feat(fast-inbox): sequencer streaming message selection, flag off (A-1382)

Implements A-1382 (FI-12): sequencer streaming Inbox message selection behind a `streamingInbox` flag, default off. Part of the Fast Inbox stack (AZIP-22).

## Flag semantics

- One shared env var `STREAMING_INBOX` -> `streamingInbox: boolean` (default false), defined once in `stdlib`'s `sharedSequencerConfigMappings` so the sequencer reads it now and the validator (A-1383) maps the same env. Flag off is byte-identical: the new paths are gated at checkpoint start and per block.
- With the flag on, checkpoints are expected to fail L1 submission (on-chain `propose` still enforces the legacy per-checkpoint consumption until the flip, A-1384). The streaming path is exercised with unit/mock tests only.

## Selection policy (mirrors `ProposeLib.validateInboxConsumption`)

New pure selector `sequencer-client/src/sequencer/inbox_bucket_selector.ts`, run per block:

- Pick the newest lag-eligible bucket (`getLatestInboxBucketAtOrBefore(now - INBOX_LAG_SECONDS)`); on the checkpoint's final block, also consider the cutoff bucket and take the newer, so consumption reaches the censorship floor.
- Walk back from the candidate to the newest bucket that fits both the per-block cap (`bucket.totalMsgCount - parent.totalMsgCount`) and the per-checkpoint cap (`bucket.totalMsgCount - checkpointStartTotalMsgCount`). If even the first forward bucket overshoots the per-checkpoint cap, consume nothing — matching L1's cap-escape (`next.totalMsgCount - parentTotal > MAX_L1_TO_L2_MSGS_PER_CHECKPOINT`).
- The inclusive `<=` comparisons make a bucket exactly `INBOX_LAG_SECONDS` old eligible and a bucket exactly at the cutoff mandatory, matching L1's strict `next.timestamp > cutoff`.

Cutoff is computed as `getTimestampForSlot(slot - 1) - INBOX_LAG_SECONDS`, matching `ProposeLib` exactly (not the consensus timetable's `getBuildFrameStart`, which subtracts an extra ethereum-slot). Boundary vectors pinned against A-1371 resolution section 13.

## Cutoff floor

On the checkpoint's final block (including the block that reaches the per-checkpoint block cap) the cutoff is a consumption floor, so the checkpoint's own header would pass the L1 censorship assert post-flip.

## Builder interface change

- `ICheckpointBlockBuilder.buildBlock` gains an optional per-block `l1ToL2Messages` bundle; `ICheckpointsBuilder.startCheckpoint` gains `insertMessagesPerBlock`. Threaded through `FullNodeCheckpointsBuilder`/`CheckpointBuilder` and the lightweight builder (first-in-checkpoint bundle padded, non-first compact; the inHash/rolling hash recompute over the accumulated logical messages).
- An optional signed bucket reference is threaded onto block proposals (`Validator.createBlockProposal` -> `ValidationService` -> `BlockProposal.createProposalFromSigner`).

## Constant

`INBOX_LAG_SECONDS = 12` added to `constants.nr` and regenerated into the TS constants (`constants.gen.ts`). Not emitted to `ConstantsGen.sol` (Solidity whitelist); `ProposeLib` keeps its local copy pending consolidation (A-1434).

## Open item / to verify on CI

- Non-genesis cross-checkpoint parent-bucket sourcing is not wired: there is no by-rolling-hash archiver lookup and legacy parents do not sit on a bucket boundary, so only the genesis base case is resolved and non-genesis throws (safely caught -> skipped proposal). This is a flip-time concern.
- Local build/typecheck of `sequencer-client`, `validator-client`, `prover-client` is blocked by the known stale-artifact/`@aztec/bb-avm-sim` breakage, so CI is the typecheck of record for the job/builder/proposal edits. The pure selector unit tests and the stdlib config changes were verified locally.

Replaces #24787.

Author: spalladino

noir-projects/fnd/noir-protocol-circuits/crates/types/src/constants.nr

@@ -69,6 +69,11 @@ pub global L1_TO_L2_MSG_SUBTREE_ROOT_SIBLING_PATH_LENGTH: u32 =
 pub global MAX_L1_TO_L2_MSGS_PER_BLOCK: u32 = 1024;
 // Cap on L1-to-L2 messages consumed by a single checkpoint. Semantically today's NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP.
 pub global MAX_L1_TO_L2_MSGS_PER_CHECKPOINT: u32 = 1024;
+// Minimum bucket age, in seconds, at the start of a checkpoint's build frame for its consumption to be mandatory under
+// the streaming Inbox censorship cutoff (AZIP-22 Fast Inbox). One L1 slot: validators cannot be required to act on
+// buckets they may not yet have seen. L2 consensus policy consumed by the sequencer and validator (and mirrored by
+// ProposeLib on L1); the protocol circuits do not read it.
+pub global INBOX_LAG_SECONDS: u32 = 12;
 // Maximum number of subtrees a L2ToL1Msg unbalanced tree can have. Used when calculating the out hash of a tx.
 pub global MAX_L2_TO_L1_MSG_SUBTREES_PER_TX: u32 = 3; // ceil(log2(MAX_L2_TO_L1_MSGS_PER_TX))
 

yarn-project/foundation/src/config/env_var.ts

@@ -385,6 +385,7 @@ export type EnvVar =
   | 'FISHERMAN_MODE'
   | 'MAX_ALLOWED_ETH_CLIENT_DRIFT_SECONDS'
   | 'MAX_BLOCKS_PER_CHECKPOINT'
+  | 'STREAMING_INBOX'
   | 'LEGACY_BLS_CLI'
   | 'DEBUG_FORCE_TX_PROOF_VERIFICATION'
   | 'VALIDATOR_ALLOW_EPHEMERAL_SIGNING_PROTECTION'

yarn-project/prover-client/src/light/lightweight_checkpoint_builder.ts

@@ -70,9 +70,14 @@ export class LightweightCheckpointBuilder {
     db: MerkleTreeWriteOperations,
     bindings?: LoggerBindings,
     feeAssetPriceModifier: bigint = 0n,
+    // Streaming Inbox (AZIP-22 Fast Inbox): messages are inserted per block via `addBlock`, so `l1ToL2Messages` here
+    // is empty and the up-front checkpoint-wide insertion is skipped.
+    insertMessagesPerBlock: boolean = false,
   ): Promise<LightweightCheckpointBuilder> {
-    // Insert l1-to-l2 messages into the tree.
-    await appendL1ToL2MessagesToTree(db, l1ToL2Messages);
+    // Insert l1-to-l2 messages into the tree (legacy flow: the whole checkpoint's messages up front).
+    if (!insertMessagesPerBlock) {
+      await appendL1ToL2MessagesToTree(db, l1ToL2Messages);
+    }
 
     return new LightweightCheckpointBuilder(
       checkpointNumber,
@@ -172,7 +177,7 @@ export class LightweightCheckpointBuilder {
   public async addBlock(
     globalVariables: GlobalVariables,
     txs: ProcessedTx[],
-    opts: { insertTxsEffects?: boolean; expectedEndState?: StateReference } = {},
+    opts: { insertTxsEffects?: boolean; expectedEndState?: StateReference; l1ToL2Messages?: Fr[] } = {},
   ): Promise<{ block: L2Block; timings: Record<string, number> }> {
     const timings: Record<string, number> = {};
     const isFirstBlock = this.blocks.length === 0;
@@ -203,6 +208,20 @@ export class LightweightCheckpointBuilder {
       timings.insertSideEffects = msInsertSideEffects;
     }
 
+    // Streaming Inbox (AZIP-22 Fast Inbox): insert this block's L1-to-L2 message bundle before reading the end state,
+    // so the block header's L1-to-L2 tree snapshot reflects it. First-in-checkpoint bundles are padded to
+    // NUMBER_OF_L1_L2_MESSAGES_PER_ROLLUP (matching the legacy per-checkpoint insertion and the world-state
+    // synchronizer); non-first bundles are appended compactly. The logical (unpadded) messages are accumulated only
+    // once the block is fully built (below), so a mid-build failure does not pollute the checkpoint's inHash/rolling
+    // hash; the rolling hash and inHash are recomputed over them at checkpoint completion.
+    if (opts.l1ToL2Messages !== undefined) {
+      if (isFirstBlock) {
+        await appendL1ToL2MessagesToTree(this.db, opts.l1ToL2Messages);
+      } else {
+        await this.db.appendLeaves(MerkleTreeId.L1_TO_L2_MESSAGE_TREE, opts.l1ToL2Messages);
+      }
+    }
+
     const [msGetEndState, endState] = await elapsed(() => this.db.getStateReference());
     timings.getEndState = msGetEndState;
 
@@ -238,6 +257,12 @@ export class LightweightCheckpointBuilder {
     const block = new L2Block(newArchive, header, body, this.checkpointNumber, indexWithinCheckpoint);
     this.blocks.push(block);
 
+    // Accumulate the streaming bundle now that the block is fully built, so a mid-build throw above leaves the
+    // checkpoint's message list (and thus its inHash/rolling hash) consistent with the blocks actually built.
+    if (opts.l1ToL2Messages !== undefined) {
+      this.l1ToL2Messages.push(...opts.l1ToL2Messages);
+    }
+
     const [msSpongeAbsorb] = await elapsed(() => this.spongeBlob.absorb(blockBlobFields));
     timings.spongeAbsorb = msSpongeAbsorb;
     this.blobFields.push(...blockBlobFields);

yarn-project/sequencer-client/src/config.ts

@@ -69,6 +69,7 @@ export const DefaultSequencerConfig = {
   skipPushProposedBlocksToArchiver: false,
   skipPublishingCheckpointsPercent: 0,
   maxBlocksPerCheckpoint: DEFAULT_MAX_BLOCKS_PER_CHECKPOINT,
+  streamingInbox: false,
 } satisfies ResolvedSequencerConfig;
 
 /**

yarn-project/sequencer-client/src/sequencer/checkpoint_proposal_job.test.ts

@@ -40,7 +40,7 @@ import {
   type ResolvedSequencerConfig,
   type WorldStateSynchronizer,
 } from '@aztec/stdlib/interfaces/server';
-import type { L1ToL2MessageSource } from '@aztec/stdlib/messaging';
+import type { InboxBucket, L1ToL2MessageSource } from '@aztec/stdlib/messaging';
 import { BlockProposal, CheckpointProposal, type CoordinationSignatureContext } from '@aztec/stdlib/p2p';
 import { CheckpointHeader } from '@aztec/stdlib/rollup';
 import type { ProposerTimetable, SubslotSelection } from '@aztec/stdlib/timetable';
@@ -1394,6 +1394,59 @@ describe('CheckpointProposalJob', () => {
     });
   });
 
+  describe('streaming inbox (flag on)', () => {
+    beforeEach(() => {
+      job.setTimetable(makeProposerTimetable({ l1Constants, blockDurationMs: 3000 }));
+      job.updateConfig({ streamingInbox: true });
+    });
+
+    it('streams per-block bucket bundles, advances the reference, and skips the bulk message fetch', async () => {
+      jest
+        .spyOn(job.getTimetable(), 'selectNextSubslot')
+        .mockReturnValueOnce(subslot(10, 0, false))
+        .mockReturnValueOnce(subslot(18, 1, true))
+        .mockReturnValue(noSubslot());
+
+      // The archiver returns the newest synced bucket (seq 2) for any lag/cutoff lookup, so the first block
+      // consumes through it and the second block (cursor already at seq 2) consumes nothing and reuses the ref.
+      const bucket: InboxBucket = {
+        seq: 2n,
+        inboxRollingHash: new Fr(99),
+        totalMsgCount: 5n,
+        timestamp: 0n,
+        msgCount: 2,
+        lastMessageIndex: 4n,
+      };
+      const bundle = Array.from({ length: 5 }, (_, i) => new Fr(i + 1));
+      l1ToL2MessageSource.getLatestInboxBucketAtOrBefore.mockResolvedValue(bucket);
+      l1ToL2MessageSource.getL1ToL2MessagesBetweenBuckets.mockResolvedValue(bundle);
+
+      const { lastBlock } = await setupMultipleBlocks(2, [2, 1]);
+      validatorClient.collectAttestations.mockResolvedValue(getAttestations(lastBlock));
+
+      const checkpoint = await job.executeAndAwait();
+
+      expect(checkpoint).toBeDefined();
+
+      // Streaming skips the bulk per-checkpoint fetch and tells the builder to insert messages per block.
+      expect(l1ToL2MessageSource.getL1ToL2Messages).not.toHaveBeenCalled();
+      expect(checkpointsBuilder.startCheckpointCalls).toHaveLength(1);
+      expect(checkpointsBuilder.startCheckpointCalls[0].l1ToL2Messages).toEqual([]);
+      expect(checkpointsBuilder.startCheckpointCalls[0].insertMessagesPerBlock).toBe(true);
+
+      // The first block consumes the selected bundle; the second consumes nothing.
+      expect(checkpointBuilder.buildBlockCalls).toHaveLength(2);
+      expect(checkpointBuilder.buildBlockCalls[0].opts.l1ToL2Messages).toEqual(bundle);
+      expect(checkpointBuilder.buildBlockCalls[1].opts.l1ToL2Messages).toEqual([]);
+
+      // Both block proposals carry the selected bucket reference (the second reuses the first's).
+      const bucketRefArgs = validatorClient.createBlockProposal.mock.calls.map(call => call[8]);
+      expect(bucketRefArgs).toHaveLength(2);
+      expect(bucketRefArgs[0]?.bucketSeq).toBe(2n);
+      expect(bucketRefArgs[1]?.bucketSeq).toBe(2n);
+    });
+  });
+
   describe('build single block', () => {
     it('does not build a block if not enough valid txs are collected', async () => {
       // We have enough txs, but not enough valid ones