Repository navigation
feat(beacon): follow gloas live - #639
Conversation
🤖 Codex Code Review
I found one concrete correctness bug; the rest of the reviewed paths look thoughtfully implemented.
If you want, I can do a second pass focused only on fork-choice / envelope import interactions in Automated review by OpenAI Codex · gpt-5.4 · custom prompt |
🤖 Claude Code ReviewReview of PR 639: follow gloas liveThis is a very large PR (about 15.6k lines added). I could only read part of it: the CLAUDE.md, README and Makefile changes,
Findings
What looks good
RecommendationNothing I read is blocking. The consensus-critical parts (envelope queueing and aging, FULL/EMPTY head handling, the engine Automated review by Claude (Anthropic) · sonnet · custom prompt |
🤖 Kimi Code Review
I'll review this PR implementing Gloas (EIP-7732) ePBS support in ethlambda. This is a substantial consensus-layer change affecting fork choice, gossip validation, state transition, and networking. Critical Issues1. Fork Choice: Missing
|
| Priority | Count | Categories |
|---|---|---|
| Critical | 3 | Missing signature check, incorrect payload status for unknown roots, bid matching incompleteness |
| Security | 2 | Race condition (documented), test HTTP parser (test-only) |
| Correctness | 4 | Clock clamping, attestation clock advance, missing_columns semantics, finality check |
| Performance | 2 | O(n²) eviction, unbounded EL walk |
| Rust/Style | 4 | Clones, #[must_use], naming, features |
The most critical fix needed is Item 2: signature verification must occur before the engine call in the main import path, not just in the column-waiting path.
Automated review by Kimi (Moonshot AI) · kimi-k2.6 · custom prompt
…8-gloas-live # Conflicts: # crates/net/p2p/src/beacon/transition.rs
## 🗒️ Description / Motivation
A beacon follower that has caught up keeps downloading blocks it already
has.
`P2PServer::beacon_fetched_through` is the watermark range sync starts
from, and only `handle_beacon_blocks_by_range_response` advances it.
Once the follower is at the tip it imports from gossip, so the watermark
stays at its last range batch while the head moves on. Every peer that
connects later advertises a head above the watermark, and its `Status`
answer starts a range session from there:
```
watermark (last range batch) our head peer head
| | |
[ already imported from gossip ][ owed ]
^ range session starts here ^ should start here
```
Each re-fetched block also brings its custody columns
(`request_beacon_data_columns_by_range` runs for the same span), and
each one costs the chain actor an import attempt that ends at "already
in the store", followed by a head recompute.
Observed on the Platåberget follower (build `c184e736`) between 14:08Z
and 17:02Z on 2026-10-01:
| | |
|---|---|
| Bursts of arrivals that imported nothing | 66 |
| Blocks in them | 748 |
| Burst size | the slots since the burst before it |
| Cost per arrival | ~65 ms (`cascade_ms` ~30-47 ms + `get_head_ms` ~20
ms) |
| Largest burst | 67 blocks at 16:52:36Z; the gossip block for slot
354263 waited 4.2 s behind it in the queue |
## What Changed
- `crates/net/p2p/src/req_resp/handlers.rs`: `beacon_sync_target` takes
the store's head slot and measures the peer against
`max(fetched_through, head_slot)`. `handle_status_response` reads the
head with `Store::beacon_head`, the same whole-block decode
`build_status` already does for every handshake we send, and logs it
beside `fetched_through`.
- `crates/net/p2p/src/lib.rs`: the `beacon_fetched_through` doc says
only range answers advance it.
- `docs/beacon_wire.md`, `CLAUDE.md`: describe the two floors.
## Correctness / Behavior Guarantees
- The watermark still wins while a delivered batch is draining through
the actor mailbox: there the head is below it. That is the case it was
introduced for (11,213 blocks fetched to import 100 when range sync was
driven off the head alone), and it is unchanged.
- The head is a safe floor because a head block's whole ancestry is
already imported, so nothing at or below it can be missing from the
canonical chain.
- A peer on another fork whose head is above ours gets a session from
our head onward. Blocks of its branch at or below our head slot come
through the by-root parent lookup, as they already did whenever the
watermark was current.
- A peer exactly one block ahead (its block still in gossip flight)
still costs a one-block request. I left that in rather than adding a
tolerance, since a tolerance would delay real catch-up.
- The startup seed is unchanged: it was already the anchor head.
## Tests Added / Run
-
`beacon_sync_target_starts_after_a_head_gossip_moved_past_fetched_through`
(new): a head above the watermark moves the start to `head + 1`; a peer
at or behind the head gets `None`.
- `beacon_sync_target_keys_off_fetched_through_while_the_head_lags` (was
`..._not_store_head`): same assertions, now with a head below the
watermark passed in explicitly.
- `beacon_sync_target_is_bounded_by_max_sync_range`: updated for the new
argument.
```
cargo test -p ethlambda-p2p --lib --profile release-fast
cargo clippy -p ethlambda-p2p --all-targets --profile release-fast -- -D warnings
```
Not deployed to a follower yet.
## Related Issues / PRs
- Related to #639 (the build deployed on the follower).
## ✅ Verification Checklist
- [x] Ran `make fmt`: clean
- [x] Ran clippy on `ethlambda-p2p` with `-D warnings`: clean
- [x] Ran `ethlambda-p2p` unit tests: passing
Gloas sidecars carry no signed header or inclusion proof: they name their block by root and slot, and the commitments their cells are checked against live in that block's bid. The fulu rules cannot judge them, so add gloas's modified data_column_sidecar rules beside them, keyed on (block root, index) per the modified Seen, with a fork-agnostic DataColumnSidecar enum in the types crate for the later plumbing to carry. A sidecar whose block has not been seen is queued (the spec's "MAY be queued"). A block seen without a post-state is queued rather than rejected, the same deviation the fulu parent rule makes until a bad-block cache exists, so that one vector is listed in SKIPPED. The spec-test runner now keeps a per-handler list of validated forks instead of a blanket fulu filter, and reads the per-message current_time_ms gloas's column vectors use in place of offset_ms.
Fulu's column rule is split into a cheap half and a stateful half so a duplicate is dropped without a blocking-pool permit and the KZG batch stays off the swarm loop; the p2p wiring will call the halves separately. Give the gloas rule the same shape, with validate_gloas as the combined form. The stateful half now checks for a post-state before decoding the block, so a block without one costs no read of it. A sidecar naming a block of an earlier fork gets its own reject reason rather than reusing Malformed. Tests pin the deliberate deviations: a block without a post-state is queued, an already stored sidecar is ignored, and a non-gloas block is rejected by name. The spec runner now fails a message that names no clock reading, and the pre-fulu decode test uses bytes valid for fulu so it can only fail on the fork.
The beacon wire computed its fork digest once at startup, so a follower
was stranded on topics nobody publishes to the moment a fork activated.
Blob-parameter-only (BPO) boundaries move the digest too, and Sepolia's
fulu to gloas boundary is close, so a long-running node has to cross
them on its own.
ForkSchedule is a pure function of the config and genesis validators
root: every digest from fork and blob-schedule epochs, digest to fork,
and the spec's window ("Transitioning the gossip", altair
p2p-interface.md). Post-fork topics are joined one epoch ahead of the
boundary and the pre-fork topics left two epochs after it, so a node
started inside a window holds both, same as one that crossed into it.
The P2P actor applies the schedule idempotently on a self-rescheduling
timer (and once at startup): it joins and leaves topic sets, swaps the
published digest and fork, bumps the metadata sequence number, accepts
peer Status at any held digest, and moves the discovery admission
filter, which is now shared with the peer table's copy. Attestation
decode takes its fork from the incoming topic's digest instead of the
current one.
The served ENR eth2 entry cannot be updated yet: ethrex's
DiscoveryServer::spawn returns no handle and has no message that
replaces its record. update_served_enr marks the gap.
Review follow-ups to crossing fork digests at runtime. The fork digest gauge is reset before it is set, since the digest now changes while running and the old label would otherwise keep reading 1. Range sync starts only from a peer on the current digest (or the next one within the gossip clock disparity of its boundary); a Status on any held digest is still answered. Publishing picks the digest from the message's own slot, so a slot-B message cannot leave on the old topics before the switch runs, and data column decode failures take their fork from the topic's digest instead of the wall clock. ForkSchedule derives the eth2 entry's next_fork_* from its merged entries and no longer clones the Config. Only a blob entry before fulu is merged away; a post-fulu entry always moves the digest since it hashes the entry's own epoch. BeaconTopics::for_fork matches on every fork, apply() checks the current digest is held before joining anything, and returns the topics it joined and left so the aggregator-subnet handling is tested. Stale docs about a frozen-at-startup digest are rewritten.
The gauge test wrote the global fork-digest gauge while transition tests in the same binary wrote it too, so it could fail under parallelism; the reset-then-set logic is now a helper tested on its own vector. The pre-fulu blob entry test put its entry on deneb's own fork epoch, where the epoch dedup dropped it before the digest comparison ran; it now uses an epoch no fork has. Publishing now refuses a slot whose digest this node does not hold instead of fanning out to a topic nobody joined. next_fork_boundary had no callers left after the schedule took over, so it goes with its tests, and the wire docs no longer say the digest is computed once.
The beacon follower ticks once per slot, so the store clock sat at the slot's start for the whole slot. on_block read it for block timeliness (attestation deadline and, from gloas, the payload timeliness committee deadline), found zero milliseconds into the slot, and called every current-slot block timely, late ones included. A late block therefore got proposer boost and was exempt from the late-head reorg rules. Advance the store clock to the block's wire receipt (decode_start, else hand-off) before on_block. The spec's clock is whole seconds and its on_tick runs whenever time > store.time, so the deadlines are judged on the second the block fell in. The advance never goes backwards and never crosses a slot boundary, which stays the tick's job since it also drains deferred aggregates and recomputes the head. Why the tick was per slot: the follower has no sub-slot duties (see ChainDuties::Beacon, introduced with the chain actor in #9). That is a statement about duties, not about fork choice needing a coarse clock, so arrival-time advances are safe. The envelope and payload-attestation handlers are not called live yet; they get the same hook when wired. Pre-gloas blocks now also get spec-correct proposer boost: a late block is no longer boosted.
A restarted gloas follower lost `verified_payloads`, which silently
dropped every FULL fork-choice node, and `block_timeliness`, which made
the head walk fail with `Error::SpecAssert("head_root in
store.block_timeliness")`. Both were in-memory only.
Two new tables hold them: `ExecutionPayloadEnvelopes` (slot || root, the
verified envelope, so a later change can serve envelopes by slot range)
and `BlockTimeliness` (root, one byte per deadline). Writes go through
to the table and the in-memory set; `from_db_state` rebuilds both for
every LiveChain block at or above the finalized block's slot, the
finalized block included since its payload status decides which branch
its children build on. The PTC vote vectors stay in memory on purpose:
after a restart only the current and previous slot's blocks read them.
`insert_verified_payload` now takes the envelope and errors on an
unknown block, since the row key needs the block's slot.
DB_VERSION is not bumped: new column families change no existing layout,
and no v5 directory holds gloas data since the previous binary refused
gloas.
Restoring verified_payloads on resume let the head walk reach payload_timeliness, which reads the payload committee's vote vectors. Those are never persisted, so the lookup failed with a SpecAssert and get_head (and a timely on_block) errored; the first child of the pre-restart tip failed the same way in notify_ptc_messages. Resume now seeds both vectors empty for every gloas block in the restored window, which is what a freshly imported block holds and is true of a process that has seen no votes. Also: persist block timeliness only for gloas blocks (nothing reads pre-gloas entries after a restart, so the rows would only grow); fall back to the anchor slot rather than the epoch start when the finalized block has no row, since a finalized block can sit below its epoch start; pass the block's slot to insert_verified_payload instead of re-decoding the block; and correct the docs that called a missing timeliness entry fatal or the scratch in-memory only.
The resume test only exercised the spec-literal gloas_get_head. The actor uses get_head_node, whose walk_head re-derives payload links that do not survive a restart and reads the boost and weight helpers, so assert it succeeds and agrees with gloas_get_head. Also make the resume fork check an exhaustive match so a new fork forces a decision, state the real cost of the LiveChain scan in its doc, and debug-assert that insert_verified_payload is given its block's own slot.
Every gloas block was ignored as an unsupported fork, so the node could not relay one even once the actor follows gloas. Gloas now runs its own modified `validate_beacon_block_gossip`: the operation and parent-request limits (gloas lists are progressive, so decoding enforces none of them), bid checks in place of execution-payload checks, and the parent payload status read through the existing `is_parent_node_full` and `is_payload_verified`. Earlier forks keep their rules unchanged. `fixed_proposer` answers from a gloas parent's lookahead, which gloas keeps unchanged from fulu. The spec runner now validates gloas `gossip_beacon_block` and delivers a listed block's payload envelope before the case runs.
Gossip rejected a block with more deposit requests than the preset bound, but gloas deposit requests are a progressive list that neither the spec nor the state transition bounds, so import would have accepted what gossip refused. The parent payload status is also read once rather than decoding the parent block twice on the validation pool, and a failed read is now an Ignore(Internal) with a log instead of a mislabelled queue. Docs no longer claim every gloas block is ignored as an unsupported fork.
Gloas redefines DataColumnSidecar (no header or inclusion proof; a slot and a block root instead), and the bytes carry no fork tag. Thread the fork-agnostic DataColumnSidecar enum through p2p, the actor API, storage reads and the chain actor so a gloas column takes the same routes a fulu one does. The fork comes from context: the gossip topic's digest, a req/resp chunk's context bytes (then checked against the digest at the sidecar's own slot), and for stored rows the fork of the slot in the key, so the table layout and DB_VERSION are unchanged. A gloas column is verified against its own block's bid, so the chain actor parks it keyed on its block root (a fulu one stays keyed on its parent) and replays it through the p2p checks once that block has a post-state. Tests that stored a fulu sidecar at a slot mainnet still schedules as phase0 now use a store with fulu active from genesis, since rows decode by their slot's fork.
The parking lot for data column sidecars the p2p checks could not judge yet is about to grow bounds of its own, so give it a module beside beacon_aggregates instead of growing lib.rs. Pure move: no behavior change.
A gloas sidecar carries no signature, so a peer can invent (slot, root, index) triples as fast as it can send them and each one parked costs a disk row. - Park only while the node follows the fork; gloas blocks cannot import yet, so nothing would ever drain a parked row. - Check shape before anything is written: slot in gloas, index in range, column and proofs agree within the blob limit, index one this node samples. - Cap distinct parked gloas roots per slot and pin each root to one slot. - Keep the parked count as a running counter instead of summing every root. - Share one "can be judged now" predicate between the actor and the p2p check, so a root with a state but no block cannot bounce between them. - Drop by-root column answers that were not asked for. Also refreshes docs that still said a column waits for its parent.
A gloas follower dropped every aggregate, subnet attestation and attester slashing as an unsupported fork. They now decode and validate under gloas's modified rules: data.index is the payload-present flag (0 or 1), and a vote for the full payload is ignored until the block's envelope is verified and its payload validated (verify_attestation_payload_status). Gloas shares electra's wire bytes but its Attestation is a progressive container, so the aggregator's signed root differs. The aggregate therefore gets its own SignedAggregateAndProof::Gloas variant rather than reusing electra's, and attester slashings get a matching AttesterSlashing::Gloas. Subnet attestations keep the SingleAttestation shape and are told apart by slot. apply_verified_aggregate took PreGloas rules unconditionally; it now reads the vote's fork from its slot so payload_present is recorded for gloas votes. Payload verdicts live in a new beacon-root-keyed scratch map, since a gloas block carries no execution hash in el_block_hashes; an absent root reads as NOT_VALIDATED, as the specification's default does.
… votes Gloas aggregation bits are an unbounded progressive bitlist, and the seen-set verdict expands them into a Vec<bool> before any other check, so a large message forced a large allocation. A gloas aggregate longer than the electra type bound is now rejected first, reading the length without expanding it. An honest gloas-slot vote for the last pre-gloas block (FULL under the boundary rule) was ignored as optimistic because block_payload_statuses never holds a pre-gloas root. Such a root now reads its own block validity. Also drops the now-unreachable UnsupportedFork arms on the aggregate and attestation topics, fixes stale docs, tightens an assertion, and unit-tests the payload-status branches and the status map.
Gloas moves the execution payload out of the block into a revealed envelope, and the Amsterdam execution fork asks about it with engine_newPayloadV5 and an ExecutionPayloadV4 (V3's fields plus blockAccessList and slotNumber). Add the JSON view of that payload, the client call (with the six second timeout amsterdam.md gives the method), the capability entry, and a request builder that takes the payload, parent root and requests from the envelope and the versioned hashes from the block's bid, as verify_execution_payload_envelope does. Nothing calls the new pieces yet; wiring them into envelope import is a separate change.
ask_envelope returned Ok(None) for a non-gloas block, borrowing the "nothing to ask, import it" meaning from ask. Here it could only mean a block and envelope that do not belong together, which a caller copying ask would have accepted unchecked. It now returns an EnvelopeMismatch error, and the request builder checks the block is gloas, the envelope's beacon_block_root is the block's root, and the bid's block_hash is the payload's before building anything. The missing-V5 handshake warning now fires only when the network schedules gloas, so mainnet and Hoodi with a pre-Amsterdam execution client do not warn on every start. Also refresh docs that still said nothing calls the gloas request list or that V5 is absent, and use a well-formed empty block access list in the wire test.
… gossip rules The two new gloas topics need validators before p2p can subscribe to them. Both follow the cheap/stateful split the other topics use, so the swarm loop only runs the seen-cache, clock and finalized-slot checks inline; store reads, the payload timeliness committee and signatures run on the blocking pool. A block seen without a post-state is queued (envelope) or ignored (payload attestation) where the spec rejects it, the deviation every other topic already makes until a bad-block cache exists; the two matching reject_block_failed_validation vectors are skipped for that reason. The envelope's finalized-slot IGNORE runs before the block lookups, which only changes the metric label between two IGNORE outcomes. verify_execution_requests_limits moves to gossip/mod.rs so the block and envelope rules share it.
Withdrawals and the execution request lists are progressive, so only the gossip size cap bounded an envelope that could be queued for an unknown block. The withdrawal and request count limits do not depend on the block, so they now run in cheap_checks, before anything can be queued. The payload attestation path also decoded the whole head block just to get its root; head() returns the root alone. A committee-window miss now has its own ignore reason instead of sharing StateUnavailable, and the deviation paths (no post-state, uncached head, window miss, non-gloas block) are pinned by unit tests since the fixtures treat Queue as ignore.
Gloas peers recover missed payloads through execution_payload_envelopes_by_range/1 and by_root/1. Register both protocols (bidirectional at the libp2p level) and answer them from the store: the codec frames each envelope under the digest of its block's epoch and rejects any non-gloas or unscheduled digest, by-range serves only envelopes the next canonical block builds on (the head's when held, since fork choice does not persist which payload branch the head picked), and both are capped at MAX_REQUEST_PAYLOADS. No requests are issued yet; a response nothing asked for is logged and dropped.
handlers.rs is already past three thousand lines and the client side of the envelope protocols lands next, so give the server handlers, their pure functions and tests a module of their own. Pure move.
Auto-merge was disabled for another pull request in the stack
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: - require_validated and the syncing endpoint's head check read optimism through block_is_optimistic, which knows a gloas block's payload link. - payload_attestation_data follows attestation data's rule: a 503 without an execution client, or when the voted block's payload is unvalidated. - The gloas validator-client tests serve through an idle execution client, and the optimistic-head test names the fork attestation_data now takes.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: - Gloas block production (produceBlockV4) appends the client versions to the graffiti the way fulu's does. - The validator client's gloas proposal and duties tests take their graffiti and fee recipient from ProposerSettings, and a validator's own graffiti is checked to reach a gloas block request.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: - The BLS fixture tests follow main's cryptography-specs layout, and main's Makefile (gossip vectors in the pinned tree) replaces the separate gossip tree this branch extended. - Operations under a gloas head are IGNOREd and a gloas-shaped attester slashing has no consumer; gloas operation vectors are not run. - Published columns and operations go out under the slot's own digest, and column subnets use compute_subnet_for_data_column_sidecar. - Gloas block production packs from the store's attestation pool, and a published gloas block gossips no sidecars (its columns follow the envelope). The payload attestation pool stays a shared handle.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: the write cursor also drives gloas's progressive registry. A cursor pass crosses a ProgressiveList's subtrees with global indices, and try_update_validators_with_balances and try_update_balances work on any BeaconState, so electra's effective-balance step and the reward deltas write through them too.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: gloas block processing (its attestations and sync aggregate) reads the total active balance from the same cache, which gloas block production passes in, and the cache's registry scan walks iter_validators so it covers gloas's progressive registry.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: gloas's progressive inactivity scores and ring buffers go through the same element accessors (inactivity_score_mut, InactivityScoresRef), and ProgressiveList is Buffered. Main's new tests write block_roots by index rather than through iter_mut, which a tree-backed vector has not got.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: - The key-layout bump is DB_VERSION 7, since main spends 6 on #634's gloas config keys. - A gloas fork-choice test stores a state whose header slot is its block's, since states are keyed by that slot, and the slot-peek test covers a gloas block, now the newest fork.
Main gained the gloas stack (#634, #635, #639, #662, #663). Adapted to it: gloas aggregates are checked under the schedule's attester domain too (is_valid_indexed_attestation_with_domain), main's attestation_for test helper signs under the schedule's domain, and the test store helpers are main's beacon_store_with_config.
🗒️ Description / Motivation
#634 implements gloas (EIP-7732, ePBS) in the state transition and fork choice, and #635 adds Platåberget, the one public chain already past gloas. The follower still could not follow it:
refuse_unfollowable_forkrefused a gloas anchor, nothing subscribed to or fetched execution payload envelopes, and a fork-digest boundary needed a restart.This PR makes the live follower follow gloas:
ethlambda beacon --network platabergetcheckpoint-syncs from a gloas anchor, imports gloas blocks and their payload envelopes from gossip and req/resp, tracks head and finality, judges payloads through the execution client, and crosses a fork-digest boundary at runtime. The node stays a follower (no gloas validator duties).The runtime rollover is what Sepolia needs: it forks to gloas on 2026-10-06 13:53 UTC.
What Changed
Envelope import (
crates/blockchain/src/beacon_envelope.rs,beacon_payloads.rs)on_execution_payload_envelope.awaiting_import). Range catch-up depends on this.Store::head_payload_status) and recomputed after a restart.Gossip (
state_transition::beacon::gossip,p2p/src/beacon/)beacon_block,data_column_sidecar, aggregates and attestations (progressive containers, aggregation-bits length bounded before expansion,verify_attestation_payload_status).execution_payloadandpayload_attestation_message. They are joined only for gloas digests (BeaconTopics::for_fork).beacon_columns.rs).Req/resp (
p2p/src/req_resp/envelopes.rs,envelope_client.rs)execution_payload_envelopes_by_{range,root}/1: canonical FULL envelopes only, and the head's envelope only when the head node is FULL.needs_envelope(same dedup and retry ladder as block fetches) and by range after a gloas span's blocks reach the actor. Range sync holds the next batch until the envelope answer is forwarded.Fork-digest rollover (
p2p/src/beacon/fork_schedule.rs,transition.rs)ForkSchedulejoins the next digest's topicsSUBSCRIBE_LEAD_EPOCHSbefore its boundary and leaves the old onesUNSUBSCRIBE_LAG_EPOCHSafter. Blob-parameter (BPO) boundaries are included.Execution client (
crates/net/engine,beacon_engine.rs)engine_newPayloadV5judges an envelope that passed the consensus checks:latestValidHashis a hash mismatch, so only that envelope is refused.latestValidHashcondemns the payload through the execution-chain walk.engine_forkchoiceUpdatedV4for a gloas head, with the custody columns. The head hash follows the head node's FULL or EMPTY status; finalized and safe come from the checkpoint blocks'bid.parent_block_hash.Storage (
crates/storage/src/store.rs)ExecutionPayloadEnvelopes(verified envelopes) andBlockTimeliness(gloas timeliness). Both are reloaded on resume for the unfinalized window.Checkpoint sync and API
execution_payload_envelopesendpoint, and the by-root request covers the rest.crates/net/rpc/src/beacon/envelopes.rs). Optimism for gloas is judged read-only (rpc/src/shared/optimistic.rs).refuse_validator_duties_from_gloaskeeps the validator-client endpoints off gloas epochs.Docs:
CLAUDE.md,README.md,docs/beacon_engine.md,docs/beacon_stf.md,docs/beacon_wire.md,docs/checkpoint_sync.md,docs/spec_deviations.md.Correctness / Behavior Guarantees
Deliberate departures from the gloas gossip rules (
docs/beacon_wire.md), each for want of state this node does not keep. The engine-side choices are indocs/spec_deviations.md.payload_attestation_messageon_payload_attestation_messagechecks the signature againLimitations
eth2after a boundary: ethrex'sDiscoveryServercannot replace the served ENR at runtime, so theeth2entry keeps the startup digest until a restart. Peers that discover the node after a boundary reject the record. Existing connections and gossip are unaffected.SpecAssert("block_root in store.unrealized_justifications")until fix(beacon): persist unrealized justifications so get_head survives a restart #628 lands. That is not gloas-specific.Tests Added / Run
gossip_beacon_block,gossip_data_column_sidecar,gossip_beacon_aggregate_and_proof,gossip_beacon_attestation, plus the newgossip_execution_payload_envelopeandgossip_payload_attestation_message. Thereject_block_failed_validation-style vectors are skipped by name, for the bad-block-cache reason above.ethlambda-blockchain, behind its newbeacon-spec-testsfeature (run bymake test-beacon-mainnet; reported as ignored by a plaincargo test).crates/net/engine/tests/wire_smoke.rs), and the resumed-store head walk.c184e736): caught up from the checkpoint anchor to the network head in under 30 s, then 0-slot lag with a root match againstbeacon.plataberget.ethpandaops.ioon every sample for 6 minutes.Related Issues / PRs
✅ Verification Checklist
make fmt— cleanmake lint(clippy with-D warnings) — cleanmake test(test-consensusplustest-node, atrelease-fast) — all passing (left to CI)