@lodestar/validator 1.43.0-rc.5 → 1.44.0-dev.1a8c38ee36

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lodestar/validator",
-  "version": "1.43.0-rc.5",
+  "version": "1.44.0-dev.1a8c38ee36",
   "description": "A Typescript implementation of the validator client",
   "author": "ChainSafe Systems",
   "license": "Apache-2.0",
@@ -50,21 +50,21 @@
   "dependencies": {
     "@chainsafe/blst": "^2.2.0",
     "@chainsafe/ssz": "^1.4.0",
-    "@lodestar/api": "^1.43.0-rc.5",
-    "@lodestar/config": "^1.43.0-rc.5",
-    "@lodestar/db": "^1.43.0-rc.5",
-    "@lodestar/params": "^1.43.0-rc.5",
-    "@lodestar/state-transition": "^1.43.0-rc.5",
-    "@lodestar/types": "^1.43.0-rc.5",
-    "@lodestar/utils": "^1.43.0-rc.5",
+    "@lodestar/api": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/config": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/db": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/params": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/state-transition": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/types": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/utils": "^1.44.0-dev.1a8c38ee36",
     "strict-event-emitter-types": "^2.0.0"
   },
   "devDependencies": {
-    "@lodestar/logger": "^1.43.0-rc.5",
-    "@lodestar/spec-test-util": "^1.43.0-rc.5",
-    "@lodestar/test-utils": "^1.43.0-rc.5",
+    "@lodestar/logger": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/spec-test-util": "^1.44.0-dev.1a8c38ee36",
+    "@lodestar/test-utils": "^1.44.0-dev.1a8c38ee36",
     "@vekexasia/bigint-buffer2": "^1.1.1",
     "rimraf": "^4.4.1"
   },
-  "gitHead": "d7caddaad924496813904b3049464c02a99d7c46"
+  "gitHead": "f34aa8a4d6de39ccb11977b25f1abce7ba6f7908"
 }

package/src/services/block.ts

@@ -52,18 +52,12 @@ export class BlockProposingService {
     private readonly api: ApiClient,
     private readonly clock: IClock,
     private readonly validatorStore: ValidatorStore,
+    dutiesService: BlockDutiesService,
     private readonly metrics: Metrics | null,
     private readonly opts: BlockProposalOpts
   ) {
-    this.dutiesService = new BlockDutiesService(
-      config,
-      logger,
-      api,
-      clock,
-      validatorStore,
-      metrics,
-      this.notifyBlockProductionFn
-    );
+    this.dutiesService = dutiesService;
+    this.dutiesService.setNotifyBlockProductionFn(this.notifyBlockProductionFn);
   }
 
   removeDutiesForKey(pubkey: PubkeyHex): void {

package/src/services/blockDuties.ts

@@ -1,18 +1,28 @@
 import {ApiClient, routes} from "@lodestar/api";
 import {ChainForkConfig} from "@lodestar/config";
+import {isForkPostFulu} from "@lodestar/params";
 import {computeEpochAtSlot, computeStartSlotAtEpoch} from "@lodestar/state-transition";
 import {BLSPubkey, Epoch, RootHex, Slot} from "@lodestar/types";
 import {sleep, toPubkeyHex} from "@lodestar/utils";
 import {Metrics} from "../metrics.js";
 import {PubkeyHex} from "../types.js";
-import {IClock, LoggerVc, differenceHex} from "../util/index.js";
+import {IClock, LoggerVc} from "../util/index.js";
+import {ChainHeaderTracker, HeadEventData} from "./chainHeaderTracker.js";
 import {ValidatorStore} from "./validatorStore.js";
 
-/** This polls block duties 1s before the next epoch */
+/**
+ * Pre-Fulu only: poll next-epoch proposer duties ~1s before the boundary. Post-Fulu the 1-epoch
+ * deterministic lookahead lets us pre-fetch via `runEveryEpoch`, so this fast path is unused.
+ *
+ * Historical context: starting Jul 2023 we poll 1s before the next epoch because
+ * `PrepareNextSlotScheduler` (BN-side) usually finishes the upcoming-epoch transition in ~3s,
+ * so the proposer-duties query at ~1s pre-boundary lands on a hot cache. See:
+ *  - https://github.com/ChainSafe/lodestar/issues/5792
+ */
 // TODO: change to 8333 (5/6 of slot) to do it 2s before the next epoch
 // once we have some improvement on epoch transition time
 // see https://github.com/ChainSafe/lodestar/issues/5792#issuecomment-1647457442
-// TODO GLOAS: re-evaluate timing
+// TODO GLOAS: re-evaluate timing — Gloas may want the offset *after* the boundary
 const BLOCK_DUTIES_LOOKAHEAD_BPS = 9167;
 /** Only retain `HISTORICAL_DUTIES_EPOCHS` duties prior to the current epoch */
 const HISTORICAL_DUTIES_EPOCHS = 2;
@@ -20,31 +30,42 @@ const HISTORICAL_DUTIES_EPOCHS = 2;
 const GENESIS_EPOCH = 0;
 export const GENESIS_SLOT = 0;
 
-type BlockDutyAtEpoch = {dependentRoot: RootHex; data: routes.validator.ProposerDuty[]};
+export type BlockDutyAtEpoch = {dependentRoot: RootHex; data: routes.validator.ProposerDuty[]};
 type NotifyBlockProductionFn = (slot: Slot, proposers: BLSPubkey[]) => void;
 
 export class BlockDutiesService {
   /** Notify the block service if it should produce a block. */
-  private readonly notifyBlockProductionFn: NotifyBlockProductionFn;
+  private notifyBlockProductionFn: NotifyBlockProductionFn = () => {};
   /** Maps an epoch to all *local* proposers in this epoch. Notably, this does not contain
       proposals for any validators which are not registered locally. */
   private readonly proposers = new Map<Epoch, BlockDutyAtEpoch>();
 
+  /**
+   * Tracks which proposer pubkeys we have already notified for the active slot so that
+   * a late-arriving cache update (SSE-driven refetch, slow initial poll) only fires
+   * `notifyBlockProductionFn` for *newly discovered* proposers, never duplicates.
+   */
+  private notifiedSlot: Slot = -1;
+  private readonly notifiedProposers = new Set<PubkeyHex>();
+  /**
+   * True once `notifyProposersForSlot` has been invoked for `notifiedSlot`, regardless of
+   * whether anything was notified. Any subsequent invocation that finds *new* proposers is
+   * therefore a late detection — the signal tracked by `newProposalDutiesDetected`.
+   */
+  private notifiedSlotInitialPass = false;
+
   constructor(
     private readonly config: ChainForkConfig,
     private readonly logger: LoggerVc,
     private readonly api: ApiClient,
     private readonly clock: IClock,
     private readonly validatorStore: ValidatorStore,
-    private readonly metrics: Metrics | null,
-    notifyBlockProductionFn: NotifyBlockProductionFn
+    chainHeaderTracker: ChainHeaderTracker,
+    private readonly metrics: Metrics | null
   ) {
-    this.notifyBlockProductionFn = notifyBlockProductionFn;
-
-    // TODO: Instead of polling every CLOCK_SLOT, poll every CLOCK_EPOCH and track re-org events
-    //       only then re-fetch the block duties. Make sure most clients (including Lodestar)
-    //       properly emit the re-org event
-    clock.runEverySlot(this.runBlockDutiesTask);
+    clock.runEveryEpoch(this.runEveryEpochTask);
+    clock.runEverySlot(this.runEverySlotTask);
+    chainHeaderTracker.runOnNewHead(this.onNewHead);
 
     if (metrics) {
       metrics.proposerDutiesEpochCount.addCollect(() => {
@@ -53,6 +74,14 @@ export class BlockDutiesService {
     }
   }
 
+  /**
+   * Late-bind the production callback. Allows the duties service to be constructed
+   * before the consumer that handles proposal production.
+   */
+  setNotifyBlockProductionFn(notifyBlockProductionFn: NotifyBlockProductionFn): void {
+    this.notifyBlockProductionFn = notifyBlockProductionFn;
+  }
+
   /**
    * Returns the pubkeys of the validators which are assigned to propose in the given slot.
    *
@@ -75,6 +104,16 @@ export class BlockDutiesService {
     return Array.from(publicKeys.values());
   }
 
+  /**
+   * Returns the cached `{dependentRoot, data}` entry for `epoch`, or `undefined` if duties
+   * for that epoch are not yet known. Consumers can detect a proposer-shuffling change
+   * (e.g. after a reorg) by observing a different `dependentRoot` than the one they last
+   * read for the same epoch.
+   */
+  getProposersAtEpoch(epoch: Epoch): BlockDutyAtEpoch | undefined {
+    return this.proposers.get(epoch);
+  }
+
   removeDutiesForKey(pubkey: PubkeyHex): void {
     for (const blockDutyAtEpoch of this.proposers.values()) {
       blockDutyAtEpoch.data = blockDutyAtEpoch.data.filter((proposer) => {
@@ -83,108 +122,191 @@ export class BlockDutiesService {
     }
   }
 
-  private runBlockDutiesTask = async (slot: Slot, signal: AbortSignal): Promise<void> => {
+  /**
+   * Baseline per-epoch fetch. Fires at epoch boundaries (and once at startup). Post-Fulu the
+   * deterministic 1-epoch lookahead lets us also pre-fetch `epoch + 1`; pre-Fulu the next
+   * epoch's dep_root only stabilizes at the boundary and is handled by `runEverySlotTask`.
+   *
+   * Mid-epoch refreshes (e.g. reorgs) are driven by `onNewHead` instead of polling every slot.
+   */
+  private runEveryEpochTask = async (epoch: Epoch): Promise<void> => {
     try {
-      if (slot < 0) {
-        // Before genesis, fetch the genesis duties but don't notify block production
-        // Only fetch duties once since there is not possible to re-org. TODO: Review
+      if (epoch < GENESIS_EPOCH) {
+        // Pre-genesis: prime the genesis-epoch duties exactly once so the slot-0 proposer
+        // doesn't have to wait on a cold cache. Only fetch once since a pre-genesis re-org
+        // is not possible. TODO: Review.
         if (!this.proposers.has(GENESIS_EPOCH)) {
           await this.pollBeaconProposers(GENESIS_EPOCH);
         }
-      } else {
-        await this.pollBeaconProposersAndNotify(slot, signal);
+        return;
+      }
+
+      await this.pollBeaconProposers(epoch);
+
+      const nextEpoch = epoch + 1;
+      if (isForkPostFulu(this.config.getForkName(computeStartSlotAtEpoch(nextEpoch)))) {
+        await this.pollBeaconProposers(nextEpoch);
       }
     } catch (e) {
-      this.logger.error("Error on pollBeaconProposers", {}, e as Error);
+      this.logger.error("Error on runEveryEpochTask", {epoch}, e as Error);
     } finally {
-      this.pruneOldDuties(computeEpochAtSlot(slot));
+      this.pruneOldDuties(Math.max(epoch, GENESIS_EPOCH));
     }
   };
 
   /**
-   * Download the proposer duties for the current epoch and store them in `this.proposers`.
-   * If there are any proposer for this slot, send out a notification to the block proposers.
-   *
-   * ## Note
-   *
-   * This function will potentially send *two* notifications to the `BlockService`; it will send a
-   * notification initially, then it will download the latest duties and send a *second* notification
-   * if those duties have changed. This behaviour simultaneously achieves the following:
+   * Slot-tick handler. Notifies block production for cached proposers in this slot, and on
+   * the last slot of a pre-Fulu epoch schedules the boundary fetch for `nextEpoch` duties.
+   * Reorg detection is handled by `onNewHead`, so this task does not re-poll on every slot.
+   */
+  private runEverySlotTask = async (slot: Slot, signal: AbortSignal): Promise<void> => {
+    try {
+      if (slot < GENESIS_SLOT) {
+        return;
+      }
+
+      this.notifyProposersForSlot(slot);
+
+      const nextEpoch = computeEpochAtSlot(slot) + 1;
+      const isLastSlotOfEpoch = computeStartSlotAtEpoch(nextEpoch) === slot + 1;
+      if (isLastSlotOfEpoch && !isForkPostFulu(this.config.getForkName(slot + 1))) {
+        // Pre-Fulu: 0-epoch proposer lookahead, so the next-epoch dep_root only becomes stable
+        // as the last block of the current epoch lands. Sleep until ~1s before the boundary
+        // then fetch — same timing as before this refactor.
+        this.pollBeaconProposersBeforeBoundary(slot, nextEpoch, signal).catch((e) => {
+          this.logger.error("Error on pollBeaconProposersBeforeBoundary", {nextEpoch}, e);
+        });
+      }
+    } catch (e) {
+      this.logger.error("Error on runEverySlotTask", {slot}, e as Error);
+    }
+  };
+
+  /**
+   * SSE head-event handler. The beacon-API `head` event carries attester-duty dep_roots,
+   * which coincide with the proposer dep_roots at a fork-dependent offset:
    *
-   * 1. Block production can happen immediately and does not have to wait for the proposer duties to
-   *    download.
-   * 2. We won't miss a block if the duties for the current slot happen to change with this poll.
+   *   Pre-Fulu  (proposer dep_root(E) = block@startSlot(E) - 1):
+   *     currentDutyDependentRoot  ≡ proposer_dep_root(currentEpoch)
+   *     (next-epoch proposer dep_root is not exposed; pre-Fulu falls back to the
+   *      `runEverySlotTask` boundary poll.)
    *
-   * This sounds great, but is it safe? Firstly, the additional notification will only contain block
-   * producers that were not included in the first notification. This should be safety enough.
-   * However, we also have the slashing protection as a second line of defense. These two factors
-   * provide an acceptable level of safety.
+   *   Post-Fulu (proposer dep_root(E) = block@startSlot(E - 1) - 1, EIP-7917):
+   *     previousDutyDependentRoot ≡ proposer_dep_root(currentEpoch)
+   *     currentDutyDependentRoot  ≡ proposer_dep_root(nextEpoch)
    *
-   * It's important to note that since there is a 0-epoch look-ahead (i.e., no look-ahead) for block
-   * proposers then it's very likely that a proposal for the first slot of the epoch will need go
-   * through the slow path every time. I.e., the proposal will only happen after we've been able to
-   * download and process the duties from the BN. This means it is very important to ensure this
-   * function is as fast as possible.
-   *   - Starting from Jul 2023, we poll proposers 1s before the next epoch thanks to PrepareNextSlotScheduler
-   * usually finishes in 3s.
+   * On a dep_root mismatch (reorg, or initial sync delivering a fresher head) we refetch
+   * just the affected epoch, mirroring `AttestationDutiesService.onNewHead`.
    */
-  private async pollBeaconProposersAndNotify(currentSlot: Slot, signal: AbortSignal): Promise<void> {
-    const nextEpoch = computeEpochAtSlot(currentSlot) + 1;
-    const isLastSlotEpoch = computeStartSlotAtEpoch(nextEpoch) === currentSlot + 1;
-    if (isLastSlotEpoch) {
-      // no need to await for other steps, just poll proposers for next epoch
-      this.pollBeaconProposersNextEpoch(currentSlot, nextEpoch, signal).catch((e) => {
-        this.logger.error("Error on pollBeaconProposersNextEpoch", {}, e);
-      });
-    }
+  private onNewHead = async ({
+    slot,
+    previousDutyDependentRoot,
+    currentDutyDependentRoot,
+  }: HeadEventData): Promise<void> => {
+    const currentEpoch = computeEpochAtSlot(slot);
+    const isPostFulu = isForkPostFulu(this.config.getForkName(slot));
 
-    // Notify the block proposal service for any proposals that we have in our cache.
-    const initialBlockProposers = this.getblockProposersAtSlot(currentSlot);
-    if (initialBlockProposers.length > 0) {
-      this.notifyBlockProductionFn(currentSlot, initialBlockProposers);
+    if (isPostFulu) {
+      await this.refetchIfDepRootChanged(currentEpoch, previousDutyDependentRoot);
+      await this.refetchIfDepRootChanged(currentEpoch + 1, currentDutyDependentRoot);
+    } else {
+      await this.refetchIfDepRootChanged(currentEpoch, currentDutyDependentRoot);
     }
+  };
 
-    // Poll proposers again for the same slot
-    await this.pollBeaconProposers(computeEpochAtSlot(currentSlot));
-
-    // Compute the block proposers for this slot again, now that we've received an update from the BN.
-    //
-    // Then, compute the difference between these two sets to obtain a set of block proposers
-    // which were not included in the initial notification to the `BlockService`.
-    const newBlockProducers = this.getblockProposersAtSlot(currentSlot);
-    const additionalBlockProducers = differenceHex(initialBlockProposers, newBlockProducers);
-
-    // If there are any new proposers for this slot, send a notification so they produce a block.
-    //
-    // See the function-level documentation for more reasoning about this behaviour.
-    if (additionalBlockProducers.length > 0) {
-      this.notifyBlockProductionFn(currentSlot, additionalBlockProducers);
-      this.logger.debug("Detected new block proposer", {currentSlot});
-      this.metrics?.newProposalDutiesDetected.inc();
+  private async refetchIfDepRootChanged(epoch: Epoch, expectedDepRoot: RootHex): Promise<void> {
+    const cached = this.proposers.get(epoch);
+    if (!cached || cached.dependentRoot === expectedDepRoot) {
+      return;
     }
+
+    this.logger.debug("Proposer duties dep_root changed, refetching", {
+      epoch,
+      priorDependentRoot: cached.dependentRoot,
+      newDependentRoot: expectedDepRoot,
+    });
+    await this.pollBeaconProposers(epoch);
   }
 
   /**
-   * This is to avoid some delay on the first slot of the epoch when validators have proposal duties.
-   * See https://github.com/ChainSafe/lodestar/issues/5792
+   * Pre-Fulu boundary fetch. Because pre-Fulu proposer shuffling has 0-epoch look-ahead, a
+   * proposal for the first slot of the new epoch otherwise goes through the slow path every
+   * time: the proposal can only happen *after* we download and process the new duties from
+   * the BN. Polling ~1s before the boundary, while `PrepareNextSlotScheduler` is finishing
+   * the upcoming-epoch transition, lets us land on a hot BN cache and avoid the miss.
+   *
+   * See https://github.com/ChainSafe/lodestar/issues/5792.
    */
-  private async pollBeaconProposersNextEpoch(currentSlot: Slot, nextEpoch: Epoch, signal: AbortSignal): Promise<void> {
+  private async pollBeaconProposersBeforeBoundary(
+    currentSlot: Slot,
+    nextEpoch: Epoch,
+    signal: AbortSignal
+  ): Promise<void> {
     const nextSlot = currentSlot + 1;
     const lookAheadMs =
       this.config.SLOT_DURATION_MS - this.config.getSlotComponentDurationMs(BLOCK_DUTIES_LOOKAHEAD_BPS);
     await sleep(this.clock.msToSlot(nextSlot) - lookAheadMs, signal);
-    this.logger.debug("Polling proposers for next epoch", {nextEpoch, nextSlot});
-    // Poll proposers for the next epoch
+    this.logger.debug("Polling proposers for the next epoch", {nextEpoch, currentSlot});
     await this.pollBeaconProposers(nextEpoch);
   }
 
+  /**
+   * Notify block production for *newly discovered* proposers in this slot. Notifications are
+   * deduplicated per-slot so that a late SSE refetch can extend the proposer set without
+   * triggering a duplicate `createAndPublishBlock` for already-notified validators.
+   *
+   * ## Multi-notification safety
+   *
+   * Within a single slot the cache can be updated from several sources (cold-cache backfill at
+   * startup, SSE-driven reorg refetch). Each update may fire this function again. The contract
+   * we keep is: each pubkey is notified *at most once per slot*. The additional notifications
+   * only carry proposers that were not part of an earlier notification.
+   *
+   * Is this safe? Firstly, the dedup above guarantees we never ask the same validator to
+   * propose twice for the same slot. Secondly, slashing protection in `ValidatorStore` acts as
+   * a second line of defense should the dedup ever fail. Together they provide an acceptable
+   * level of safety for the "notify-from-cache, refine-after-refetch" pattern.
+   */
+  private notifyProposersForSlot(slot: Slot): void {
+    if (slot !== this.notifiedSlot) {
+      this.notifiedSlot = slot;
+      this.notifiedSlotInitialPass = false;
+      this.notifiedProposers.clear();
+    }
+
+    const isLateDetection = this.notifiedSlotInitialPass;
+    this.notifiedSlotInitialPass = true;
+
+    const newProposers: BLSPubkey[] = [];
+    for (const pubkey of this.getblockProposersAtSlot(slot)) {
+      const pubkeyHex = toPubkeyHex(pubkey);
+      if (!this.notifiedProposers.has(pubkeyHex)) {
+        this.notifiedProposers.add(pubkeyHex);
+        newProposers.push(pubkey);
+      }
+    }
+
+    if (newProposers.length === 0) {
+      return;
+    }
+
+    if (isLateDetection) {
+      this.metrics?.newProposalDutiesDetected.inc();
+      this.logger.debug("Detected new block proposer", {slot});
+    }
+    this.notifyBlockProductionFn(slot, newProposers);
+  }
+
   private async pollBeaconProposers(epoch: Epoch): Promise<void> {
     // Only download duties and push out additional block production events if we have some validators.
     if (!this.validatorStore.hasSomeValidators()) {
       return;
     }
 
-    const res = await this.api.validator.getProposerDuties({epoch});
+    // Post-Fulu the proposer dependent root changed (deterministic proposer lookahead)
+    const res = isForkPostFulu(this.config.getForkName(computeStartSlotAtEpoch(epoch)))
+      ? await this.api.validator.getProposerDutiesV2({epoch})
+      : await this.api.validator.getProposerDuties({epoch});
     const proposerDuties = res.value();
     const {dependentRoot} = res.meta();
     const relevantDuties = proposerDuties.filter((duty) => {
@@ -195,6 +317,11 @@ export class BlockDutiesService {
     this.logger.debug("Downloaded proposer duties", {epoch, dependentRoot, count: relevantDuties.length});
 
     const prior = this.proposers.get(epoch);
+    // Concurrent polls for the same epoch (e.g. `onNewHead` and `runEveryEpochTask` racing)
+    // both write here last-write-wins. The pre-refactor per-slot poll healed any stale write
+    // on the next slot; in the event-driven model staleness can persist until the next
+    // dep_root change. In practice the same BN serves both calls so they return identical
+    // payloads — accept the rare race rather than serialising fetches.
     this.proposers.set(epoch, {dependentRoot, data: relevantDuties});
 
     if (prior && prior.dependentRoot !== dependentRoot) {
@@ -204,6 +331,12 @@ export class BlockDutiesService {
         dependentRoot,
       });
     }
+
+    // If this fetch revealed proposer(s) for the active slot that the last `runEverySlotTask`
+    // missed (cold cache at startup, or duties shifted by a reorg), notify now.
+    if (this.notifiedSlot >= GENESIS_SLOT && computeEpochAtSlot(this.notifiedSlot) === epoch) {
+      this.notifyProposersForSlot(this.notifiedSlot);
+    }
   }
 
   /** Run once per epoch to prune `this.proposers` map */

package/src/services/proposerPreferences.ts

@@ -0,0 +1,124 @@
+import {ApiClient} from "@lodestar/api";
+import {ChainForkConfig} from "@lodestar/config";
+import {SLOTS_PER_EPOCH, isForkPostGloas} from "@lodestar/params";
+import {computeEpochAtSlot} from "@lodestar/state-transition";
+import {Epoch, RootHex, Slot, gloas} from "@lodestar/types";
+import {fromHex, toPubkeyHex} from "@lodestar/utils";
+import {Metrics} from "../metrics.js";
+import {IClock, LoggerVc} from "../util/index.js";
+import {BlockDutiesService} from "./blockDuties.js";
+import {ValidatorStore} from "./validatorStore.js";
+
+/**
+ * Submit a proposer's `SignedProposerPreferences` this many slots before the proposal slot.
+ *
+ * Earlier submission means more reorg-triggered resubmits (and gossip flood); later
+ * submission risks missing the bid-auction window for this proposal slot. The bid for
+ * slot S typically arrives at slot S-1, so we want preferences propagated to the network
+ * and consumed by builders before then. SLOTS_PER_EPOCH / 4 (8 slots @ 32 SPE, ~96s @ 12s
+ * slots) gives ample margin while bounding redundant resubmits.
+ */
+const SUBMIT_BEFORE_PROPOSAL_SLOTS = Math.floor(SLOTS_PER_EPOCH / 4);
+
+/** Per-epoch tracking of preferences already submitted under the current dependent_root. */
+type SubmittedAtEpoch = {dependentRoot: RootHex; slots: Set<Slot>};
+
+/**
+ * Signs and submits `SignedProposerPreferences` for any local validator that will propose
+ * within the next `SUBMIT_BEFORE_PROPOSAL_SLOTS`. Re-submits automatically when the proposer
+ * dependent root for an epoch shifts (e.g. after a reorg) — detected by comparing the cached
+ * `dependentRoot` reported by `BlockDutiesService` against the one we last submitted under.
+ *
+ * No-op pre-gloas.
+ */
+export class ProposerPreferencesService {
+  private readonly submitted = new Map<Epoch, SubmittedAtEpoch>();
+
+  constructor(
+    private readonly config: ChainForkConfig,
+    private readonly logger: LoggerVc,
+    private readonly api: ApiClient,
+    clock: IClock,
+    private readonly validatorStore: ValidatorStore,
+    private readonly blockDutiesService: BlockDutiesService,
+    _metrics: Metrics | null
+  ) {
+    clock.runEverySlot(this.runProposerPreferencesTask);
+  }
+
+  private runProposerPreferencesTask = async (slot: Slot): Promise<void> => {
+    if (!isForkPostGloas(this.config.getForkName(slot))) {
+      return;
+    }
+
+    const currentEpoch = computeEpochAtSlot(slot);
+    const batch: gloas.SignedProposerPreferences[] = [];
+    // Track which `(submission, slot)` pairs are pending an API submission so we can mark
+    // them only after the network call succeeds. Marking before would silently drop a
+    // preference on transient API failure (no retry until dependent_root shifts).
+    const pending: {submission: SubmittedAtEpoch; slot: Slot}[] = [];
+
+    for (const epoch of [currentEpoch, currentEpoch + 1]) {
+      const dutiesAtEpoch = this.blockDutiesService.getProposersAtEpoch(epoch);
+      if (!dutiesAtEpoch) continue;
+
+      // Reset submission tracking if the dependent root for this epoch has shifted
+      // (e.g. due to a reorg). Any previously-submitted preferences are now stale.
+      let submission = this.submitted.get(epoch);
+      if (submission === undefined || submission.dependentRoot !== dutiesAtEpoch.dependentRoot) {
+        if (submission !== undefined) {
+          this.logger.info("Proposer-shuffling dependent root shifted; resubmitting preferences", {
+            epoch,
+            priorDependentRoot: submission.dependentRoot,
+            dependentRoot: dutiesAtEpoch.dependentRoot,
+          });
+        }
+        submission = {dependentRoot: dutiesAtEpoch.dependentRoot, slots: new Set()};
+        this.submitted.set(epoch, submission);
+      }
+
+      const dependentRootBytes = fromHex(dutiesAtEpoch.dependentRoot);
+
+      for (const duty of dutiesAtEpoch.data) {
+        if (duty.slot <= slot) continue;
+        if (duty.slot > slot + SUBMIT_BEFORE_PROPOSAL_SLOTS) continue;
+        if (submission.slots.has(duty.slot)) continue;
+
+        try {
+          const pubkeyHex = toPubkeyHex(duty.pubkey);
+          const signed = await this.validatorStore.signProposerPreferences(
+            duty,
+            dependentRootBytes,
+            this.validatorStore.getFeeRecipient(pubkeyHex),
+            this.validatorStore.getGasLimit(pubkeyHex),
+            slot
+          );
+          batch.push(signed);
+          pending.push({submission, slot: duty.slot});
+        } catch (e) {
+          this.logger.error(
+            "Error signing proposer preferences",
+            {slot: duty.slot, validatorIndex: duty.validatorIndex},
+            e as Error
+          );
+        }
+      }
+    }
+
+    if (batch.length === 0) {
+      return;
+    }
+
+    try {
+      await this.api.beacon.submitSignedProposerPreferences({signedProposerPreferences: batch});
+      // Only mark as submitted after the API call succeeds; a thrown error leaves the
+      // slot eligible for retry on the next tick.
+      for (const {submission, slot: submittedSlot} of pending) {
+        submission.slots.add(submittedSlot);
+      }
+      this.logger.debug("Submitted signed proposer preferences", {count: batch.length});
+    } catch (e) {
+      this.logger.error("Error submitting signed proposer preferences", {count: batch.length}, e as Error);
+    }
+  };
+}

package/src/services/validatorStore.ts

@@ -9,6 +9,7 @@ import {
   DOMAIN_BEACON_BUILDER,
   DOMAIN_BEACON_PROPOSER,
   DOMAIN_CONTRIBUTION_AND_PROOF,
+  DOMAIN_PROPOSER_PREFERENCES,
   DOMAIN_PTC_ATTESTER,
   DOMAIN_RANDAO,
   DOMAIN_SELECTION_PROOF,
@@ -704,6 +705,42 @@ export class ValidatorStore {
     };
   }
 
+  async signProposerPreferences(
+    duty: routes.validator.ProposerDuty,
+    dependentRoot: Uint8Array,
+    feeRecipient: ExecutionAddress,
+    gasLimit: number,
+    currentSlot: Slot
+  ): Promise<gloas.SignedProposerPreferences> {
+    if (duty.slot <= currentSlot) {
+      throw Error(`Not signing proposer preferences for past slot ${duty.slot} (current ${currentSlot})`);
+    }
+
+    this.assertDoppelgangerSafe(duty.pubkey);
+
+    const message: gloas.ProposerPreferences = {
+      dependentRoot,
+      proposalSlot: duty.slot,
+      validatorIndex: duty.validatorIndex,
+      feeRecipient: fromHex(feeRecipient),
+      targetGasLimit: gasLimit,
+    };
+
+    const signingSlot = duty.slot;
+    const domain = this.config.getDomain(signingSlot, DOMAIN_PROPOSER_PREFERENCES);
+    const signingRoot = computeSigningRoot(ssz.gloas.ProposerPreferences, message, domain);
+
+    const signableMessage: SignableMessage = {
+      type: SignableMessageType.PROPOSER_PREFERENCES,
+      data: message,
+    };
+
+    return {
+      message,
+      signature: await this.getSignature(duty.pubkey, signingRoot, signingSlot, signableMessage),
+    };
+  }
+
   async signAttestationSelectionProof(pubkey: BLSPubkeyMaybeHex, slot: Slot): Promise<BLSSignature> {
     const signingSlot = slot;
     const domain = this.config.getDomain(slot, DOMAIN_SELECTION_PROOF);