fix: harden runtime authorized signer refresh

[dghelm]

Summary

• add a head-qualified, two-phase authorization barrier for runtime L1 signer refresh
• pin signer storage reads to the observed L1 block hash using EIP-1898
• keep runtime refresh behind --consensus.runtime-authorized-signer-refresh, default off
• preserve explicit --consensus.authorized-signer and Noop consensus as static modes
• make reset and reorg transitions staged, fail-closed, retryable, and generation-aware
• invalidate pre-unwind payload/signing work before it can be persisted or announced
• keep authorization phase two reachable while optimistic L2 synchronization is active
• defer trusted imports while authorization or reset transitions are pending
• acknowledge manual block-build admission with typed outcomes
• reject manual block builds unless the orchestrator is fully synchronized
• cancel and resolve active builds before optimistic-sync and reset transitions enter Syncing
• give every admitted manual build a correlated terminal completion ticket
• report success, cancellation/skip, and post-admission payload failures to the exact waiting caller
• keep remote-source completion waits shutdown-aware without an unsafe timeout
• surface typed reset failures through the handle, RPC, and debug REPL

Root cause

The original runtime refresh compared the latest L1 head against state that structural handling had already advanced, so the signer read was skipped. Enabling the corrected path exposed broader lifecycle assumptions: an explicit signer could be overwritten, storage reads were not tied to the observed head, refresh failures could stall derivation or report a false synced state, and asynchronous block work could cross signer-rotation, reorg, or reset boundaries.

Review also identified liveness gaps in the hardened state machine. Optimistic sync could mark L2 as syncing while an authorization barrier prevented network import, but the phase-two signer update was gated on L2 already being synced. Rejected, cancelled, post-admission failed, or sync-suspended manual builds could also leave the remote source waiting forever on unrelated global events.

Design

Dynamic mode emits:

1. AuthorizationPending(head) on a priority control channel before the structural transition.
2. Reorg / NewBlock on the ordinary FIFO L1 channel.
3. A signer read pinned to head.hash.
4. AuthorizedSigner { head, signer } on the ordinary FIFO channel before Processed.

Consensus stays fail-closed until phase two matches the exact pending head. Read failures retain the barrier, use bounded retry backoff, and emit neither Processed nor Synced. The ordinary L1 branch is reachable when L2 is synced or authorization is pending, while retaining the derivation-empty and reset-tail gates, so phase two cannot deadlock optimistic sync or overtake structural work.

Administrative resets and ordinary reorgs advance an unwind generation exactly once per committed unwind. In-flight payloads are cancelled, and signer results tagged with an older generation are discarded before database or network effects. Reset tails retain their committed unwind result, reject conflicting targets, and resume without double-unwinding.

BuildBlock now returns a typed admission result for authorization/reset policy rejection, lack of full synchronization, an active payload, missing signer or sequencer configuration, and payload-start failure. Every command path answers its admission oneshot. Successful admission returns a per-request completion ticket. Payload finalization, L1-message persistence, and signer-enqueue errors resolve that ticket as Failed; empty, invalidated, and cancelled jobs resolve it as Skipped; successful signer enqueue resolves it as Sequenced. Only one manual payload is admitted at a time, so a later request cannot replace the active job.

Every orchestrator transition into L1 or L2 Syncing cancels an accepted payload before changing the sync state and resolves its ticket exactly once. Reset initiation performs this cancellation before the fallible database unwind, while optimistic sync performs it immediately after the engine accepts the optimistic head. A build cannot be admitted while either layer is already syncing.

The remote source waits on this correlated ticket instead of a global event stream. It skips expected admission-policy rejections, reports operational admission and terminal failures, and retains shutdown awareness without an uncorrelated timeout.

Operator impact

Runtime refresh is opt-in:

--consensus.runtime-authorized-signer-refresh

Contradictory configurations are rejected. Explicit signer overrides remain static. The opt-in startup probe requires the configured L1 endpoint to accept hash-qualified EIP-1898 storage reads.

Zero remains a valid halt signer and produces a distinct warning on transition.

Base reconciliation

Rebased onto feat/tsuki-hardfork-2 at f0b480d, which includes PR #22 and removes the Rust Anvil/Tempo dependency conflict from the test graph. No separate test-infrastructure fix was cherry-picked.

Validation on the rebased tip

• orchestrator unit suite, including correlated-ticket and injected post-admission failure regressions
• signer and watcher suites
• optimistic-sync authorization-overlap regression
• typed BuildBlock rejection regression, including unsynchronized admission
• exact-once cancellation regression, including correlated ticket completion
• optimistic-sync transition cancellation regression
• reset-transition cancellation regression
• remote-source suite, 3/3 serially
• strict Clippy for the orchestrator and node across all targets
• cargo check --workspace --all-features --locked
• RUSTUP_TOOLCHAIN=nightly-2026-01-18 cargo fmt --all -- --check
• git diff --check

The full sequencer suite still has inherited failures in the rebased DogeOS execution stack (missing exec scalar in spec_id=TSUKI, followed by ValidationServiceUnreachable); the cancellation changes are not the source of those failures.

Required before enabling dynamic refresh in production

• deploy and integration-test DogeOS L1 EIP-1898 support
• add the deterministic watcher/orchestrator interleaving harness
• close or formally specify the residual in-flight external engine-call linearization window
• decide runtime behavior for the static --network.valid_signer eth-wire compatibility signer

These items do not block merging the default-off implementation.

Fixes #6

[codspeed-hq]

Congrats! CodSpeed is installed 🎉

🆕 2 new benchmarks were detected.

You will start to see performance impacts in the reports once the benchmarks are run from your default branch.

Detected benchmarks

• pipeline_derive_in_file_blobs: 689.9 ms
• pipeline_derive_s3_blobs: 63.9 ms

---

[dghelm]

Closing without merge — a deliberate scope decision.

The root-cause diagnosis stands and is preserved on #6, and the review rounds surfaced real hazards. But the remediation grew into ~2,800 lines of ordered-stream hardening (two-phase authorization barrier, dedicated priority control channel, unwind-generation tagging, staged commit-aware resets) for a feature that ships default-off and cannot be enabled until #8 (hash-pinned reads) and #31 (eth-wire signer gate) land. That is a deep cut into consensus-critical code we are still getting the hang of as a fork, guarding a flag nobody can flip. The next attempt will be a fresh, smaller cut built on a current-value abstraction for the signer (see the design note on #6) rather than more armor on the notification stream.

What is preserved:

• Learnings and requirements: root causes + the six activation hazards + design guidance → Reth Authorized Sequencer Signer Is Not Refreshed at Runtime #6.
• Pre-existing bugs found during review, extractable independently: L1 watcher: reset/channel-swap race can terminate the watcher with the reset unprocessed #29 (watcher reset/channel-swap race can kill the watcher), Chain orchestrator: in-flight signed block can be persisted and announced after an unwind discards its chain #30 (stale signed block persisted/announced across unwinds).
• Reference implementation: this branch is retained; 7496ee8 and d1d669f are worth mining for the zero-signer fail-closed semantics, step backoff, reset-race recovery, generation tagging, and the test patterns (scripted MockProvider storage responses, exact notification-sequence assertions).
• CI context: the four red lint jobs are the base branch's tempo-alloy E0119 (Remove embedded Foundry/Tempo from the rollup-node test graph #21); the zero-step test jobs and CodSpeed 401 are Restore PR test runners and CodSpeed upload authentication #10. None were caused by this PR.