feat(fast-inbox): flip consensus to streaming inbox (A-1384)

Coordinated cutover of the Fast Inbox (AZIP-22) project (issue A-1384, FI-14). Flips the authoritative path across L1, circuits, and the node from the legacy `inHash`/frontier-tree consumption to the streaming rolling-hash Inbox.

Stacked on the node phase: #24784 (A-1379) -> #24785 (A-1380) -> #24786 (A-1381) -> #24787 (A-1382) -> #24788 (A-1383). Base is `spl/a-1383-validator-streaming`.

## Merge gate

- **A-1431 (domain-separation decision) must resolve before this merges.** It is deliberately deferred and nothing is adopted here. If it adopts a separator, the rolling-hash link-encoding change must be inserted below this PR in the stack.

## L1 (`l1-contracts`)

- `ProposeLib.propose` calls `validateInboxConsumption` against the parent checkpoint's consumed position (read from the parent temp-log record) instead of `inbox.consume()` + the `Rollup__InvalidInHash` check; the returned consumed total is stored in the new record.
- `ProposeArgs` gains an unsigned `bucketHint` calldata field (out of the attested payload digest).
- `TempCheckpointLog` / `CompressedTempCheckpointLog` carry `{inboxRollingHash, inboxMsgTotal, inboxConsumedBucket}`; genesis is `{0,0,0}`.
- `EpochProofLib.getEpochProofPublicInputs` anchors the rolling-hash chain start to the record of checkpoint `start - 1` (`Rollup__InvalidPreviousInboxRollingHash`).
- `Inbox.sendL2Message` returns and emits the compact cumulative message index.

## Circuits (`noir-projects`)

- `MAX_L1_TO_L2_MSGS_PER_BLOCK` 1024 -> 256.
- `L1ToL2MessageBundle` drops `num_real_msgs`; a single `num_msgs` drives the compact tree append and the message-sponge absorb.
- `SpongeBlob::absorb_block_end_data` absorbs the L1-to-L2 tree root for every block.

## Node (`yarn-project`)

- **Streaming is the only path**: the `streamingInbox` flag is removed across foundation/stdlib config + the sequencer/validator plumbing.
- **Sequencer**: sources the parent bucket from the fork's L1-to-L2 leaf count + `getInboxBucketByTotalMsgCount` (cross-checkpoint); feeds inHash zero; relaxes `waitForMinTxs` for message-only blocks; threads the consumed bucket seq as the propose `bucketHint`. Automine mirrors the selection.
- **Validator**: per-block acceptance + checkpoint re-execution always run; the checkpoint rebuild derives the consumed message list from the buckets between the parent checkpoint's position and the last block.
- **World state**: `appendL1ToL2MessagesToTree` / `handleL2BlockAndMessages` append real leaves at compact indices; the synchronizer derives each block's bundle from its leaf-index range.
- **Blob / constants / bundle**: per-block blob root, `MAX_L1_TO_L2_MSGS_PER_BLOCK = 256`, `L1ToL2MessageBundle` drops `numRealMsgs`; provable per-checkpoint ceiling 2457 -> 2234.
- **Archiver / TXE**: the dead inHash cross-check is removed; TXE appends unpadded compact leaves.
- **L1 ABI**: `@aztec/l1-artifacts` regenerated for the new `ProposeArgs` (gitignored generated output; the `ethereum` package builds against it).

## Verification

- L1 `forge test`: full propose/inbox suite green (ProposeInboxConsumption, Inbox, InboxBuckets, Rollup incl. a new anchoring negative, RollupFieldRange, FeeRollup, ValidatorSelection, escape-hatch, tmnt207/419).
- Circuits `nargo test`: parity, block_root structure, msgs_only green on touched crates.
- Node jest (runnable locally): validator proposal_handler (34) + streaming checks (14), sequencer inbox selector (9), world-state native (56), blob-lib + stdlib. tsc for the broken-build-zone packages (prover-client, sequencer-client, validator-client, etc.) is CI's job of record.
- Codex (gpt-5.6-terra) reviewed both the L1/circuits layer and the node wiring: no consensus-critical issue; bucket cursor/range `(fromExclusive, toInclusive]` and pipelining-parent sourcing verified correct.

VK regen and `Prover.toml` sample-input regen ride CI (local `bb write_vk` OOMs on `rollup_root`).

## Node prover + archiver keying (completed in this PR)

- **Prover per-block message split**: the checkpoint's messages are sliced per block from the blocks' L1-to-L2 leaf-count ranges; each block root appends its own real slice at compact indices with per-block start/end snapshots and a full-height frontier hint. `startCheckpoint` no longer inserts messages up front.
- **Checkpoint keying from records**: `getL1ToL2MessageCheckpoint` binary-searches the block records for the first block whose L1-to-L2 leaf count exceeds the message index (portal claim helpers depend on this); the prover-node derives the checkpoint's consumed messages from the Inbox buckets.

Codex (gpt-5.6-terra) reviewed the prover/keying rework: no consensus defect; slice partitioning, bucket-range agreement, fork ordering, frontier height, and the checkpoint boundary rule all verified.

## Left for FI-18 cleanup

The `message_store` `InboxLeaf` index-formula methods (`smallestIndexForCheckpoint` etc.) have no correctness-critical live callers post-flip; the public-simulator's next-checkpoint fetch degrades safely without them (simulates without the not-yet-consumed messages). Deleted in FI-18.

## Accepted residual risk

A-1390 (unconsumed-bucket overwrite protection) stays post-flip: a consumption backlog older than the Inbox ring can overwrite unconsumed buckets and halt proposals until an upgrade. Acceptable for non-production lines.


## Review follow-up (phase-2 final review)

A final review pass appended `fix(fast-inbox): thread per-block message sponges and wire the msgs-only block root in the prover`:

- The prover supplied the checkpoint-wide message sponge as every non-first block root's start sponge, which the block-merge/checkpoint-root continuity asserts reject whenever a non-first block carries messages. The sponge is now threaded per block.
- A zero-tx non-first block (the message-only shape this PR lets the sequencer produce) was rejected by `BlockProvingState` and the lightweight builder, and the orchestrator never selected the msgs-only block root. Both now accept it and route it through `BlockRootMsgsOnlyRollupPrivateInputs`.
- The required `bucketHint` parameter added to `enqueueProposeCheckpoint` here is now passed by the publisher unit/integration tests and the e2e synching test (the integration suite's consumption model is reworked for streaming semantics in #24793).

## Bucket-hint carry on final-block failure (CI fix)

The `cross_chain_messages` e2e ("builds multiple blocks per slot with L1 to L2 messages") caught a product regression: when a checkpoint's first block is message-only (consuming a bucket) and the final block fails to build, the `bucketHint` on the propose payload was reconstructed from the last successfully-built block's streaming cursor and lost the already-consumed bucket, so L1 `validateInboxConsumption` rejected the checkpoint. `CheckpointProposalBroadcast` now carries `bucketHint` explicitly, sourced from the streaming state's `lastBucketRef.bucketSeq` at both propose sites (fisherman and main), so the consumed bucket survives a final-block build failure. A `checkpoint_proposal_job.test.ts` regression case drives message-only-first-block + final-block-failure and asserts the enqueued hint is the consumed bucket (RED reverting the fix: `Expected 2n, Received 0n`).

## L1→L2 readiness gate on the PXE sync tip (CI fix)

The shared cross-chain e2e helper (`message_test_helpers.ts`) evaluated `isL1ToL2MessageReady` against the default `'latest'` tip, while these suites anchor the PXE to `syncChainTip: 'checkpointed'`. Pre-flip every message entered at the first block of the next checkpoint, so `'latest'` readiness coincided with checkpointed availability; post-flip per-block insertion lets the proposed chain reach a message's consume-checkpoint a full checkpoint before it is published on L1, so readiness flipped true while the PXE had not yet synced the message and the private consume simulated against a missing membership witness (`No L1 to L2 message found`). This deterministically failed `l1_to_l2.test.ts` from this branch up. The helper now gates on the configured PXE sync tip via a new `CrossChainMessagingTest.pxeSyncChainTip` getter (defaulting to `'latest'`, so suites that do not pin a tip keep their semantics). Test-support only; box-verified green on all three cross-chain suites (`l1_to_l2`, `streaming_inbox`, `l1_to_l2_inbox_drift`).

## Per-block L1→L2 message tree root in archiver reconstruction (consensus fix)

The archiver's checkpoint reconstruction (`retrievedToPublishedCheckpoint` in `data_retrieval.ts`) read the L1→L2 message tree root once from the checkpoint's **first** block and applied it to every block — a stale pre-flip per-checkpoint assumption. Post-flip the blob carries a **per-block** root (any block in a checkpoint can insert messages). A follower node (prover / sync-only) that rebuilds a non-first message-inserting block therefore got the first block's root, so its world-state synchronizer inserted the correct message, recomputed the real root, and mismatched the reconstructed header (`block state does not match world state`) — forking the node from the sequencer on the first message-consuming block. In production this would fork every prover/follower on the first cross-chain-consuming block; it surfaced here as `cross_chain_public_message` and `token_bridge` failing (only follower nodes reconstruct via the archiver, which is why proposal validation — building from each validator's own world-state fork — never caught it). Reconstruction now uses each block's own `l1ToL2MessageRoot` from the blob. A `data_retrieval.test.ts` unit case asserts each reconstructed block's tree root matches its own blob root (RED: non-first blocks got the first block's root); both e2es green at a-1384.



## World-state mock Inbox buckets (CI fix, pass-8)

`world-state/src/test/integration.test.ts` drives the streaming synchronizer through `MockPrefilledArchiver`, but `setPrefilled` only seeded the legacy per-checkpoint message map and never registered Inbox buckets. Post-flip the synchronizer reconstructs each block's consumed L1→L2 bundle from buckets (`getInboxBucketByTotalMsgCount`), which returned undefined against the empty bucket map, so every block synced an empty bundle and the reconstructed state diverged from the header (`block state does not match world state`, then a 600s timeout). `setPrefilled` now registers a genesis sentinel plus one bucket per message-carrying checkpoint (cumulative `totalMsgCount` = the block's post-insertion leaf count), rebuilt from the full prefilled chain so reorg re-prefills stay aligned. Box: 12/12 (reorg 32s→2.4s), verified at a-1384 and top.

## Leftover sweep (post-review)

- Removed the inert `isFirstBlock` parameter from the blob-data test fixtures (`makeBlockEndBlobData` / `makeBlockBlobData` and the archiver `makeBlockBlobDataFromBody` helper). Post-flip every block carries its own L1-to-L2 root, so the flag had no effect on output; the earlier lint fix had only underscore-bound it "for call-site compatibility". The two now-identical blob-data tests are collapsed into one.



Replaces #24789.

Author: spalladino

l1-contracts/src/core/Rollup.sol

@@ -41,6 +41,7 @@ import {
   Epoch,
   Timestamp,
   CommitteeAttestations,
+  EpochProofExtLib,
   RollupOperationsExtLib,
   ValidatorOperationsExtLib,
   EthValue,
@@ -300,7 +301,7 @@ contract Rollup is IStaking, IValidatorSelection, IRollup, RollupCore {
     ProposedHeader[] calldata _headers,
     bytes calldata _blobPublicInputs
   ) external view override(IRollup) returns (bytes32[] memory) {
-    return RollupOperationsExtLib.getEpochProofPublicInputs(_start, _end, _args, _headers, _blobPublicInputs);
+    return EpochProofExtLib.getEpochProofPublicInputs(_start, _end, _args, _headers, _blobPublicInputs);
   }
 
   /**

l1-contracts/src/core/RollupCore.sol

@@ -18,6 +18,7 @@ import {IOutbox} from "@aztec/core/interfaces/messagebridge/IOutbox.sol";
 import {Constants} from "@aztec/core/libraries/ConstantsGen.sol";
 import {CommitteeAttestations} from "@aztec/core/libraries/rollup/AttestationLib.sol";
 import {Errors} from "@aztec/core/libraries/Errors.sol";
+import {EpochProofExtLib} from "@aztec/core/libraries/rollup/EpochProofExtLib.sol";
 import {RollupOperationsExtLib} from "@aztec/core/libraries/rollup/RollupOperationsExtLib.sol";
 import {ValidatorOperationsExtLib} from "@aztec/core/libraries/rollup/ValidatorOperationsExtLib.sol";
 import {SlasherDeploymentExtLib} from "@aztec/core/libraries/rollup/SlasherDeploymentExtLib.sol";
@@ -466,7 +467,7 @@ contract RollupCore is EIP712("Aztec Rollup", "1"), Ownable, IStakingCore, IVali
    * @param _args Contains the epoch range, public inputs, fees, attestations, and the ZK proof
    */
   function submitEpochRootProof(SubmitEpochRootProofArgs calldata _args) external override(IRollupCore) {
-    RollupOperationsExtLib.submitEpochRootProof(_args);
+    EpochProofExtLib.submitEpochRootProof(_args);
   }
 
   /**

l1-contracts/src/core/libraries/Errors.sol

@@ -60,6 +60,8 @@ library Errors {
   error Rollup__InvalidCheckpointNumber(uint256 expected, uint256 actual); // 0xd1ba9bfa
   error Rollup__InvalidInHash(bytes32 expected, bytes32 actual); // 0xcd6f4233
   error Rollup__InvalidInboxRollingHash(bytes32 expected, bytes32 actual); // 0xed1f7bb5
+  error Rollup__InvalidPreviousInboxRollingHash(bytes32 expected, bytes32 actual); // 0x2fe7cae5
+  error Rollup__InvalidEndInboxRollingHash(bytes32 expected, bytes32 actual); // 0x4a9cdb72
   error Rollup__InboxBucketStillMutable(uint256 bucketSeq); // 0x7254b980
   error Rollup__UnconsumedInboxMessages(uint256 nextBucketSeq); // 0x2bd4bf10
   error Rollup__InboxConsumptionBehindParent(uint256 expected, uint256 actual); // 0x54e0c025

l1-contracts/src/core/libraries/compressed-data/CheckpointLog.sol

@@ -34,7 +34,16 @@ struct TempCheckpointLog {
   bytes32 attestationsHash;
   bytes32 payloadDigest;
   Slot slotNumber;
+  // Streaming Inbox consumption counts (AZIP-22 Fast Inbox). `inboxMsgTotal` is the cumulative Inbox message count
+  // consumed as of this checkpoint (the child's parent-total origin); `inboxConsumedBucket` is the bucket sequence
+  // number the header's rolling hash corresponds to. Declared next to the slot number so the three share one storage
+  // slot (4 + 8 + 8 of 32 bytes): propose writes and reads that slot for the slot-progression check anyway.
+  uint64 inboxMsgTotal;
+  uint64 inboxConsumedBucket;
   FeeHeader feeHeader;
+  // The consensus Inbox rolling hash the checkpoint header committed to, in a slot of its own: epoch proofs anchor
+  // both ends of their consumed chain segment against it.
+  bytes32 inboxRollingHash;
 }
 
 struct CompressedTempCheckpointLog {
@@ -44,7 +53,10 @@ struct CompressedTempCheckpointLog {
   bytes32 attestationsHash;
   bytes32 payloadDigest;
   CompressedSlot slotNumber;
+  uint64 inboxMsgTotal;
+  uint64 inboxConsumedBucket;
   CompressedFeeHeader feeHeader;
+  bytes32 inboxRollingHash;
 }
 
 library CompressedTempCheckpointLogLib {
@@ -61,7 +73,10 @@ library CompressedTempCheckpointLogLib {
       attestationsHash: _checkpoint.attestationsHash,
       payloadDigest: _checkpoint.payloadDigest,
       slotNumber: _checkpoint.slotNumber.compress(),
-      feeHeader: _checkpoint.feeHeader.compress()
+      inboxMsgTotal: _checkpoint.inboxMsgTotal,
+      inboxConsumedBucket: _checkpoint.inboxConsumedBucket,
+      feeHeader: _checkpoint.feeHeader.compress(),
+      inboxRollingHash: _checkpoint.inboxRollingHash
     });
   }
 
@@ -77,7 +92,10 @@ library CompressedTempCheckpointLogLib {
       attestationsHash: _compressedCheckpoint.attestationsHash,
       payloadDigest: _compressedCheckpoint.payloadDigest,
       slotNumber: _compressedCheckpoint.slotNumber.decompress(),
-      feeHeader: _compressedCheckpoint.feeHeader.decompress()
+      inboxMsgTotal: _compressedCheckpoint.inboxMsgTotal,
+      inboxConsumedBucket: _compressedCheckpoint.inboxConsumedBucket,
+      feeHeader: _compressedCheckpoint.feeHeader.decompress(),
+      inboxRollingHash: _compressedCheckpoint.inboxRollingHash
     });
   }
 }

l1-contracts/src/core/libraries/rollup/EpochProofExtLib.sol

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2024 Aztec Labs.
+pragma solidity >=0.8.27;
+
+import {SubmitEpochRootProofArgs, PublicInputArgs} from "@aztec/core/interfaces/IRollup.sol";
+import {ProposedHeader} from "@aztec/core/libraries/rollup/ProposedHeaderLib.sol";
+import {EpochProofLib} from "./EpochProofLib.sol";
+
+/**
+ * @title EpochProofExtLib - External Rollup Library (Epoch Proof Functions)
+ * @author Aztec Labs
+ * @notice External library containing epoch-proof functions for the Rollup contract to avoid exceeding max
+ * contract size.
+ *
+ * @dev This library serves as an external library for the Rollup contract, splitting off the epoch proof
+ *      submission and public-input computation from RollupOperationsExtLib, which the streaming inbox
+ *      validation pushed over the deployable size limit. The library contains external functions primarily
+ *      focused on:
+ *      - Epoch proof submission and verification
+ *      - Epoch proof public input computation
+ */
+library EpochProofExtLib {
+  function submitEpochRootProof(SubmitEpochRootProofArgs calldata _args) external {
+    EpochProofLib.submitEpochRootProof(_args);
+  }
+
+  function getEpochProofPublicInputs(
+    uint256 _start,
+    uint256 _end,
+    PublicInputArgs calldata _args,
+    ProposedHeader[] calldata _headers,
+    bytes calldata _blobPublicInputs
+  ) external view returns (bytes32[] memory) {
+    return EpochProofLib.getEpochProofPublicInputs(_start, _end, _args, _headers, _blobPublicInputs);
+  }
+}

l1-contracts/src/core/libraries/rollup/EpochProofLib.sol

@@ -289,6 +289,30 @@ library EpochProofLib {
           expectedEndArchive == _args.endArchive, Errors.Rollup__InvalidArchive(expectedEndArchive, _args.endArchive)
         );
       }
+
+      // Boundary anchoring for the Inbox rolling-hash chain (AZIP-22 Fast Inbox), mirroring previousArchive/endArchive:
+      // both ends of the claimed chain segment must match the rolling hashes recorded at propose for checkpoints
+      // _start - 1 and _end. The start needs this to be sound - the previous checkpoint's header is not among this
+      // proof's public inputs, so nothing else pins where the segment begins. The end is already pinned transitively
+      // (the checkpoint root binds end_inbox_rolling_hash to the last checkpoint header, whose hash verifyHeaders ties
+      // to storage), so checking it here only trades a bare proof-verification failure for a specific error.
+      {
+        bytes32 expectedPreviousInboxRollingHash = STFLib.getInboxRollingHash(_start - 1);
+        require(
+          expectedPreviousInboxRollingHash == _args.previousInboxRollingHash,
+          Errors.Rollup__InvalidPreviousInboxRollingHash(
+            expectedPreviousInboxRollingHash, _args.previousInboxRollingHash
+          )
+        );
+      }
+
+      {
+        bytes32 expectedEndInboxRollingHash = STFLib.getInboxRollingHash(_end);
+        require(
+          expectedEndInboxRollingHash == _args.endInboxRollingHash,
+          Errors.Rollup__InvalidEndInboxRollingHash(expectedEndInboxRollingHash, _args.endInboxRollingHash)
+        );
+      }
     }
 
     bytes32[] memory publicInputs = new bytes32[](Constants.ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH);
@@ -319,9 +343,9 @@ library EpochProofLib {
 
       publicInputs[2] = _args.outHash;
 
-      // Inbox rolling-hash chain segment consumed across the epoch (AZIP-22 Fast Inbox). Deliberately UNVALIDATED
-      // until the Fast Inbox flip, when they get checked against per-checkpoint records written at propose; for now
-      // they are only passed through to the proof's public inputs.
+      // Inbox rolling-hash chain segment consumed across the epoch (AZIP-22 Fast Inbox). The start is validated above
+      // against the record written at propose for checkpoint _start - 1; the end is pinned transitively through the
+      // stored checkpoint header hashes (see the anchoring block in assertAcceptable).
       publicInputs[3] = _args.previousInboxRollingHash;
       publicInputs[4] = _args.endInboxRollingHash;
     }

l1-contracts/src/core/libraries/rollup/ProposeLib.sol

@@ -18,6 +18,7 @@ import {ValidatorSelectionLib} from "@aztec/core/libraries/rollup/ValidatorSelec
 import {Timestamp, Slot, Epoch, TimeLib} from "@aztec/core/libraries/TimeLib.sol";
 import {CompressedSlot, CompressedTimeMath} from "@aztec/shared/libraries/CompressedTimeMath.sol";
 import {Signature} from "@aztec/shared/libraries/SignatureLib.sol";
+import {SafeCast} from "@oz/utils/math/SafeCast.sol";
 import {ProposedHeader, ProposedHeaderLib} from "./ProposedHeaderLib.sol";
 import {STFLib} from "./STFLib.sol";
 
@@ -33,6 +34,10 @@ struct ProposeArgs {
   bytes32 archive;
   OracleInput oracleInput;
   ProposedHeader header;
+  // Sequence number of the Inbox bucket the header's `inboxRollingHash` corresponds to (AZIP-22 Fast Inbox).
+  // Unsigned lookup aid kept out of the attested payload digest: a wrong hint can only revert, never change what is
+  // accepted, since integrity comes from the rolling-hash equality check against the committee-signed header.
+  uint256 bucketHint;
 }
 
 struct ProposePayload {
@@ -46,7 +51,9 @@ struct InterimProposeValues {
   bytes32[] blobHashes;
   bytes32 blobsHashesCommitment;
   bytes[] blobCommitments;
-  bytes32 inHash;
+  bytes32 blobCommitmentsHash;
+  FeeHeader feeHeader;
+  uint256 consumedInboxMsgTotal;
   bytes32 headerHash;
   bytes32 attestationsHash;
   bytes32 payloadDigest;
@@ -121,6 +128,7 @@ library ProposeLib {
   using TimeLib for Epoch;
   using CompressedTimeMath for CompressedSlot;
   using ChainTipsLib for CompressedChainTips;
+  using SafeCast for uint256;
 
   /**
    * @notice  Publishes a new checkpoint to the pending chain.
@@ -261,17 +269,31 @@ library ProposeLib {
     uint256 checkpointNumber = tips.getPending() + 1;
     tips = tips.updatePending(checkpointNumber);
 
+    // Validate the streaming Inbox consumption against the parent checkpoint's consumed position (AZIP-22 Fast
+    // Inbox). The parent is checkpointNumber - 1, always available: checkpoint 0 carries the {0,0,0} genesis base
+    // case written at initialization. rollupStore.tips is not committed until below, so the parent read still sees
+    // the parent as the pending tip. The returned cumulative total is stored in this checkpoint's record so its
+    // child validates against it and, since temp-log records rewind with the pending chain on a prune, the record
+    // stays prune-consistent.
+    v.consumedInboxMsgTotal = validateInboxConsumption(
+      rollupStore.config.inbox,
+      v.header.inboxRollingHash,
+      _args.bucketHint,
+      v.header.slotNumber,
+      STFLib.getInboxMsgTotal(checkpointNumber - 1)
+    );
+
     // Calculate accumulated blob commitments hash for this checkpoint
     // Blob commitments are collected and proven per root rollup proof (per epoch),
     // so we need to know whether we are at the epoch start:
     v.isFirstCheckpointOfEpoch =
       v.currentEpoch > STFLib.getEpochForCheckpoint(checkpointNumber - 1) || checkpointNumber == 1;
-    bytes32 blobCommitmentsHash = BlobLib.calculateBlobCommitmentsHash(
+    v.blobCommitmentsHash = BlobLib.calculateBlobCommitmentsHash(
       STFLib.getBlobCommitmentsHash(checkpointNumber - 1), v.blobCommitments, v.isFirstCheckpointOfEpoch
     );
 
     // Compute fee header for checkpoint metadata
-    FeeHeader memory feeHeader = FeeLib.computeFeeHeader(
+    v.feeHeader = FeeLib.computeFeeHeader(
       checkpointNumber,
       _args.oracleInput.feeAssetPriceModifier,
       v.header.totalManaUsed,
@@ -289,20 +311,18 @@ library ProposeLib {
     STFLib.addTempCheckpointLog(
       TempCheckpointLog({
         headerHash: v.headerHash,
-        blobCommitmentsHash: blobCommitmentsHash,
+        blobCommitmentsHash: v.blobCommitmentsHash,
         outHash: v.header.outHash,
         attestationsHash: v.attestationsHash,
         payloadDigest: v.payloadDigest,
         slotNumber: v.header.slotNumber,
-        feeHeader: feeHeader
+        feeHeader: v.feeHeader,
+        inboxRollingHash: v.header.inboxRollingHash,
+        inboxMsgTotal: v.consumedInboxMsgTotal.toUint64(),
+        inboxConsumedBucket: _args.bucketHint.toUint64()
       })
     );
 
-    // Consume pending L1->L2 messages and validate against header commitment
-    // @note  The checkpoint number here will always be >=1 as the genesis checkpoint is at 0
-    v.inHash = rollupStore.config.inbox.consume(checkpointNumber);
-    require(v.header.inHash == v.inHash, Errors.Rollup__InvalidInHash(v.inHash, v.header.inHash));
-
     {
       bytes32 archive = _args.archive;
       if (v.isEscapeHatch) {

l1-contracts/src/core/libraries/rollup/RollupOperationsExtLib.sol

@@ -4,12 +4,9 @@
 pragma solidity >=0.8.27;
 
 import {Errors} from "@aztec/core/libraries/Errors.sol";
-import {SubmitEpochRootProofArgs, PublicInputArgs} from "@aztec/core/interfaces/IRollup.sol";
 import {STFLib} from "@aztec/core/libraries/rollup/STFLib.sol";
 import {Timestamp, TimeLib, Slot, Epoch} from "@aztec/core/libraries/TimeLib.sol";
 import {BlobLib} from "@aztec-blob-lib/BlobLib.sol";
-import {EpochProofLib} from "./EpochProofLib.sol";
-import {ProposedHeader} from "@aztec/core/libraries/rollup/ProposedHeaderLib.sol";
 import {AttestationLib} from "@aztec/core/libraries/rollup/AttestationLib.sol";
 import {
   ProposeLib,
@@ -21,16 +18,16 @@ import {
 import {Signature} from "@aztec/shared/libraries/SignatureLib.sol";
 
 /**
- * @title RollupOperationsExtLib - External Rollup Library (Proposal and Proof Verification Functions)
+ * @title RollupOperationsExtLib - External Rollup Library (Proposal Functions)
  * @author Aztec Labs
  * @notice External library containing proposal-related functions for the Rollup contract to avoid exceeding max
  * contract size.
  *
  * @dev This library serves as an external library for the Rollup contract, splitting off proposal-related
- *      functionality to keep the main contract within the maximum contract size limit. The library contains
- *      external functions primarily focused on:
+ *      functionality to keep the main contract within the maximum contract size limit. Epoch-proof functions
+ *      live in EpochProofExtLib to keep this library itself deployable. The library contains external
+ *      functions primarily focused on:
  *      - Checkpoint proposal submission and validation
- *      - Epoch proof submission and verification
  *      - Blob validation and commitment management
  *      - Chain pruning operations
  */
@@ -39,10 +36,6 @@ library RollupOperationsExtLib {
   using TimeLib for Slot;
   using AttestationLib for CommitteeAttestations;
 
-  function submitEpochRootProof(SubmitEpochRootProofArgs calldata _args) external {
-    EpochProofLib.submitEpochRootProof(_args);
-  }
-
   function validateHeaderWithAttestations(
     ValidateHeaderArgs calldata _args,
     CommitteeAttestations calldata _attestations,
@@ -78,16 +71,6 @@ library RollupOperationsExtLib {
     STFLib.prune();
   }
 
-  function getEpochProofPublicInputs(
-    uint256 _start,
-    uint256 _end,
-    PublicInputArgs calldata _args,
-    ProposedHeader[] calldata _headers,
-    bytes calldata _blobPublicInputs
-  ) external view returns (bytes32[] memory) {
-    return EpochProofLib.getEpochProofPublicInputs(_start, _end, _args, _headers, _blobPublicInputs);
-  }
-
   function validateBlobs(bytes calldata _blobsInput, bool _checkBlob)
     external
     view

l1-contracts/src/core/libraries/rollup/STFLib.sol

@@ -132,7 +132,12 @@ library STFLib {
         slotNumber: Slot.wrap(0),
         feeHeader: FeeHeader({
           excessMana: 0, manaUsed: 0, ethPerFeeAsset: _initialEthPerFeeAsset, congestionCost: 0, proverCost: 0
-        })
+        }),
+        // Genesis Inbox consumption base case, matching the Inbox's genesis bucket-0 sentinel {0, 0, 0}, so
+        // checkpoint 1 validates its consumption against it (AZIP-22 Fast Inbox).
+        inboxRollingHash: bytes32(0),
+        inboxMsgTotal: 0,
+        inboxConsumedBucket: 0
       }).compress();
   }
 
@@ -305,6 +310,26 @@ library STFLib {
     return getStorageTempCheckpointLog(_checkpointNumber).slotNumber.decompress();
   }
 
+  /**
+   * @notice Retrieves the cumulative Inbox message count consumed as of a checkpoint (AZIP-22 Fast Inbox)
+   * @dev Gas-efficient accessor reading only the streaming-inbox consumed total. Reverts if the checkpoint is stale.
+   * @param _checkpointNumber The checkpoint number to get the consumed total for
+   * @return The cumulative Inbox message count consumed as of the checkpoint
+   */
+  function getInboxMsgTotal(uint256 _checkpointNumber) internal view returns (uint64) {
+    return getStorageTempCheckpointLog(_checkpointNumber).inboxMsgTotal;
+  }
+
+  /**
+   * @notice Retrieves the Inbox rolling hash a checkpoint committed to (AZIP-22 Fast Inbox)
+   * @dev Gas-efficient accessor reading only the streaming-inbox rolling hash. Reverts if the checkpoint is stale.
+   * @param _checkpointNumber The checkpoint number to get the rolling hash for
+   * @return The consensus Inbox rolling hash recorded for the checkpoint
+   */
+  function getInboxRollingHash(uint256 _checkpointNumber) internal view returns (bytes32) {
+    return getStorageTempCheckpointLog(_checkpointNumber).inboxRollingHash;
+  }
+
   /**
    * @notice Gets the effective pending checkpoint number based on pruning eligibility
    * @dev Returns either the pending checkpoint number or proven checkpoint number depending on

l1-contracts/src/core/messagebridge/Inbox.sol

@@ -130,10 +130,10 @@ contract Inbox is IInbox {
       currentTree = trees[inProgress];
     }
 
-    // this is the global leaf index and not index in the checkpoint subtree
-    // such that users can simply use it and don't need access to a node if they are to consume it in public.
-    // trees are constant size so global index = tree number * size + subtree index
-    uint256 index = (inProgress - Constants.INITIAL_CHECKPOINT_NUMBER) * SIZE + currentTree.nextIndex;
+    // Compact cumulative message index (AZIP-22 Fast Inbox): the zero-based position of this message in the Inbox's
+    // insertion order, equal to the number of messages inserted before it. It is embedded in the leaf preimage and
+    // matches the streaming L1-to-L2 tree's leaf count, so consumers do not need per-checkpoint tree geometry.
+    uint256 index = totalMessagesInserted;
 
     // If the sender is the fee asset portal, we use a magic address to simpler have it initialized at genesis.
     // We assume that no-one will know the private key for this address and that the precompile won't change to