@aztec/stdlib 0.0.1-commit.f2ce05ee → 0.0.1-commit.f5a9928

package/src/checkpoint/validate.ts

@@ -0,0 +1,262 @@
+import { BLOBS_PER_CHECKPOINT, FIELDS_PER_BLOB, MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT } from '@aztec/constants';
+import type { CheckpointNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { sum } from '@aztec/foundation/collection';
+
+import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT } from '../deserialization/index.js';
+import type { Checkpoint } from './checkpoint.js';
+
+export class CheckpointValidationError extends Error {
+  constructor(
+    message: string,
+    public readonly checkpointNumber: CheckpointNumber,
+    public readonly slot: SlotNumber,
+  ) {
+    super(message);
+    this.name = 'CheckpointValidationError';
+  }
+}
+
+/**
+ * Validates a checkpoint. Throws a CheckpointValidationError if any validation fails.
+ * - Validates structural integrity (non-empty, block count, sequential numbers, archive chaining, slot consistency)
+ * - Validates checkpoint blob field count against maxBlobFields limit
+ * - Validates total L2 gas used by checkpoint blocks against the Rollup contract mana limit
+ * - Validates total DA gas used by checkpoint blocks against MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT
+ * - Validates individual block L2 gas and DA gas against maxL2BlockGas and maxDABlockGas limits
+ */
+export function validateCheckpoint(
+  checkpoint: Checkpoint,
+  opts: {
+    rollupManaLimit?: number;
+    maxL2BlockGas?: number;
+    maxDABlockGas?: number;
+    maxTxsPerCheckpoint?: number;
+    maxTxsPerBlock?: number;
+    /**
+     * Max blocks per checkpoint. Defaults to {@link MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT}; the L1-sync
+     * ingest path passes `MAX_CAPACITY_BLOCKS_PER_CHECKPOINT` to tolerate larger checkpoints already
+     * accepted by L1.
+     */
+    maxBlocksPerCheckpoint?: number;
+    /**
+     * Whether to tolerate a zero-tx block after the first one. Defaults to false; the L1-sync ingest path
+     * passes true for the same reason it raises `maxBlocksPerCheckpoint` — such a checkpoint is already on
+     * L1, and refusing to ingest it would stall sync rather than undo it.
+     */
+    allowEmptyNonFirstBlocks?: boolean;
+  },
+): void {
+  validateCheckpointStructure(checkpoint, {
+    maxBlocksPerCheckpoint: opts.maxBlocksPerCheckpoint,
+    allowEmptyNonFirstBlocks: opts.allowEmptyNonFirstBlocks,
+  });
+  validateCheckpointLimits(checkpoint, opts);
+  validateCheckpointBlocksLimits(checkpoint, opts);
+}
+
+/**
+ * Validates structural integrity of a checkpoint.
+ * - Non-empty block list
+ * - Block count within `maxBlocksPerCheckpoint` (default {@link MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT})
+ * - Checkpoint slot matches the first block's slot
+ * - Checkpoint lastArchiveRoot matches the first block's lastArchive root
+ * - Sequential block numbers without gaps
+ * - Sequential indexWithinCheckpoint starting at 0
+ * - Every block after the first carries at least one tx, unless `allowEmptyNonFirstBlocks` is set
+ * - Archive root chaining between consecutive blocks
+ * - Consistent slot number across all blocks
+ * - Global variables (slot, timestamp, coinbase, feeRecipient, gasFees) match checkpoint header for each block
+ */
+export function validateCheckpointStructure(
+  checkpoint: Checkpoint,
+  opts: { maxBlocksPerCheckpoint?: number; allowEmptyNonFirstBlocks?: boolean } = {},
+): void {
+  const { maxBlocksPerCheckpoint = MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT, allowEmptyNonFirstBlocks = false } = opts;
+  const { blocks, number, slot } = checkpoint;
+
+  if (blocks.length === 0) {
+    throw new CheckpointValidationError('Checkpoint has no blocks', number, slot);
+  }
+
+  if (blocks.length > maxBlocksPerCheckpoint) {
+    throw new CheckpointValidationError(
+      `Checkpoint has ${blocks.length} blocks, exceeding limit of ${maxBlocksPerCheckpoint}`,
+      number,
+      slot,
+    );
+  }
+
+  const firstBlock = blocks[0];
+
+  if (!checkpoint.header.lastArchiveRoot.equals(firstBlock.header.lastArchive.root)) {
+    throw new CheckpointValidationError(
+      `Checkpoint lastArchiveRoot does not match first block's lastArchive root`,
+      number,
+      slot,
+    );
+  }
+
+  for (let i = 0; i < blocks.length; i++) {
+    const block = blocks[i];
+
+    if (block.indexWithinCheckpoint !== i) {
+      throw new CheckpointValidationError(
+        `Block at index ${i} has indexWithinCheckpoint ${block.indexWithinCheckpoint}, expected ${i}`,
+        number,
+        slot,
+      );
+    }
+
+    if (block.slot !== slot) {
+      throw new CheckpointValidationError(
+        `Block ${block.number} has slot ${block.slot}, expected ${slot} (all blocks must share the same slot)`,
+        number,
+        slot,
+      );
+    }
+
+    if (!checkpoint.header.matchesGlobalVariables(block.header.globalVariables)) {
+      throw new CheckpointValidationError(
+        `Block ${block.number} global variables (slot, timestamp, coinbase, feeRecipient, gasFees) do not match checkpoint header`,
+        number,
+        slot,
+      );
+    }
+
+    if (i > 0) {
+      // The only block-root circuit that proves a zero-tx block is `rollup_block_root_first_empty_tx`, which is
+      // pinned to index 0 of a checkpoint: it starts a fresh sponge blob and carries a non-zero in_hash, both of
+      // which the block-merge continuity checks forbid at any later index. An empty block past the first would
+      // therefore have no circuit able to prove it.
+      if (!allowEmptyNonFirstBlocks && block.body.txEffects.length === 0) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} at index ${i} has no txs; only the first block of a checkpoint may be empty`,
+          number,
+          slot,
+        );
+      }
+
+      const prev = blocks[i - 1];
+      if (block.number !== prev.number + 1) {
+        throw new CheckpointValidationError(
+          `Block numbers are not sequential: block at index ${i - 1} has number ${prev.number}, block at index ${i} has number ${block.number}`,
+          number,
+          slot,
+        );
+      }
+
+      if (!block.header.lastArchive.root.equals(prev.archive.root)) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} lastArchive root does not match archive root of block ${prev.number}`,
+          number,
+          slot,
+        );
+      }
+    }
+  }
+}
+
+/** Validates checkpoint blocks gas limits */
+function validateCheckpointBlocksLimits(
+  checkpoint: Checkpoint,
+  opts: {
+    maxL2BlockGas?: number;
+    maxDABlockGas?: number;
+    maxTxsPerBlock?: number;
+  },
+): void {
+  const { maxL2BlockGas, maxDABlockGas, maxTxsPerBlock } = opts;
+
+  if (maxL2BlockGas !== undefined) {
+    for (const block of checkpoint.blocks) {
+      const blockL2Gas = block.header.totalManaUsed.toNumber();
+      if (blockL2Gas > maxL2BlockGas) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} in checkpoint has L2 gas used ${blockL2Gas} exceeding limit of ${maxL2BlockGas}`,
+          checkpoint.number,
+          checkpoint.slot,
+        );
+      }
+    }
+  }
+
+  if (maxDABlockGas !== undefined) {
+    for (const block of checkpoint.blocks) {
+      const blockDAGas = block.computeDAGasUsed();
+      if (blockDAGas > maxDABlockGas) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} in checkpoint has DA gas used ${blockDAGas} exceeding limit of ${maxDABlockGas}`,
+          checkpoint.number,
+          checkpoint.slot,
+        );
+      }
+    }
+  }
+
+  if (maxTxsPerBlock !== undefined) {
+    for (const block of checkpoint.blocks) {
+      const blockTxCount = block.body.txEffects.length;
+      if (blockTxCount > maxTxsPerBlock) {
+        throw new CheckpointValidationError(
+          `Block ${block.number} in checkpoint has ${blockTxCount} txs exceeding limit of ${maxTxsPerBlock}`,
+          checkpoint.number,
+          checkpoint.slot,
+        );
+      }
+    }
+  }
+}
+
+/** Validates checkpoint max blob fields, gas limits, and tx limits */
+function validateCheckpointLimits(
+  checkpoint: Checkpoint,
+  opts: {
+    rollupManaLimit?: number;
+    maxTxsPerCheckpoint?: number;
+  },
+): void {
+  const { rollupManaLimit, maxTxsPerCheckpoint } = opts;
+
+  const maxBlobFields = BLOBS_PER_CHECKPOINT * FIELDS_PER_BLOB;
+  const maxDAGas = MAX_PROCESSABLE_DA_GAS_PER_CHECKPOINT;
+
+  if (rollupManaLimit !== undefined) {
+    const checkpointMana = sum(checkpoint.blocks.map(block => block.header.totalManaUsed.toNumber()));
+    if (checkpointMana > rollupManaLimit) {
+      throw new CheckpointValidationError(
+        `Checkpoint mana cost ${checkpointMana} exceeds rollup limit of ${rollupManaLimit}`,
+        checkpoint.number,
+        checkpoint.slot,
+      );
+    }
+  }
+
+  const checkpointDAGas = sum(checkpoint.blocks.map(block => block.computeDAGasUsed()));
+  if (checkpointDAGas > maxDAGas) {
+    throw new CheckpointValidationError(
+      `Checkpoint DA gas cost ${checkpointDAGas} exceeds limit of ${maxDAGas}`,
+      checkpoint.number,
+      checkpoint.slot,
+    );
+  }
+
+  const checkpointBlobFields = checkpoint.toBlobFields().length;
+  if (checkpointBlobFields > maxBlobFields) {
+    throw new CheckpointValidationError(
+      `Checkpoint blob field count ${checkpointBlobFields} exceeds limit of ${maxBlobFields}`,
+      checkpoint.number,
+      checkpoint.slot,
+    );
+  }
+
+  if (maxTxsPerCheckpoint !== undefined) {
+    const checkpointTxCount = sum(checkpoint.blocks.map(block => block.body.txEffects.length));
+    if (checkpointTxCount > maxTxsPerCheckpoint) {
+      throw new CheckpointValidationError(
+        `Checkpoint tx count ${checkpointTxCount} exceeds limit of ${maxTxsPerCheckpoint}`,
+        checkpoint.number,
+        checkpoint.slot,
+      );
+    }
+  }
+}

package/src/config/chain-config.ts

@@ -1,5 +1,5 @@
-import { l1ContractAddressesMapping } from '@aztec/ethereum/l1-contract-addresses';
-import type { ConfigMappingsType } from '@aztec/foundation/config';
+import { type L1ContractAddresses, pickL1ContractAddressMappings } from '@aztec/ethereum/l1-contract-addresses';
+import { type ConfigMappingsType, numberConfigHelper } from '@aztec/foundation/config';
 import { EthAddress } from '@aztec/foundation/eth-address';
 
 export { type SequencerConfig, SequencerConfigSchema } from '../interfaces/configs.js';
@@ -7,26 +7,28 @@ export { type AllowedElement } from '../interfaces/allowed_element.js';
 
 export const emptyChainConfig: ChainConfig = {
   l1ChainId: 0,
-  l1Contracts: { rollupAddress: EthAddress.ZERO },
   rollupVersion: 0,
+  rollupAddress: EthAddress.ZERO,
 };
 
 export const chainConfigMappings: ConfigMappingsType<ChainConfig> = {
   l1ChainId: {
     env: 'L1_CHAIN_ID',
-    parseEnv: (val: string) => +val,
-    defaultValue: 31337,
+    ...numberConfigHelper(31337),
     description: 'The chain ID of the ethereum host.',
   },
   rollupVersion: {
     env: 'ROLLUP_VERSION',
     description: 'The version of the rollup.',
-    parseEnv: (val: string) => (Number.isSafeInteger(parseInt(val, 10)) ? parseInt(val, 10) : undefined),
-  },
-  l1Contracts: {
-    description: 'The deployed L1 contract addresses',
-    nested: l1ContractAddressesMapping,
+    parseEnv: (val: string) => {
+      const parsed = parseInt(val, 10);
+      if (!Number.isSafeInteger(parsed)) {
+        throw new Error(`Invalid rollup version: ${val}`);
+      }
+      return parsed;
+    },
   },
+  ...pickL1ContractAddressMappings('rollupAddress'),
 };
 
 /** Chain configuration. */
@@ -35,9 +37,4 @@ export type ChainConfig = {
   l1ChainId: number;
   /** The version of the rollup. */
   rollupVersion: number;
-  /** The address to the L1 contracts. */
-  l1Contracts: {
-    /** The address to rollup */
-    rollupAddress: EthAddress;
-  };
-};
+} & Pick<L1ContractAddresses, 'rollupAddress'>;

package/src/config/index.ts

@@ -1,3 +1,4 @@
 export * from './chain-config.js';
+export * from './network-consensus-config.js';
 export * from './node-rpc-config.js';
 export * from './sequencer-config.js';

package/src/config/network-consensus-config.ts

@@ -0,0 +1,299 @@
+import { type L1ContractsConfig, l1ContractsConfigMappings, validateSlotDurations } from '@aztec/ethereum/config';
+import { type EnvVar, pickConfigMappings } from '@aztec/foundation/config';
+
+import { MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT } from '../deserialization/index.js';
+import type { SequencerConfig } from '../interfaces/configs.js';
+import {
+  DEFAULT_CHECKPOINT_PROPOSAL_INIT_TIME,
+  DEFAULT_CHECKPOINT_PROPOSAL_PREPARE_TIME,
+  DEFAULT_MIN_BLOCK_DURATION,
+  DEFAULT_P2P_PROPAGATION_TIME,
+} from '../timetable/budgets.js';
+import { ProposerTimetable } from '../timetable/proposer_timetable.js';
+import { sharedSequencerConfigMappings } from './sequencer-config.js';
+
+/**
+ * Environment variables whose values must be identical across every node of a network. They fall into three
+ * categories, all consensus-critical:
+ *
+ * - Timing/protocol consensus: slot and epoch durations, block sub-slot duration, max blocks per checkpoint, and
+ *   the checkpoint-proposal materialization grace. Proposers and validators must agree on these to land on the
+ *   same proposed chain and the same checkpoint-proposal receive/handoff deadlines.
+ * - Network identity and L1-posted deployment params: the L1 chain id and the staking/governance/slashing
+ *   parameters baked into the deployed rollup contract (committee size, lags, thresholds, mana target, fee
+ *   pricing, governance/slashing round sizes, quorums, slash amounts, etc.). A node disagreeing with the rollup
+ *   it points at would compute the wrong epoch geometry, fees, or slashing rounds.
+ * - Node-side slashing offense consensus: the offense detection/penalty parameters validators apply locally to
+ *   decide which payloads to sign. Validators must agree on these to reach the on-chain slashing quorum.
+ *
+ * Deliberately excluded: bootnodes, P2P/store/OTEL/sentinel settings, SEQ_MIN_TX_PER_BLOCK, SEQ_MAX_TX_PER_*,
+ * AZTEC_SLASHER_ENABLED, PROVER_REAL_PROOFS, TRANSACTIONS_DISABLED, and AZTEC_ENTRY_QUEUE_* (mainnet-only genesis
+ * params enforced by L1).
+ */
+export const NETWORK_CONSENSUS_ENV_VARS = [
+  // Timing/protocol consensus.
+  'ETHEREUM_SLOT_DURATION',
+  'AZTEC_SLOT_DURATION',
+  'AZTEC_EPOCH_DURATION',
+  'SEQ_BLOCK_DURATION_MS',
+  'MAX_BLOCKS_PER_CHECKPOINT',
+  'CHECKPOINT_PROPOSAL_SYNC_GRACE_SECONDS',
+
+  // Network identity / L1-posted deployment params.
+  'L1_CHAIN_ID',
+  'AZTEC_TARGET_COMMITTEE_SIZE',
+  'AZTEC_LAG_IN_EPOCHS_FOR_VALIDATOR_SET',
+  'AZTEC_LAG_IN_EPOCHS_FOR_RANDAO',
+  'AZTEC_ACTIVATION_THRESHOLD',
+  'AZTEC_EJECTION_THRESHOLD',
+  'AZTEC_LOCAL_EJECTION_THRESHOLD',
+  'AZTEC_EXIT_DELAY_SECONDS',
+  'AZTEC_INBOX_LAG',
+  'AZTEC_PROOF_SUBMISSION_EPOCHS',
+  'AZTEC_MANA_TARGET',
+  'AZTEC_PROVING_COST_PER_MANA',
+  'AZTEC_INITIAL_ETH_PER_FEE_ASSET',
+  'AZTEC_GOVERNANCE_PROPOSER_ROUND_SIZE',
+  'AZTEC_GOVERNANCE_PROPOSER_QUORUM',
+  'AZTEC_SLASHING_QUORUM',
+  'AZTEC_SLASHING_ROUND_SIZE_IN_EPOCHS',
+  'AZTEC_SLASHING_LIFETIME_IN_ROUNDS',
+  'AZTEC_SLASHING_OFFSET_IN_ROUNDS',
+  'AZTEC_SLASHING_EXECUTION_DELAY_IN_ROUNDS',
+  'AZTEC_SLASHING_VETOER',
+  'AZTEC_SLASHING_DISABLE_DURATION',
+  'AZTEC_SLASH_AMOUNT_SMALL',
+  'AZTEC_SLASH_AMOUNT_MEDIUM',
+  'AZTEC_SLASH_AMOUNT_LARGE',
+
+  // Node-side slashing offense consensus.
+  'SLASH_OFFENSE_EXPIRATION_ROUNDS',
+  'SLASH_MAX_PAYLOAD_SIZE',
+  'SLASH_EXECUTE_ROUNDS_LOOK_BACK',
+  'SLASH_DATA_WITHHOLDING_TOLERANCE_SLOTS',
+  'SLASH_DATA_WITHHOLDING_PENALTY',
+  'SLASH_INACTIVITY_TARGET_PERCENTAGE',
+  'SLASH_INACTIVITY_CONSECUTIVE_EPOCH_THRESHOLD',
+  'SLASH_INACTIVITY_PENALTY',
+  'SLASH_PROPOSE_INVALID_ATTESTATIONS_PENALTY',
+  'SLASH_DUPLICATE_PROPOSAL_PENALTY',
+  'SLASH_DUPLICATE_ATTESTATION_PENALTY',
+  'SLASH_PROPOSE_DESCENDANT_OF_CHECKPOINT_WITH_INVALID_ATTESTATIONS_PENALTY',
+  'SLASH_ATTEST_INVALID_CHECKPOINT_PROPOSAL_PENALTY',
+  'SLASH_UNKNOWN_PENALTY',
+  'SLASH_INVALID_BLOCK_PENALTY',
+  'SLASH_INVALID_CHECKPOINT_PROPOSAL_PENALTY',
+  'SLASH_GRACE_PERIOD_L2_SLOTS',
+] as const satisfies readonly EnvVar[];
+
+/** A consensus-critical environment variable name; see {@link NETWORK_CONSENSUS_ENV_VARS}. */
+export type ConsensusEnvVar = (typeof NETWORK_CONSENSUS_ENV_VARS)[number];
+
+/**
+ * The subset of consensus-critical timing config whose geometry can be validated in isolation. Composed by
+ * picking the canonical fields from their owning config types so the field set never drifts from the config
+ * layer: slot durations from {@link L1ContractsConfig}, block sub-slot/checkpoint timings from
+ * {@link SequencerConfig} (whose fields are optional there, hence `Required`).
+ */
+export type NetworkConsensusConfig = Pick<L1ContractsConfig, 'aztecSlotDuration' | 'ethereumSlotDuration'> &
+  Required<Pick<SequencerConfig, 'blockDurationMs' | 'maxBlocksPerCheckpoint' | 'checkpointProposalSyncGraceSeconds'>>;
+
+/** Config mappings for the slot-timing fields of {@link NetworkConsensusConfig}, picked from their owners. */
+const networkConsensusConfigMappings = {
+  ...pickConfigMappings(l1ContractsConfigMappings, ['aztecSlotDuration', 'ethereumSlotDuration']),
+  ...pickConfigMappings(sharedSequencerConfigMappings, [
+    'blockDurationMs',
+    'maxBlocksPerCheckpoint',
+    'checkpointProposalSyncGraceSeconds',
+  ]),
+};
+
+/**
+ * Extracts the timing {@link NetworkConsensusConfig} from a generated network config object. The env-var names
+ * and the per-field parsing both come from the canonical config mappings (`l1ContractsConfigMappings` and
+ * `sharedSequencerConfigMappings`), so each field is parsed exactly as the node's config layer would parse it.
+ * A field whose env var is absent becomes `NaN`, which {@link validateNetworkConsensusConfig} reports as an
+ * error. Never throws: parse helpers that would throw or yield `undefined` are coerced to `NaN`.
+ */
+export function getConsensusConfigFromNetworkEnv(
+  values: Record<string, string | number | boolean>,
+): NetworkConsensusConfig {
+  const result = {} as Record<keyof NetworkConsensusConfig, number>;
+  for (const [field, mapping] of Object.entries(networkConsensusConfigMappings)) {
+    const raw = mapping.env !== undefined ? values[mapping.env] : undefined;
+    if (raw === undefined) {
+      result[field as keyof NetworkConsensusConfig] = NaN;
+      continue;
+    }
+    let parsed: number | undefined;
+    try {
+      parsed = mapping.parseEnv ? mapping.parseEnv(String(raw)) : Number(raw);
+    } catch {
+      parsed = NaN;
+    }
+    result[field as keyof NetworkConsensusConfig] = parsed ?? NaN;
+  }
+  return result;
+}
+
+/**
+ * Validates a {@link NetworkConsensusConfig} for self-consistency, returning a list of error messages (empty
+ * when valid). Used by the cli unit test that gates the generated network configs.
+ *
+ * The check requires `maxBlocksPerCheckpoint` to be *exactly* what a {@link ProposerTimetable} built from the
+ * same slot timings and the production default budgets derives. This exact-equality requirement ensures the
+ * published network value is precisely what the production default budgets produce, so every node running those
+ * defaults agrees on the per-checkpoint block count without clamping.
+ */
+export function validateNetworkConsensusConfig(config: NetworkConsensusConfig): string[] {
+  const errors: string[] = [];
+
+  for (const [field, value] of Object.entries(config)) {
+    if (typeof value !== 'number' || !Number.isFinite(value)) {
+      errors.push(`${field} must be a finite number (got ${value})`);
+    }
+  }
+  if (errors.length > 0) {
+    return errors;
+  }
+
+  errors.push(...validateSlotDurations(config));
+  if (config.blockDurationMs <= 0) {
+    errors.push(`blockDurationMs must be positive (got ${config.blockDurationMs})`);
+  }
+  if (config.blockDurationMs / 1000 > config.aztecSlotDuration) {
+    errors.push(
+      `blockDurationMs (${config.blockDurationMs}ms) exceeds aztecSlotDuration (${config.aztecSlotDuration}s)`,
+    );
+  }
+  if (config.maxBlocksPerCheckpoint < 1) {
+    errors.push(`maxBlocksPerCheckpoint must be at least 1 (got ${config.maxBlocksPerCheckpoint})`);
+  }
+  if (config.maxBlocksPerCheckpoint > MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT) {
+    errors.push(
+      `maxBlocksPerCheckpoint (${config.maxBlocksPerCheckpoint}) exceeds the ` +
+        `${MAX_ATTESTABLE_BLOCKS_PER_CHECKPOINT} blocks nodes will build or attest to, so the network would ` +
+        `reject block indices its own configuration admits`,
+    );
+  }
+  if (config.checkpointProposalSyncGraceSeconds < 0) {
+    errors.push(
+      `checkpointProposalSyncGraceSeconds must be non-negative (got ${config.checkpointProposalSyncGraceSeconds})`,
+    );
+  }
+  if (errors.length > 0) {
+    return errors;
+  }
+
+  let computed: number;
+  try {
+    computed = new ProposerTimetable({
+      l1Constants: {
+        l1GenesisTime: 0n,
+        slotDuration: config.aztecSlotDuration,
+        ethereumSlotDuration: config.ethereumSlotDuration,
+      },
+      blockDuration: config.blockDurationMs / 1000,
+      minBlockDuration: DEFAULT_MIN_BLOCK_DURATION,
+      p2pPropagationTime: DEFAULT_P2P_PROPAGATION_TIME,
+      checkpointProposalPrepareTime: DEFAULT_CHECKPOINT_PROPOSAL_PREPARE_TIME,
+      checkpointProposalInitTime: DEFAULT_CHECKPOINT_PROPOSAL_INIT_TIME,
+      checkpointProposalSyncGrace: config.checkpointProposalSyncGraceSeconds,
+    }).getMaxBlocksPerCheckpoint();
+  } catch (err) {
+    // The timetable constructor throws when not even one block fits the default budgets; report instead.
+    errors.push(
+      `maxBlocksPerCheckpoint (${config.maxBlocksPerCheckpoint}) cannot be achieved: the default operational ` +
+        `budgets fit fewer than one block for slot duration ${config.aztecSlotDuration}s and block duration ` +
+        `${config.blockDurationMs / 1000}s (${err instanceof Error ? err.message : String(err)})`,
+    );
+    return errors;
+  }
+
+  if (computed !== config.maxBlocksPerCheckpoint) {
+    errors.push(
+      `maxBlocksPerCheckpoint (${config.maxBlocksPerCheckpoint}) does not match the ${computed} blocks the ` +
+        `production default budgets derive for slot duration ${config.aztecSlotDuration}s and block duration ` +
+        `${config.blockDurationMs / 1000}s`,
+    );
+  }
+
+  return errors;
+}
+
+/**
+ * Enforces that operators do not silently override consensus-critical values diverging from the network config.
+ *
+ * For each var in {@link NETWORK_CONSENSUS_ENV_VARS} present in `networkConfig`: if the operator set it in `env`
+ * to a conflicting value, this throws unless `ALLOW_OVERRIDING_NETWORK_CONFIG` is truthy (in which case it logs
+ * and keeps the operator value).
+ *
+ * This function is pure: it never writes to `env`. Instead it returns the canonical env writes the caller
+ * should apply — a map of env-var name to canonical string value for every numeric var whose env value matched
+ * the network value numerically. Applying these closes a bypass where the config layer parses some vars with
+ * `parseInt` (which reads '6e3' as 6); rewriting them to the network value's string form keeps the operator's
+ * numerically-equal value but in canonical form. Vars kept under `ALLOW_OVERRIDING_NETWORK_CONFIG` (genuine
+ * conflicts) are not included, so the operator value is preserved untouched.
+ *
+ * @returns Canonical env writes (env-var name -> canonical string value) for the caller to apply.
+ */
+export function checkConsensusEnvOverrides(
+  networkConfig: Record<string, string | number | boolean>,
+  env: { [key: string]: string | undefined } = process.env,
+  log?: (msg: string) => void,
+): Record<string, string> {
+  const allowOverride = allowsNetworkConfigOverride(env);
+  const canonical: Record<string, string> = {};
+  const conflicts: string[] = [];
+
+  for (const envVar of NETWORK_CONSENSUS_ENV_VARS) {
+    const networkValue = networkConfig[envVar];
+    if (networkValue === undefined) {
+      continue;
+    }
+
+    const current = env[envVar];
+    if (current === undefined || current === '') {
+      continue;
+    }
+
+    const networkIsNumeric = typeof networkValue === 'number';
+    const matches = networkIsNumeric ? Number(current) === networkValue : current === String(networkValue);
+    if (matches) {
+      if (networkIsNumeric) {
+        canonical[envVar] = String(networkValue);
+      }
+      continue;
+    }
+
+    const conflict = `${envVar}=${current} conflicts with the network value ${networkValue}`;
+    if (allowOverride) {
+      log?.(
+        `Environment variable ${conflict}. Consensus-critical values must match across the network, but ` +
+          `ALLOW_OVERRIDING_NETWORK_CONFIG is set so the operator value is kept (only do this if you know what ` +
+          `you are doing).`,
+      );
+      continue;
+    }
+    conflicts.push(conflict);
+  }
+
+  // Accumulate every conflict so the operator sees all the env vars they need to reconcile at once, rather than
+  // fixing them one failed startup at a time.
+  if (conflicts.length > 0) {
+    throw new Error(
+      `Environment variables conflict with consensus-critical network values:\n` +
+        conflicts.map(c => `  - ${c}`).join('\n') +
+        `\nConsensus-critical values must match across the network. Set ALLOW_OVERRIDING_NETWORK_CONFIG=1 to ` +
+        `override (only do this if you know what you are doing).`,
+    );
+  }
+
+  return canonical;
+}
+
+/** Whether the env opts into overriding network-wide consensus values (`ALLOW_OVERRIDING_NETWORK_CONFIG`). */
+export function allowsNetworkConfigOverride(env: { [key: string]: string | undefined } = process.env): boolean {
+  const value = env.ALLOW_OVERRIDING_NETWORK_CONFIG;
+  return value === '1' || value?.toLowerCase() === 'true';
+}

package/src/config/node-rpc-config.ts

@@ -1,5 +1,11 @@
 import { DEFAULT_MAX_DEBUG_LOG_MEMORY_READS } from '@aztec/constants';
-import { type ConfigMappingsType, numberConfigHelper } from '@aztec/foundation/config';
+import { type ConfigMappingsType, booleanConfigHelper, numberConfigHelper } from '@aztec/foundation/config';
+
+const parseCommaSeparatedList = (value: string) =>
+  value
+    .split(',')
+    .map(item => item.trim())
+    .filter(Boolean);
 
 export const nodeRpcConfigMappings: ConfigMappingsType<NodeRPCConfig> = {
   rpcSimulatePublicMaxGasLimit: {
@@ -23,6 +29,33 @@ export const nodeRpcConfigMappings: ConfigMappingsType<NodeRPCConfig> = {
     description: 'Maximum allowed batch size for JSON RPC batch requests.',
     defaultValue: '1mb',
   },
+  rpcHttpKeepAliveTimeoutMs: {
+    env: 'RPC_HTTP_KEEP_ALIVE_TIMEOUT_MS',
+    description: 'HTTP keep-alive timeout for JSON RPC connections in milliseconds.',
+    ...numberConfigHelper(5_000),
+  },
+  rpcHttpHeadersTimeoutMs: {
+    env: 'RPC_HTTP_HEADERS_TIMEOUT_MS',
+    description: 'Timeout for receiving complete HTTP headers on JSON RPC connections in milliseconds.',
+    ...numberConfigHelper(60_000),
+  },
+  rpcCorsAllowedOrigins: {
+    env: 'RPC_CORS_ALLOWED_ORIGINS',
+    description: 'Origins allowed to make credentialed cross-origin JSON RPC requests, separated by commas.',
+    parseEnv: parseCommaSeparatedList,
+    defaultValue: [],
+  },
+  rpcCorsAllowedHeaders: {
+    env: 'RPC_CORS_ALLOWED_HEADERS',
+    description: 'Headers allowed in cross-origin JSON RPC requests, separated by commas.',
+    parseEnv: parseCommaSeparatedList,
+    defaultValue: [],
+  },
+  rpcCorsAllowAnyOrigin: {
+    env: 'RPC_CORS_ALLOW_ANY_ORIGIN',
+    description: 'Allow credentialed cross-origin JSON RPC requests from any origin.',
+    ...booleanConfigHelper(false),
+  },
 };
 
 export type NodeRPCConfig = {
@@ -34,4 +67,21 @@ export type NodeRPCConfig = {
   rpcMaxBatchSize: number;
   /** The maximum body size the RPC server will accept */
   rpcMaxBodySize: string;
+  /** HTTP keep-alive timeout for JSON RPC connections in milliseconds. */
+  rpcHttpKeepAliveTimeoutMs?: number;
+  /** Timeout for receiving complete HTTP headers on JSON RPC connections in milliseconds. */
+  rpcHttpHeadersTimeoutMs?: number;
+  /** Origins allowed to make credentialed cross-origin requests to the RPC server. */
+  rpcCorsAllowedOrigins?: string[];
+  /** Headers allowed in cross-origin requests to the RPC server. */
+  rpcCorsAllowedHeaders?: string[];
+  /** Whether to allow credentialed cross-origin requests from any origin. */
+  rpcCorsAllowAnyOrigin?: boolean;
 };
+
+/** Resolves the CORS origin policy for an RPC server. */
+export function getRpcCorsAllowedOrigins(
+  config: Pick<NodeRPCConfig, 'rpcCorsAllowedOrigins' | 'rpcCorsAllowAnyOrigin'>,
+): string[] {
+  return config.rpcCorsAllowAnyOrigin ? ['*'] : (config.rpcCorsAllowedOrigins ?? []);
+}