const messagePathInSubtree = txOutHashTree.getSiblingPath(message.toBuffer());
-
-  // Calculate txOutHash for all txs.
-  const txSubtreeRoots = messagesForAllTxs.map((messages, i) => {
-    // For a tx with no messages, we have to set an out hash of 0 to match what the circuit does.
-    if (messages.length === 0) {
-      return Fr.ZERO;
-    }
+  // Build the tx tree.
+  const messagesInTx = messagesInEpoch[checkpointIndex][blockIndex][txIndex];
+  const txTree = UnbalancedMerkleTreeCalculator.create(messagesInTx.map(msg => msg.toBuffer()));
+  // Get the sibling path of the target message in the tx tree.
+  const pathToMessageInTxSubtree = txTree.getSiblingPathByLeafIndex(messageIndexInTx);
 
-    if (i === txIndex) {
-      return Fr.fromBuffer(txOutHash);
-    }
+  // Build the tree of the block containing the target message.
+  const blockTree = buildBlockTree(messagesInEpoch[checkpointIndex][blockIndex]);
+  // Get the sibling path of the tx out hash in the block tree.
+  const pathToTxOutHashInBlockTree = blockTree.getSiblingPathByLeafIndex(txIndex);
 
-    const root = computeUnbalancedShaRoot(messages.map(msg => msg.toBuffer()));
-    return Fr.fromBuffer(root);
-  });
+  // Build the tree of the checkpoint containing the target message.
+  const checkpointTree = buildCheckpointTree(messagesInEpoch[checkpointIndex]);
+  // Get the sibling path of the block out hash in the checkpoint tree.
+  const pathToBlockOutHashInCheckpointTree = checkpointTree.getSiblingPathByLeafIndex(blockIndex);
 
-  // Construct the top tree.
-  // The leaves of this tree are the `txOutHashes`.
-  // The root of this tree should match the `out_hash` calculated in the circuits. Zero hashes are compressed to reduce
-  // cost if the non-zero leaves result in a shorter path.
-  const valueToCompress = Buffer.alloc(32);
-  const topTree = UnbalancedMerkleTreeCalculator.create(
-    txSubtreeRoots.map(root => root.toBuffer()),
-    valueToCompress,
+  // Compute the out hashes of all checkpoints in the epoch.
+  let checkpointOutHashes = messagesInEpoch.map((messagesInCheckpoint, i) => {
+    if (i === checkpointIndex) {
+      return checkpointTree.getRoot();
+    }
+    return buildCheckpointTree(messagesInCheckpoint).getRoot();
+  });
+  // Pad to AZTEC_MAX_EPOCH_DURATION with zeros.
+  checkpointOutHashes = checkpointOutHashes.concat(
+    Array.from({ length: OUT_HASH_TREE_LEAF_COUNT - messagesInEpoch.length }, () => Buffer.alloc(32)),
   );
-  const root = Fr.fromBuffer(topTree.getRoot());
 
-  // Compute the combined sibling path by appending the tx subtree path to the top tree path.
-  const txPathInTopTree = topTree.getSiblingPath(txOutHash);
-  const combinedPath = messagePathInSubtree.toBufferArray().concat(txPathInTopTree.toBufferArray());
+  // Build the epoch tree with all the checkpoint out hashes, including the padded zeros.
+  // Note: The epoch tree is actually a balanced tree, but we use an unbalanced tree calculator here to avoid turning
+  // this function into async.
+  const epochTree = UnbalancedMerkleTreeCalculator.create(checkpointOutHashes);
+  // Get the sibling path of the checkpoint out hash in the epoch tree.
+  const pathToCheckpointOutHashInEpochTree = epochTree.getSiblingPathByLeafIndex(checkpointIndex);
+
+  // The root of the epoch tree should match the `out_hash` in the root rollup's public inputs.
+  const root = Fr.fromBuffer(epochTree.getRoot());
+
+  // Compute the combined sibling path by appending the tx subtree path to the block tree path, then to the checkpoint
+  // tree path, then to the epoch tree path.
+  const combinedPath = pathToMessageInTxSubtree
+    .toBufferArray()
+    .concat(pathToTxOutHashInBlockTree.toBufferArray())
+    .concat(pathToBlockOutHashInCheckpointTree.toBufferArray())
+    .concat(pathToCheckpointOutHashInEpochTree.toBufferArray());
 
   // Compute the combined index.
-  // It is the index of the message in the balanced tree at its current height.
-  const txLeafIndexAtLevel = topTree.getLeafLocation(txIndex).index;
-  const messageLeafPosition = txOutHashTree.getLeafLocation(messageIndexInTx);
-  const numLeavesInLeftSubtrees = txLeafIndexAtLevel * (1 << messageLeafPosition.level);
-  const combinedIndex = numLeavesInLeftSubtrees + messageLeafPosition.index;
+  // It is the index of the message in the balanced tree (by filling up the wonky tree with empty nodes) at its current
+  // height. It's used to validate the membership proof.
+  const messageLeafPosition = txTree.getLeafLocation(messageIndexInTx);
+  const txLeafPosition = blockTree.getLeafLocation(txIndex);
+  const blockLeafPosition = checkpointTree.getLeafLocation(blockIndex);
+  const checkpointLeafPosition = epochTree.getLeafLocation(checkpointIndex);
+  const numLeavesInLeftCheckpoints = checkpointLeafPosition.index * (1 << blockLeafPosition.level);
+  const indexAtCheckpointLevel = numLeavesInLeftCheckpoints + blockLeafPosition.index;
+  const numLeavesInLeftBlocks = indexAtCheckpointLevel * (1 << txLeafPosition.level);
+  const indexAtTxLevel = numLeavesInLeftBlocks + txLeafPosition.index;
+  const numLeavesInLeftTxs = indexAtTxLevel * (1 << messageLeafPosition.level);
+  const combinedIndex = numLeavesInLeftTxs + messageLeafPosition.index;
 
   return {
     root,
@@ -92,8 +207,19 @@ export function computeL2ToL1MembershipWitnessFromMessagesForAllTxs(
   };
 }
 
-export function getL2ToL1MessageLeafId(
-  membershipWitness: Pick<L2ToL1MembershipWitness, 'leafIndex' | 'siblingPath'>,
-): bigint {
-  return 2n ** BigInt(membershipWitness.siblingPath.pathSize) + membershipWitness.leafIndex;
+function buildCheckpointTree(messagesInCheckpoint: Fr[][][]) {
+  const blockOutHashes = messagesInCheckpoint.map(messagesInBlock => buildBlockTree(messagesInBlock).getRoot());
+  return buildCompressedTree(blockOutHashes);
+}
+
+function buildBlockTree(messagesInBlock: Fr[][]) {
+  const txOutHashes = messagesInBlock.map(messages => computeUnbalancedShaRoot(messages.map(msg => msg.toBuffer())));
+  return buildCompressedTree(txOutHashes);
+}
+
+function buildCompressedTree(leaves: Buffer[]) {
+  // Note: If a block or tx has no messages (i.e. leaf == Buffer.alloc(32)), we ignore that branch and only accumulate
+  // the non-zero hashes to match what the circuits do.
+  const valueToCompress = Buffer.alloc(32);
+  return UnbalancedMerkleTreeCalculator.create(leaves, valueToCompress);
 }

package/src/messaging/out_hash.ts

@@ -1,36 +1,77 @@
+import { OUT_HASH_TREE_LEAF_COUNT } from '@aztec/constants';
+import { padArrayEnd } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
-import { UnbalancedMerkleTreeCalculator, computeUnbalancedShaRoot } from '@aztec/foundation/trees';
+import { computeBalancedShaRoot, computeUnbalancedShaRoot, computeWonkyShaRoot } from '@aztec/foundation/trees';
 
+/**
+ * Computes the out hash of a tx. It's the root of the unbalanced tree of all the L2-to-L1 messages emitted by the tx.
+ * @param messages - The L2-to-L1 messages emitted by the tx.
+ * @returns The out hash of the tx.
+ */
 export function computeTxOutHash(messages: Fr[]): Fr {
+  // Must match the implementation in `tx_base_public_inputs_composer.nr > compute_kernel_out_hash()`
   if (!messages.length) {
     return Fr.ZERO;
   }
-  // Tx out hash is the root of the unbalanced merkle tree of all the messages.
-  // Zero hashes (which should not happen) are not compressed.
+  // It's an unbalanced tree because zero hashes (which should not happen) will be included.
   return Fr.fromBuffer(computeUnbalancedShaRoot(messages.map(msg => msg.toBuffer())));
 }
 
-export function computeBlockOutHash(messagesPerBlock: Fr[][]): Fr {
-  const txOutHashes = messagesPerBlock.map(messages => computeTxOutHash(messages));
-  return aggregateOutHashes(txOutHashes);
+/**
+ * Computes the out hash of a block. It's the root of the wonky tree of all the tx out hashes.
+ * @param messagesPerTx - The L2-to-L1 messages emitted by the txs in the block. This is an array of message arrays.
+ * The array at index 0 contains the messages emitted by the first tx, the array at index 1 contains the messages
+ * emitted by the second tx, and so on.
+ * @returns The out hash of the block.
+ */
+export function computeBlockOutHash(messagesPerTx: Fr[][]): Fr {
+  // See how the tx out hashes are aggregated into a block out hash in `merge_tx_rollups.nr > accumulate_out_hash()`.
+  const txOutHashes = messagesPerTx.map(messages => computeTxOutHash(messages));
+  return Fr.fromBuffer(computeWonkyShaRoot(txOutHashes.map(hash => hash.toBuffer())));
 }
 
-export function computeCheckpointOutHash(messagesForAllTxs: Fr[][][]): Fr {
-  const blockOutHashes = messagesForAllTxs.map(block => computeBlockOutHash(block));
-  return aggregateOutHashes(blockOutHashes);
+/**
+ * Computes the out hash of a checkpoint. It's the root of the wonky tree of all the block out hashes.
+ * @param messagesPerBlock - The L2-to-L1 messages emitted by the txs in the blocks in the checkpoint. This is an array
+ * of arrays of messages. The array at index 0 contains the arrays of messages emitted by the first block, the array at
+ * index 1 contains the arrays of messages emitted by the second block, and so on.
+ * @returns The out hash of the checkpoint.
+ */
+export function computeCheckpointOutHash(messagesPerBlock: Fr[][][]): Fr {
+  // See how the block out hashes are aggregated into a checkpoint out hash in `merge_block_rollups.nr > accumulate_out_hash()`.
+  const blockOutHashes = messagesPerBlock.map(block => computeBlockOutHash(block));
+  return Fr.fromBuffer(computeWonkyShaRoot(blockOutHashes.map(hash => hash.toBuffer())));
 }
 
-// The root of this tree should match the `out_hash` calculated in the circuits. Zero hashes are compressed to reduce
-// cost if the non-zero leaves result in a shorter path.
-function aggregateOutHashes(outHashes: Fr[]): Fr {
-  if (!outHashes.length) {
-    return Fr.ZERO;
-  }
-
-  const valueToCompress = Buffer.alloc(32);
-  const tree = UnbalancedMerkleTreeCalculator.create(
-    outHashes.map(hash => hash.toBuffer()),
-    valueToCompress,
+/**
+ * Computes the accumulated (epoch) out hash of a checkpoint. It's the root of the balanced tree of all the out hashes
+ * from the first checkpoint in an epoch to the current checkpoint.
+ * It's this value that's set to the checkpoint header and validated on L1 instead of the checkpoint out hash.
+ * @param checkpointOutHashes - The out hashes of all checkpoints in the epoch.
+ * @returns The accumulated (epoch) out hash.
+ */
+export function accumulateCheckpointOutHashes(checkpointOutHashes: Fr[]): Fr {
+  // See how the checkpoint out hashes are accumulated in `checkpoint_rollup_public_inputs_composer.nr > accumulate_checkpoint_out_hash()`.
+  const paddedOutHashes = padArrayEnd(
+    checkpointOutHashes.map(hash => hash.toBuffer()),
+    Buffer.alloc(32),
+    OUT_HASH_TREE_LEAF_COUNT,
   );
-  return Fr.fromBuffer(tree.getRoot());
+  return Fr.fromBuffer(computeBalancedShaRoot(paddedOutHashes));
+}
+
+/**
+ * Computes the epoch out hash. It's the root of the balanced tree of all the checkpoint out hashes.
+ * It should match the **accumulated** out hash of the last checkpoint in the epoch.
+ * This value will be inserted into the Outbox on L1.
+ * @param messagesPerCheckpoint - The L2-to-L1 messages emitted by the txs in the blocks in the checkpoints in the epoch.
+ * This is an array of arrays of arrays of messages. The array at index 0 contains the arrays of arrays of messages
+ * emitted by the first checkpoint, the array at index 1 contains the arrays of arrays of messages emitted by the second
+ * checkpoint, and so on.
+ * @returns The epoch out hash.
+ */
+export function computeEpochOutHash(messagesPerCheckpoint: Fr[][][][]): Fr {
+  // See how the accumulated out hash is assigned to the root rollup's public inputs in `root_rollup.nr`.
+  const checkpointOutHashes = messagesPerCheckpoint.map(checkpoint => computeCheckpointOutHash(checkpoint));
+  return accumulateCheckpointOutHashes(checkpointOutHashes);
 }