feat(validator_store): implement sign_proposer_preferences (SingleValidator partial-sig) - #1125
Merged
mergify[bot] merged 9 commits intoJul 21, 2026
Merged
Conversation
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## epbs #1125 +/- ##
=======================================
Coverage ? 68.03%
=======================================
Files ? 164
Lines ? 30942
Branches ? 0
=======================================
Hits ? 21050
Misses ? 9892
Partials ? 0
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
shane-moore
reviewed
Jul 12, 2026
This was referenced Jul 12, 2026
petarjuki7
added a commit
to petarjuki7/anchor
that referenced
this pull request
Jul 15, 2026
…ure telemetry The NoSignature arm labelled every failed reconstruction signing_root_divergence and warned that operators had likely diverged on the signing root. That class is reached only via QueueClosedError, which conflates threshold-not-reached, too-few operators, and delivery loss, and the wire carries no preference fields, so the collector cannot know a signing-root split occurred. The sibling PTC path already labels the identical class honestly. Rename the label to insufficient_partial_signatures, reword the warn to list signing-root divergence as one of several possible causes, and update the two metric tests. Document CollectionTimeout in the classifier as reserved and not currently produced by the collector. Addresses review feedback on sigp#1125.
petarjuki7
force-pushed
the
feat/proposer-preferences-sign
branch
from
July 15, 2026 21:39
417c2f3 to
2deb940
Compare
Member
|
think CI will be fixed if rebase this branch from the |
Sign ProposerPreferences via a single-validator partial-signature collection round: domain keyed on proposal_slot's epoch, envelope slot stamped with the duty's proposal_slot (SIP-94 §5/§7, not the send slot), no slashing-DB interaction. Add a reconstruction-failure reporter and metric, and generalize the shared collect_signature failure classifier. Part of sigp#1063.
…ure telemetry The NoSignature arm labelled every failed reconstruction signing_root_divergence and warned that operators had likely diverged on the signing root. That class is reached only via QueueClosedError, which conflates threshold-not-reached, too-few operators, and delivery loss, and the wire carries no preference fields, so the collector cannot know a signing-root split occurred. The sibling PTC path already labels the identical class honestly. Rename the label to insufficient_partial_signatures, reword the warn to list signing-root divergence as one of several possible causes, and update the two metric tests. Document CollectionTimeout in the classifier as reserved and not currently produced by the collector. Addresses review feedback on sigp#1125.
…ions epbs (sigp#1082/sigp#1103/sigp#1128) added `spec` and `forced_gloas_index` to the shared test HarnessOptions. Append `..Default::default()` to the two ProposerPreferences failure-test constructions, matching the sibling payload_attestation tests, so the suite compiles on the rebased base. Part of sigp#1063.
petarjuki7
force-pushed
the
feat/proposer-preferences-sign
branch
from
July 16, 2026 09:25
2deb940 to
ce37a43
Compare
shane-moore
reviewed
Jul 16, 2026
shane-moore
reviewed
Jul 16, 2026
shane-moore
reviewed
Jul 17, 2026
shane-moore
reviewed
Jul 17, 2026
shane-moore
reviewed
Jul 17, 2026
shane-moore
reviewed
Jul 17, 2026
Rename signed_proposer_preferences_total to anchor_signed_proposer_preferences_total so the top-line signing counter carries the same anchor_ prefix as its paired failure counter (anchor_proposer_preferences_reconstruction_failures_total) and the rest of the file. Choosing the prefix before ship avoids a later rename breaking dashboards. Addresses review feedback on sigp#1125.
Wrap the per-validator signature collection in a slot-derived tokio timeout (2 slots) mapped to CollectionError::CollectionTimeout. Without a deadline the await resolves only when the collector is reaped at proposal_slot + 2 (up to ~13 min for a next-epoch lookahead emission); because the LH ProposerPreferencesService awaits each validator sequentially in one task, a single no-quorum validator (an expected SIP-94 §5 state such as a target_gas_limit config mismatch or a dependent_root observation split) blocks both epochs' emissions for that duration. The collector outlives the deadline, so a later per-slot retry still reconstructs if quorum forms. Also drop the run_and_update_metrics wrapper, whose catch-all arm error-logged a no-quorum failure and miscounted it as other_error on top of the reporter's correct warn and insufficient_partial_signatures. Match sign_payload_attestation: the reporter owns failure telemetry, and success is counted explicitly on the Ok path. Addresses review feedback on sigp#1125; closes the bounded-timeout AC of sigp#1063.
Three tests asserted conditions that held regardless of the behavior they named, so none could catch its target regression: - the signing-domain recompute ran under ChainSpec::mainnet(), where the send and proposal epochs share the genesis fork version, so keying the domain on the send epoch would produce an identical root; - one test asserted attribution labels the production code never writes, so the zero deltas held even if the whole reporting arm were deleted; - comments claimed the on-wire PartialSignatureMessages.slot was asserted, but the mock captures metadata.slot at the trait boundary before create_message runs. Fix by mirroring the payload_attestation sibling suite: - run the success test on a spec with Gloas activated at the lookahead epoch, so a fork boundary sits between the send and proposal epochs, and assert the root matches the proposal-epoch domain and differs from the send-epoch domain; - drop the vacuous attribution-label test; add an infra-class test (EmptySignature) that gives the Infra classification arm its first coverage, and a zero-delta infra check on the QueueClosedError test; - add a slashing-protection tripwire; - reword the slot comments to state metadata.slot is what is asserted. Addresses review feedback on sigp#1125.
sign_proposer_preferences now synthesizes CollectionTimeout when its bounded collection-wait deadline elapses, so the note claiming the variant is not produced and has no deadline path is stale. Reword it to describe the caller that produces it.
…path Exercise issue sigp#1063 AC7: a no-quorum collection must fail per-validator with a bounded timeout and never hang the caller. Add a mock-collector hang mode that returns a never-resolving future, and a test that drives the production tokio::time::timeout to elapse under paused virtual time (start_paused), asserting the result is SignatureCollectionFailed(CollectionTimeout) and that it lands in the insufficient_partial_signatures bucket, not infra. Without the production timeout the test would hang on the pending collector future rather than return, which is the "never hangs the caller" property AC7 requires.
Member
|
looks good! just got small |
Member
|
pushed the small |
shane-moore
approved these changes
Jul 21, 2026
|
Queued — the merge queue status continues in this comment ↓. |
Merge Queue Status
This pull request spent 12 minutes 4 seconds in the queue, including 10 minutes 13 seconds running CI. Required conditions to merge
|
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1063 (ePBS Proposer Preferences duty milestone, SIP-94 §5/§7).
Implements
sign_proposer_preferencesonAnchorValidatorStore: a single-validator partial-signature collection round overProposerPreferences, domain keyed onproposal_slot's epoch, envelope slot stamped with the duty'sproposal_slot(not the send slot), and no slashing-DB interaction. Adds a reconstruction-failure reporter + metric and generalizes the sharedcollect_signaturefailure classifier.Stacked on #1106 — only the final commit (
implement sign_proposer_preferences) is in scope here; the ssv_types / message-validator commits belong to #1106 and drop out of this diff once it merges.