feat: expose inbox rolling hash on root rollup public inputs (A-1373)

Add the {previous, end} inbox rolling-hash pair to RootRollupPublicInputs so
the epoch's consumed chain segment is carried through to proof verification.
The root rollup sources the pair from the merged checkpoint public inputs;
continuity within the range is already enforced by the checkpoint merges.

On L1, PublicInputArgs gains previousInboxRollingHash/endInboxRollingHash and
EpochProofLib places them at public-input positions 3 and 4 (header hashes,
fees, constants and blob inputs shift by two). Both values are deliberately
unvalidated until the Fast Inbox flip, when they will be checked against the
per-checkpoint records written at propose; for now they are pass-through only.

Also fixes two ivc-integration benchmark generators whose hand-built parity
base inputs were missing start_rolling_hash/num_msgs.

Author: spalladino

l1-contracts/src/core/interfaces/IRollup.sol

@@ -27,6 +27,11 @@ struct PublicInputArgs {
   bytes32 previousArchive;
   bytes32 endArchive;
   bytes32 outHash;
+  // Inbox rolling-hash chain segment consumed across the proven epoch (AZIP-22 Fast Inbox). Deliberately UNVALIDATED
+  // until the Fast Inbox flip, when they get checked against per-checkpoint records written at propose; for now they
+  // are only passed through to the proof's public inputs.
+  bytes32 previousInboxRollingHash;
+  bytes32 endInboxRollingHash;
   address proverId;
 }
 

l1-contracts/src/core/libraries/ConstantsGen.sol

@@ -25,7 +25,7 @@ library Constants {
     355_785_372_471_781_095_838_790_036_702_437_931_769_306_153_278_986_832_745_847_530_947_941_691_539;
   uint256 internal constant FEE_JUICE_ADDRESS = 3;
   uint256 internal constant BLS12_POINT_COMPRESSED_BYTES = 48;
-  uint256 internal constant ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH = 111;
+  uint256 internal constant ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH = 113;
   uint256 internal constant NUM_MSGS_PER_BASE_PARITY = 256;
   uint256 internal constant NUM_BASE_PARITY_PER_ROOT_PARITY = 4;
 }

l1-contracts/src/core/libraries/rollup/EpochProofLib.sol

@@ -191,6 +191,8 @@ library EpochProofLib {
     //   previous_archive_root: Field,
     //   end_archive_root: Field,
     //   out_hash: Field,
+    //   previous_inbox_rolling_hash: Field,
+    //   end_inbox_rolling_hash: Field,
     //   checkpointHeaderHashes: [Field; Constants.MAX_CHECKPOINTS_PER_EPOCH],
     //   fees: [FeeRecipient; Constants.MAX_CHECKPOINTS_PER_EPOCH],
     //   chain_id: Field,
@@ -208,15 +210,21 @@ library EpochProofLib {
       publicInputs[1] = _args.endArchive;
 
       publicInputs[2] = _args.outHash;
+
+      // Inbox rolling-hash chain segment consumed across the epoch (AZIP-22 Fast Inbox). Deliberately UNVALIDATED
+      // until the Fast Inbox flip, when they get checked against per-checkpoint records written at propose; for now
+      // they are only passed through to the proof's public inputs.
+      publicInputs[3] = _args.previousInboxRollingHash;
+      publicInputs[4] = _args.endInboxRollingHash;
     }
 
     uint256 numCheckpoints = _end - _start + 1;
 
     for (uint256 i = 0; i < numCheckpoints; i++) {
-      publicInputs[3 + i] = STFLib.getHeaderHash(_start + i);
+      publicInputs[5 + i] = STFLib.getHeaderHash(_start + i);
     }
 
-    uint256 offset = 3 + Constants.MAX_CHECKPOINTS_PER_EPOCH;
+    uint256 offset = 5 + Constants.MAX_CHECKPOINTS_PER_EPOCH;
 
     // Taking recipient/value from the checkpoint headers rather than the prover
     // as defense in depth. Slots past numCheckpoints stay zero.

l1-contracts/test/Rollup.t.sol

@@ -874,6 +874,52 @@ contract RollupTest is RollupBase {
     assertEq(outbox.getRootData(Epoch.wrap(0), 2), outHash2, "Root at K=2 should be outHash2");
   }
 
+  // getEpochProofPublicInputs is the view that the prover-publisher calls off-chain to validate its inputs before
+  // submitting. Because the fee recipient/value public inputs are taken from the supplied headers, the header check
+  // must run here too - not only on the submit path - so a mismatch is caught before publishing rather than reverting
+  // on-chain.
+  function testGetEpochProofPublicInputsVerifiesHeaders() public setUpFor("empty_checkpoint_1") {
+    _proposeCheckpoint("empty_checkpoint_1", 1);
+
+    DecoderBase.Data memory data = load("empty_checkpoint_1").checkpoint;
+    CheckpointLog memory checkpoint = rollup.getCheckpoint(0);
+
+    PublicInputArgs memory args = PublicInputArgs({
+      previousArchive: checkpoint.archive,
+      endArchive: data.archive,
+      outHash: data.header.outHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: data.header.inboxRollingHash,
+      proverId: address(0)
+    });
+
+    ProposedHeader[] memory headers = new ProposedHeader[](1);
+    headers[0] = proposedHeaders[1];
+
+    // With the canonical header, the getter assembles the public inputs, sourcing the fee recipient/value from the
+    // header.
+    bytes32[] memory publicInputs = rollup.getEpochProofPublicInputs(1, 1, args, headers, data.batchedBlobInputs);
+    assertEq(publicInputs.length, Constants.ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH, "Unexpected public inputs length");
+
+    uint256 feesOffset = 5 + Constants.MAX_CHECKPOINTS_PER_EPOCH;
+    assertEq(
+      publicInputs[feesOffset], bytes32(uint256(uint160(headers[0].coinbase))), "Coinbase not sourced from header"
+    );
+    assertEq(
+      publicInputs[feesOffset + 1], bytes32(headers[0].accumulatedFees), "Accumulated fees not sourced from header"
+    );
+
+    // Tamper a fee field so the header no longer hashes to the stored value; the getter must reject it.
+    bytes32 expectedHeaderHash = ProposedHeaderLib.hash(headers[0]);
+    headers[0].accumulatedFees += 1;
+    bytes32 providedHeaderHash = ProposedHeaderLib.hash(headers[0]);
+
+    vm.expectRevert(
+      abi.encodeWithSelector(Errors.Rollup__InvalidCheckpointHeader.selector, expectedHeaderHash, providedHeaderHash)
+    );
+    rollup.getEpochProofPublicInputs(1, 1, args, headers, data.batchedBlobInputs);
+  }
+
   function _submitEpochProof(
     uint256 _start,
     uint256 _end,
@@ -895,7 +941,12 @@ contract RollupTest is RollupBase {
     address _prover
   ) internal {
     PublicInputArgs memory args = PublicInputArgs({
-      previousArchive: _prevArchive, endArchive: _archive, outHash: _outHash, proverId: _prover
+      previousArchive: _prevArchive,
+      endArchive: _archive,
+      outHash: _outHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: 0,
+      proverId: _prover
     });
 
     uint256 size = _end - _start + 1;

l1-contracts/test/base/RollupBase.sol

@@ -78,6 +78,8 @@ contract RollupBase is DecoderBase {
       previousArchive: parentCheckpointLog.archive,
       endArchive: endFull.checkpoint.archive,
       outHash: endFull.checkpoint.header.outHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: 0,
       proverId: _prover
     });
 

l1-contracts/test/benchmark/happy.t.sol

@@ -511,6 +511,8 @@ contract BenchmarkRollupTest is FeeModelTestPoints, DecoderBase {
           previousArchive: rollup.getCheckpoint(start).archive,
           endArchive: endCheckpoint.archive,
           outHash: endCheckpoint.outHash,
+          previousInboxRollingHash: 0,
+          endInboxRollingHash: 0,
           proverId: address(0)
         });
 

l1-contracts/test/compression/PreHeating.t.sol

@@ -263,6 +263,8 @@ contract PreHeatingTest is FeeModelTestPoints, DecoderBase {
           previousArchive: rollup.getCheckpoint(start).archive,
           endArchive: endCheckpoint.archive,
           outHash: endCheckpoint.outHash,
+          previousInboxRollingHash: 0,
+          endInboxRollingHash: 0,
           proverId: address(0)
         });
 

l1-contracts/test/escape-hatch/integration/EscapeHatchIntegrationBase.sol

@@ -325,6 +325,8 @@ abstract contract EscapeHatchIntegrationBase is ValidatorSelectionTestBase {
       previousArchive: previousArchive,
       endArchive: endArchive,
       outHash: endFull.checkpoint.header.outHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: 0,
       proverId: _prover
     });
 

l1-contracts/test/escape-hatch/integration/regression/OutHashValidationSkipped.t.sol

@@ -60,6 +60,8 @@ contract OutHashValidationSkippedTest is EscapeHatchIntegrationBase {
       previousArchive: rollup.archiveAt(0),
       endArchive: rollup.archiveAt(1),
       outHash: wrongOutHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: 0,
       proverId: address(this)
     });
 

l1-contracts/test/escape-hatch/integration/submitEpochRootProof.t.sol

@@ -112,7 +112,12 @@ contract submitEpochRootProofTest is EscapeHatchIntegrationBase {
     bytes32 outHash = rollup.getCheckpoint(1).outHash;
 
     PublicInputArgs memory args = PublicInputArgs({
-      previousArchive: previousArchive, endArchive: endArchive, outHash: outHash, proverId: address(this)
+      previousArchive: previousArchive,
+      endArchive: endArchive,
+      outHash: outHash,
+      previousInboxRollingHash: 0,
+      endInboxRollingHash: 0,
+      proverId: address(this)
     });
 
     ProposedHeader[] memory headers = new ProposedHeader[](1);