@aztec/validator-ha-signer 0.0.1-commit.f504929 → 0.0.1-commit.f5a9928

package/src/db/migrations/1_initial-schema.ts

@@ -1,21 +1,52 @@
 /**
  * Initial schema for validator HA slashing protection
  *
- * This migration imports SQL from the schema.ts file to ensure a single source of truth.
+ * Note: this migration contains a fixed snapshot of the schema at the time it was created.
+ * It must NOT import from schema.ts, which evolves over time and would cause this migration
+ * to produce different results on fresh runs vs. re-runs.
  */
 import type { MigrationBuilder } from 'node-pg-migrate';
 
-import { DROP_SCHEMA_VERSION_TABLE, DROP_VALIDATOR_DUTIES_TABLE, SCHEMA_SETUP, SCHEMA_VERSION } from '../schema.js';
+import { DROP_SCHEMA_VERSION_TABLE, DROP_VALIDATOR_DUTIES_TABLE } from '../schema.js';
+
+// Snapshot of the initial schema — does NOT include checkpoint_number (added in migration 2).
+const INITIAL_SCHEMA_SETUP = [
+  `CREATE TABLE IF NOT EXISTS schema_version (
+    version INTEGER PRIMARY KEY,
+    applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+  );`,
+  `CREATE TABLE IF NOT EXISTS validator_duties (
+    rollup_address VARCHAR(42) NOT NULL,
+    validator_address VARCHAR(42) NOT NULL,
+    slot BIGINT NOT NULL,
+    block_number BIGINT NOT NULL,
+    block_index_within_checkpoint INTEGER NOT NULL DEFAULT 0,
+    duty_type VARCHAR(30) NOT NULL CHECK (duty_type IN ('BLOCK_PROPOSAL', 'CHECKPOINT_PROPOSAL', 'ATTESTATION', 'ATTESTATIONS_AND_SIGNERS', 'GOVERNANCE_VOTE', 'SLASHING_VOTE')),
+    status VARCHAR(20) NOT NULL CHECK (status IN ('signing', 'signed')),
+    message_hash VARCHAR(66) NOT NULL,
+    signature VARCHAR(132),
+    node_id VARCHAR(255) NOT NULL,
+    lock_token VARCHAR(64) NOT NULL,
+    started_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    completed_at TIMESTAMP,
+    error_message TEXT,
+
+    PRIMARY KEY (rollup_address, validator_address, slot, duty_type, block_index_within_checkpoint),
+    CHECK (completed_at IS NULL OR completed_at >= started_at)
+  );`,
+  `CREATE INDEX IF NOT EXISTS idx_validator_duties_status ON validator_duties(status, started_at);`,
+  `CREATE INDEX IF NOT EXISTS idx_validator_duties_node ON validator_duties(node_id, started_at);`,
+] as const;
 
 export function up(pgm: MigrationBuilder): void {
-  for (const statement of SCHEMA_SETUP) {
+  for (const statement of INITIAL_SCHEMA_SETUP) {
     pgm.sql(statement);
   }
 
   // Insert initial schema version
   pgm.sql(`
     INSERT INTO schema_version (version)
-    VALUES (${SCHEMA_VERSION})
+    VALUES (1)
     ON CONFLICT (version) DO NOTHING;
   `);
 }

package/src/db/migrations/2_add-checkpoint-number.ts

@@ -0,0 +1,19 @@
+/**
+ * Add checkpoint_number column to validator_duties table
+ */
+import type { MigrationBuilder } from 'node-pg-migrate';
+
+export function up(pgm: MigrationBuilder): void {
+  pgm.addColumn('validator_duties', {
+    // eslint-disable-next-line camelcase
+    checkpoint_number: { type: 'bigint', notNull: true, default: 0 },
+  });
+
+  pgm.sql(`UPDATE schema_version SET version = 2 WHERE version = 1`);
+}
+
+export function down(pgm: MigrationBuilder): void {
+  pgm.dropColumn('validator_duties', 'checkpoint_number');
+
+  pgm.sql(`UPDATE schema_version SET version = 1 WHERE version = 2`);
+}

package/src/db/postgres.ts

@@ -1,7 +1,7 @@
 /**
  * PostgreSQL implementation of SlashingProtectionDatabase
  */
-import { BlockNumber, SlotNumber } from '@aztec/foundation/branded-types';
+import { SlotNumber } from '@aztec/foundation/branded-types';
 import { randomBytes } from '@aztec/foundation/crypto/random';
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { type Logger, createLogger } from '@aztec/foundation/log';
@@ -20,7 +20,7 @@ import {
   UPDATE_DUTY_SIGNED,
 } from './schema.js';
 import type { CheckAndRecordParams, DutyRow, DutyType, InsertOrGetRow, ValidatorDutyRecord } from './types.js';
-import { getBlockIndexFromDutyIdentifier } from './types.js';
+import { getBlockIndexFromDutyIdentifier, recordFromFields } from './types.js';
 
 /**
  * Minimal pool interface for database operations.
@@ -107,6 +107,7 @@ export class PostgresSlashingProtectionDatabase implements SlashingProtectionDat
           params.validatorAddress.toString(),
           params.slot.toString(),
           params.blockNumber.toString(),
+          params.checkpointNumber.toString(),
           blockIndexWithinCheckpoint,
           params.dutyType,
           params.messageHash,
@@ -220,14 +221,17 @@ export class PostgresSlashingProtectionDatabase implements SlashingProtectionDat
   }
 
   /**
-   * Convert a database row to a ValidatorDutyRecord
+   * Convert a database row to a ValidatorDutyRecord.
+   * Maps snake_case column names to StoredDutyRecord (camelCase, ms timestamps),
+   * then delegates to the shared recordFromFields() converter.
    */
   private rowToRecord(row: DutyRow): ValidatorDutyRecord {
-    return {
-      rollupAddress: EthAddress.fromString(row.rollup_address),
-      validatorAddress: EthAddress.fromString(row.validator_address),
-      slot: SlotNumber.fromString(row.slot),
-      blockNumber: BlockNumber.fromString(row.block_number),
+    return recordFromFields({
+      rollupAddress: row.rollup_address,
+      validatorAddress: row.validator_address,
+      slot: row.slot,
+      blockNumber: row.block_number,
+      checkpointNumber: row.checkpoint_number,
       blockIndexWithinCheckpoint: row.block_index_within_checkpoint,
       dutyType: row.duty_type,
       status: row.status,
@@ -235,10 +239,10 @@ export class PostgresSlashingProtectionDatabase implements SlashingProtectionDat
       signature: row.signature ?? undefined,
       nodeId: row.node_id,
       lockToken: row.lock_token,
-      startedAt: row.started_at,
-      completedAt: row.completed_at ?? undefined,
+      startedAtMs: row.started_at.getTime(),
+      completedAtMs: row.completed_at?.getTime(),
       errorMessage: row.error_message ?? undefined,
-    };
+    });
   }
 
   /**

package/src/db/schema.ts

@@ -9,7 +9,7 @@
 /**
  * Current schema version
  */
-export const SCHEMA_VERSION = 1;
+export const SCHEMA_VERSION = 2;
 
 /**
  * SQL to create the validator_duties table
@@ -20,6 +20,7 @@ CREATE TABLE IF NOT EXISTS validator_duties (
   validator_address VARCHAR(42) NOT NULL,
   slot BIGINT NOT NULL,
   block_number BIGINT NOT NULL,
+  checkpoint_number BIGINT NOT NULL DEFAULT 0,
   block_index_within_checkpoint INTEGER NOT NULL DEFAULT 0,
   duty_type VARCHAR(30) NOT NULL CHECK (duty_type IN ('BLOCK_PROPOSAL', 'CHECKPOINT_PROPOSAL', 'ATTESTATION', 'ATTESTATIONS_AND_SIGNERS', 'GOVERNANCE_VOTE', 'SLASHING_VOTE')),
   status VARCHAR(20) NOT NULL CHECK (status IN ('signing', 'signed')),
@@ -106,6 +107,7 @@ WITH inserted AS (
     validator_address,
     slot,
     block_number,
+    checkpoint_number,
     block_index_within_checkpoint,
     duty_type,
     status,
@@ -113,13 +115,14 @@ WITH inserted AS (
     node_id,
     lock_token,
     started_at
-  ) VALUES ($1, $2, $3, $4, $5, $6, 'signing', $7, $8, $9, CURRENT_TIMESTAMP)
+  ) VALUES ($1, $2, $3, $4, $5, $6, $7, 'signing', $8, $9, $10, CURRENT_TIMESTAMP)
   ON CONFLICT (rollup_address, validator_address, slot, duty_type, block_index_within_checkpoint) DO NOTHING
   RETURNING
     rollup_address,
     validator_address,
     slot,
     block_number,
+    checkpoint_number,
     block_index_within_checkpoint,
     duty_type,
     status,
@@ -139,6 +142,7 @@ SELECT
   validator_address,
   slot,
   block_number,
+  checkpoint_number,
   block_index_within_checkpoint,
   duty_type,
   status,
@@ -154,8 +158,8 @@ FROM validator_duties
 WHERE rollup_address = $1
   AND validator_address = $2
   AND slot = $3
-  AND duty_type = $6
-  AND block_index_within_checkpoint = $5
+  AND duty_type = $7
+  AND block_index_within_checkpoint = $6
   AND NOT EXISTS (SELECT 1 FROM inserted);
 `;
 
@@ -253,6 +257,7 @@ SELECT
   validator_address,
   slot,
   block_number,
+  checkpoint_number,
   block_index_within_checkpoint,
   duty_type,
   status,

package/src/db/types.ts

@@ -1,5 +1,5 @@
-import type { BlockNumber, CheckpointNumber, IndexWithinCheckpoint, SlotNumber } from '@aztec/foundation/branded-types';
-import type { EthAddress } from '@aztec/foundation/eth-address';
+import { BlockNumber, CheckpointNumber, type IndexWithinCheckpoint, SlotNumber } from '@aztec/foundation/branded-types';
+import { EthAddress } from '@aztec/foundation/eth-address';
 import type { Signature } from '@aztec/foundation/eth-signature';
 import { DutyType } from '@aztec/stdlib/ha-signing';
 
@@ -11,6 +11,7 @@ export interface DutyRow {
   validator_address: string;
   slot: string;
   block_number: string;
+  checkpoint_number: string;
   block_index_within_checkpoint: number;
   duty_type: DutyType;
   status: DutyStatus;
@@ -23,6 +24,31 @@ export interface DutyRow {
   error_message: string | null;
 }
 
+/**
+ * Plain-primitive representation of a duty record suitable for serialization
+ * (e.g. msgpackr for LMDB). All domain types are stored as their string/number
+ * equivalents. Timestamps are Unix milliseconds.
+ */
+export interface StoredDutyRecord {
+  rollupAddress: string;
+  validatorAddress: string;
+  slot: string;
+  blockNumber: string;
+  checkpointNumber: string;
+  blockIndexWithinCheckpoint: number;
+  dutyType: DutyType;
+  status: DutyStatus;
+  messageHash: string;
+  signature?: string;
+  nodeId: string;
+  lockToken: string;
+  /** Unix timestamp in milliseconds when signing started */
+  startedAtMs: number;
+  /** Unix timestamp in milliseconds when signing completed */
+  completedAtMs?: number;
+  errorMessage?: string;
+}
+
 /**
  * Row type from INSERT_OR_GET_DUTY query (includes is_new flag)
  */
@@ -42,7 +68,8 @@ export enum DutyStatus {
 export { DutyType };
 
 /**
- * Record of a validator duty in the database
+ * Rich representation of a validator duty, with branded types and Date objects.
+ * This is the common output type returned by all SlashingProtectionDatabase implementations.
  */
 export interface ValidatorDutyRecord {
   /** Ethereum address of the rollup contract */
@@ -51,8 +78,10 @@ export interface ValidatorDutyRecord {
   validatorAddress: EthAddress;
   /** Slot number for this duty */
   slot: SlotNumber;
-  /** Block number for this duty */
+  /** Block number for this duty (0 for non-block-proposal duties) */
   blockNumber: BlockNumber;
+  /** Checkpoint number for this duty (0 for attestation and vote duties) */
+  checkpointNumber: CheckpointNumber;
   /** Block index within checkpoint (0, 1, 2... for block proposals, -1 for other duty types) */
   blockIndexWithinCheckpoint: number;
   /** Type of duty being performed */
@@ -75,6 +104,32 @@ export interface ValidatorDutyRecord {
   errorMessage?: string;
 }
 
+/**
+ * Convert a {@link StoredDutyRecord} (plain-primitive wire format) to a
+ * {@link ValidatorDutyRecord} (rich domain type).
+ *
+ * Shared by LMDB and any future non-Postgres backend implementations.
+ */
+export function recordFromFields(stored: StoredDutyRecord): ValidatorDutyRecord {
+  return {
+    rollupAddress: EthAddress.fromString(stored.rollupAddress),
+    validatorAddress: EthAddress.fromString(stored.validatorAddress),
+    slot: SlotNumber.fromString(stored.slot),
+    blockNumber: BlockNumber.fromString(stored.blockNumber),
+    checkpointNumber: CheckpointNumber.fromString(stored.checkpointNumber),
+    blockIndexWithinCheckpoint: stored.blockIndexWithinCheckpoint,
+    dutyType: stored.dutyType,
+    status: stored.status,
+    messageHash: stored.messageHash,
+    signature: stored.signature,
+    nodeId: stored.nodeId,
+    lockToken: stored.lockToken,
+    startedAt: new Date(stored.startedAtMs),
+    completedAt: stored.completedAtMs !== undefined ? new Date(stored.completedAtMs) : undefined,
+    errorMessage: stored.errorMessage,
+  };
+}
+
 /**
  * Duty identifier for block proposals.
  * blockIndexWithinCheckpoint is REQUIRED and must be >= 0.
@@ -153,8 +208,10 @@ export function getBlockIndexFromDutyIdentifier(duty: DutyIdentifier): number {
  * Additional parameters for checking and recording a new duty
  */
 interface CheckAndRecordExtra {
-  /** Block number for this duty */
-  blockNumber: BlockNumber | CheckpointNumber;
+  /** Block number for this duty (0 for non-block-proposal duties) */
+  blockNumber: BlockNumber;
+  /** Checkpoint number for this duty (0 for attestation and vote duties) */
+  checkpointNumber: CheckpointNumber;
   /** The signing root (hash) for this duty */
   messageHash: string;
   /** Identifier for the node that acquired the lock */

package/src/errors.ts

@@ -22,6 +22,27 @@ export class DutyAlreadySignedError extends Error {
   }
 }
 
+/**
+ * Thrown when the slashing-protection record for an in-flight signing operation can no longer be
+ * updated because it is no longer owned by this node - for example, the stuck-duty cleanup loop
+ * deleted the SIGNING row while the remote signer was slow. The produced signature must be
+ * discarded rather than broadcast: with no protection record in place, a later attempt for the
+ * same duty with different data would sign freely, which is slashable equivocation.
+ */
+export class SigningLockLostError extends Error {
+  constructor(
+    public readonly slot: SlotNumber,
+    public readonly dutyType: DutyType,
+    public readonly nodeId: string,
+  ) {
+    super(
+      `Slashing protection record for ${dutyType} at slot ${slot} was lost before signing completed ` +
+        `(node ${nodeId}); discarding signature`,
+    );
+    this.name = 'SigningLockLostError';
+  }
+}
+
 /**
  * Thrown when attempting to sign data that conflicts with an already-signed duty.
  * This means the same validator tried to sign DIFFERENT data for the same slot.

package/src/factory.ts

@@ -1,15 +1,18 @@
 /**
  * Factory functions for creating validator HA signers
  */
+import { createLogger } from '@aztec/foundation/log';
 import { DateProvider } from '@aztec/foundation/timer';
-import type { ValidatorHASignerConfig } from '@aztec/stdlib/ha-signing';
+import { createStore } from '@aztec/kv-store/lmdb-v2';
+import type { LocalSignerConfig, ValidatorHASignerConfig } from '@aztec/stdlib/ha-signing';
 import { getTelemetryClient } from '@aztec/telemetry-client';
 
 import { Pool } from 'pg';
 
+import { LmdbSlashingProtectionDatabase, migrateLmdbSlashingProtectionDatabase } from './db/lmdb.js';
 import { PostgresSlashingProtectionDatabase } from './db/postgres.js';
 import { HASignerMetrics } from './metrics.js';
-import type { CreateHASignerDeps, SlashingProtectionDatabase } from './types.js';
+import type { CreateHASignerDeps, CreateLocalSignerWithProtectionDeps, SlashingProtectionDatabase } from './types.js';
 import { ValidatorHASigner } from './validator_ha_signer.js';
 
 /**
@@ -27,10 +30,9 @@ import { ValidatorHASigner } from './validator_ha_signer.js';
  * ```typescript
  * const { signer, db } = await createHASigner({
  *   databaseUrl: process.env.DATABASE_URL,
- *   haSigningEnabled: true,
  *   nodeId: 'validator-node-1',
  *   pollingIntervalMs: 100,
- *   signingTimeoutMs: 3000,
+ *   peerSigningTimeoutMs: 3000,
  * });
  * signer.start(); // Start background cleanup
  *
@@ -56,7 +58,8 @@ export async function createHASigner(
   const { databaseUrl, poolMaxCount, poolMinCount, poolIdleTimeoutMs, poolConnectionTimeoutMs, ...signerConfig } =
     config;
 
-  if (!databaseUrl) {
+  const databaseUrlValue = databaseUrl?.getValue();
+  if (!databaseUrlValue) {
     throw new Error('databaseUrl is required for createHASigner');
   }
 
@@ -67,7 +70,7 @@ export async function createHASigner(
   let pool: Pool;
   if (!deps?.pool) {
     pool = new Pool({
-      connectionString: databaseUrl,
+      connectionString: databaseUrlValue,
       max: poolMaxCount ?? 10,
       min: poolMinCount ?? 0,
       idleTimeoutMillis: poolIdleTimeoutMs ?? 10_000,
@@ -77,6 +80,16 @@ export async function createHASigner(
     pool = deps.pool;
   }
 
+  // pg re-emits idle-client errors (e.g. a Postgres restart severing an idle connection) on the
+  // pool. Without an 'error' listener, Node escalates these to an uncaughtException and crashes the
+  // process - taking down every HA replica sharing the DB at once. pg destroys and replaces the
+  // errored client itself, so logging is the only action needed. Log just message/code, never the
+  // raw error object (it can carry connection metadata).
+  const log = createLogger('validator-ha-signer:factory');
+  pool.on('error', (err: NodeJS.ErrnoException) => {
+    log.warn('Postgres pool error on idle client', { message: err.message, code: err.code });
+  });
+
   // Create database instance
   const db = new PostgresSlashingProtectionDatabase(pool);
 
@@ -87,7 +100,117 @@ export async function createHASigner(
   const metrics = new HASignerMetrics(telemetryClient, signerConfig.nodeId);
 
   // Create signer
-  const signer = new ValidatorHASigner(db, { ...signerConfig, databaseUrl }, { metrics, dateProvider });
+  const signer = new ValidatorHASigner(db, signerConfig, { metrics, dateProvider });
+
+  return { signer, db };
+}
+
+/**
+ * Create a local (single-node) signing protection signer backed by LMDB.
+ *
+ * This provides double-signing protection for nodes that are NOT running in a
+ * high-availability (multi-node) setup. It prevents a proposer from sending two
+ * proposals for the same slot if the node crashes and restarts mid-proposal.
+ *
+ * `config.dataDirectory` is required so the protection database is persisted to disk and survives
+ * crashes/restarts. Booting without it throws, since an ephemeral store silently drops all
+ * double-signing protection across restarts. Set `config.allowEphemeralSigningProtection` to opt
+ * into the ephemeral store anyway (dev/test networks only) — a loud warning is logged in that case.
+ *
+ * @param config - Local signer config
+ * @param deps - Optional dependencies (telemetry, date provider).
+ * @returns An object containing the signer and database instances.
+ */
+export async function createLocalSignerWithProtection(
+  config: LocalSignerConfig,
+  deps?: CreateLocalSignerWithProtectionDeps,
+): Promise<{
+  signer: ValidatorHASigner;
+  db: SlashingProtectionDatabase;
+}> {
+  const telemetryClient = deps?.telemetryClient ?? getTelemetryClient();
+  const dateProvider = deps?.dateProvider ?? new DateProvider();
 
+  const log = createLogger('validator-ha-signer:factory');
+
+  if (!config.dataDirectory) {
+    if (!config.allowEphemeralSigningProtection) {
+      throw new Error(
+        'Local signing protection requires a persistent data directory, but none was configured. ' +
+          'Set DATA_DIRECTORY so double-signing protection survives restarts, or explicitly opt into an ' +
+          'ephemeral store (dev/test only) with VALIDATOR_ALLOW_EPHEMERAL_SIGNING_PROTECTION=true.',
+      );
+    }
+    log.warn(
+      'Local signing protection is running with an EPHEMERAL store: no data directory is configured. ' +
+        'Double-signing protection will NOT survive a restart. This is unsafe for production validators.',
+    );
+  }
+
+  const kvStore = await createStore(
+    'signing-protection',
+    LmdbSlashingProtectionDatabase.SCHEMA_VERSION,
+    {
+      dataDirectory: config.dataDirectory,
+      dataStoreMapSizeKb: config.signingProtectionMapSizeKb ?? config.dataStoreMapSizeKb,
+      rollupAddress: config.rollupAddress,
+    },
+    undefined,
+    {
+      onUpgrade: (dataDirectory, currentVersion, latestVersion) =>
+        migrateLmdbSlashingProtectionDatabase(
+          dataDirectory,
+          currentVersion,
+          latestVersion,
+          config.signingProtectionMapSizeKb ?? config.dataStoreMapSizeKb,
+        ),
+      schemaVersionMismatchPolicy: 'throw',
+      versionFileReadFailurePolicy: 'throw',
+    },
+  );
+
+  const db = new LmdbSlashingProtectionDatabase(kvStore, dateProvider);
+
+  const signerConfig = {
+    ...config,
+    nodeId: config.nodeId || 'local',
+  };
+
+  const metrics = new HASignerMetrics(telemetryClient, signerConfig.nodeId, 'LocalSigningProtectionMetrics');
+
+  const signer = new ValidatorHASigner(db, signerConfig, { metrics, dateProvider });
+
+  return { signer, db };
+}
+
+/**
+ * Create an in-memory LMDB-backed SlashingProtectionDatabase that can be shared across
+ * multiple validator nodes in the same process. Used for testing HA setups.
+ */
+export async function createSharedSlashingProtectionDb(
+  dateProvider: DateProvider = new DateProvider(),
+): Promise<SlashingProtectionDatabase> {
+  const kvStore = await createStore('shared-signing-protection', LmdbSlashingProtectionDatabase.SCHEMA_VERSION, {
+    dataStoreMapSizeKb: 1024 * 1024,
+  });
+  return new LmdbSlashingProtectionDatabase(kvStore, dateProvider);
+}
+
+/**
+ * Create a ValidatorHASigner backed by a pre-existing SlashingProtectionDatabase.
+ * Used for testing HA setups where multiple nodes share the same protection database.
+ */
+export function createSignerFromSharedDb(
+  db: SlashingProtectionDatabase,
+  config: Pick<
+    ValidatorHASignerConfig,
+    'nodeId' | 'pollingIntervalMs' | 'peerSigningTimeoutMs' | 'maxStuckDutiesAgeMs' | 'rollupAddress'
+  >,
+  deps?: CreateLocalSignerWithProtectionDeps,
+): { signer: ValidatorHASigner; db: SlashingProtectionDatabase } {
+  const telemetryClient = deps?.telemetryClient ?? getTelemetryClient();
+  const dateProvider = deps?.dateProvider ?? new DateProvider();
+  const metrics = new HASignerMetrics(telemetryClient, config.nodeId, 'SharedSigningProtectionMetrics');
+  const signer = new ValidatorHASigner(db, config, { metrics, dateProvider });
   return { signer, db };
 }

package/src/slashing_protection_service.ts

@@ -8,7 +8,7 @@ import { type Logger, createLogger } from '@aztec/foundation/log';
 import { RunningPromise } from '@aztec/foundation/promise';
 import { sleep } from '@aztec/foundation/sleep';
 import type { DateProvider } from '@aztec/foundation/timer';
-import type { ValidatorHASignerConfig } from '@aztec/stdlib/ha-signing';
+import type { BaseSignerConfig } from '@aztec/stdlib/ha-signing';
 
 import {
   type CheckAndRecordParams,
@@ -26,6 +26,9 @@ export interface SlashingProtectionServiceDeps {
   dateProvider: DateProvider;
 }
 
+/** Default max age (ms) of a stuck SIGNING duty before cleanup reclaims it: 2x the 72s Aztec slot duration. */
+export const DEFAULT_MAX_STUCK_DUTIES_AGE_MS = 144_000;
+
 /**
  * Slashing Protection Service
  *
@@ -44,7 +47,7 @@ export interface SlashingProtectionServiceDeps {
 export class SlashingProtectionService {
   private readonly log: Logger;
   private readonly pollingIntervalMs: number;
-  private readonly signingTimeoutMs: number;
+  private readonly peerSigningTimeoutMs: number;
   private readonly maxStuckDutiesAgeMs: number;
 
   private readonly metrics: HASignerMetrics;
@@ -55,14 +58,13 @@ export class SlashingProtectionService {
 
   constructor(
     private readonly db: SlashingProtectionDatabase,
-    private readonly config: ValidatorHASignerConfig,
+    private readonly config: BaseSignerConfig,
     deps: SlashingProtectionServiceDeps,
   ) {
     this.log = createLogger('slashing-protection');
     this.pollingIntervalMs = config.pollingIntervalMs;
-    this.signingTimeoutMs = config.signingTimeoutMs;
-    // Default to 144s (2x 72s Aztec slot duration) if not explicitly configured
-    this.maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? 144_000;
+    this.peerSigningTimeoutMs = config.peerSigningTimeoutMs;
+    this.maxStuckDutiesAgeMs = config.maxStuckDutiesAgeMs ?? DEFAULT_MAX_STUCK_DUTIES_AGE_MS;
 
     this.cleanupRunningPromise = new RunningPromise(this.cleanup.bind(this), this.log, this.maxStuckDutiesAgeMs);
     this.metrics = deps.metrics;
@@ -99,7 +101,7 @@ export class SlashingProtectionService {
 
       if (isNew) {
         // We successfully acquired the lock
-        this.log.info(`Acquired lock for duty ${dutyType} at slot ${slot}`, {
+        this.log.verbose(`Acquired lock for duty ${dutyType} at slot ${slot}`, {
           validatorAddress: validatorAddress.toString(),
           nodeId,
         });
@@ -132,10 +134,10 @@ export class SlashingProtectionService {
         throw new DutyAlreadySignedError(slot, dutyType, record.blockIndexWithinCheckpoint, record.nodeId);
       } else if (record.status === DutyStatus.SIGNING) {
         // Another node is currently signing - check for timeout
-        if (this.dateProvider.now() - startTime > this.signingTimeoutMs) {
+        if (this.dateProvider.now() - startTime > this.peerSigningTimeoutMs) {
           this.log.warn(`Timeout waiting for signing to complete for duty ${dutyType} at slot ${slot}`, {
             validatorAddress: validatorAddress.toString(),
-            timeoutMs: this.signingTimeoutMs,
+            timeoutMs: this.peerSigningTimeoutMs,
             signingNodeId: record.nodeId,
           });
           this.metrics.recordDutyAlreadySigned(dutyType);
@@ -177,7 +179,7 @@ export class SlashingProtectionService {
     );
 
     if (success) {
-      this.log.info(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
+      this.log.verbose(`Recorded successful signing for duty ${dutyType} at slot ${slot}`, {
         validatorAddress: validatorAddress.toString(),
         nodeId,
       });
@@ -241,10 +243,10 @@ export class SlashingProtectionService {
    */
   async start() {
     // One-time cleanup at startup: remove duties from previous rollup versions
-    const numOutdatedRollupDuties = await this.db.cleanupOutdatedRollupDuties(this.config.l1Contracts.rollupAddress);
+    const numOutdatedRollupDuties = await this.db.cleanupOutdatedRollupDuties(this.config.rollupAddress);
     if (numOutdatedRollupDuties > 0) {
       this.log.info(`Cleaned up ${numOutdatedRollupDuties} duties with outdated rollup address at startup`, {
-        currentRollupAddress: this.config.l1Contracts.rollupAddress.toString(),
+        currentRollupAddress: this.config.rollupAddress.toString(),
       });
       this.metrics.recordCleanup('outdated_rollup', numOutdatedRollupDuties);
     }
@@ -275,7 +277,10 @@ export class SlashingProtectionService {
    * Runs in the background via RunningPromise.
    */
   private async cleanup() {
-    // 1. Clean up stuck duties (our own node's duties that got stuck in 'signing' status)
+    // 1. Clean up stuck duties (our own node's duties that got stuck in 'signing' status).
+    // This cannot race an in-flight signing: every signing operation is hard-bounded by a timeout
+    // clamped below maxStuckDutiesAgeMs / 2 (see ValidatorHASigner), so a live SIGNING row is
+    // always released long before it can be considered stuck.
     const numStuckDuties = await this.db.cleanupOwnStuckDuties(this.config.nodeId, this.maxStuckDutiesAgeMs);
     if (numStuckDuties > 0) {
       this.log.verbose(`Cleaned up ${numStuckDuties} stuck duties`, {