feat(fast-inbox): per-block L1-to-L2 message bundles, move parity to checkpoint root (A-1374)

[spalladino]

Stacked on #24600 (A-1373). AZIP-22 Fast Inbox, FI-04.

What

Moves parity verification from the block-root circuits to the checkpoint root, and gives every block-root variant a per-block L1→L2 message bundle. This gets the circuit structure right for per-block messages while keeping behavior bit-identical to today — the flip to compact per-block distribution (FI-14) becomes a constant change plus padding removal, not a circuit restructure.

Circuits (noir)

• Block-root variants take a message bundle (l1_to_l2_messages, num_msgs, frontier hint) and append it to the L1→L2 tree via append_leaves_to_snapshot (the A-1372 gadget), absorbing the same leaves into an L1ToL2MessageSponge (Poseidon2) threaded across the checkpoint's blocks. First-block variants lose the parity-root proof.
• BlockRollupPublicInputs drops in_hash and the FI-03 inbox_rolling_hash pair; gains is_first_block: bool and start_msg_sponge/end_msg_sponge. is_first_block takes over in_hash's former structural role (leftmost asserted true at the checkpoint root, every right rollup asserted false at merge) and drives the block-end blob-absorb flag.
• Block merge propagates is_first_block and start_msg_sponge from the left, end_msg_sponge from the right; validate_consecutive_block_rollups asserts !right.is_first_block and right.start_msg_sponge == left.end_msg_sponge.
• Checkpoint root verifies the moved parity-root proof, asserts parity.start_sponge == empty and merged.end_msg_sponge == parity.end_sponge (the "blocks inserted exactly the parity-committed list, in order" check — no leaf arrays cross a circuit boundary), and sources the header's in_hash = parity.sha_root and inbox_rolling_hash = parity.end_rolling_hash.
• Parity base absorbs the padded batch into a message sponge; parity root threads it across the four bases alongside the rolling hash.

TypeScript

• New stdlib/src/messaging/l1_to_l2_message_sponge.ts mirrors the noir sponge (iv-0, absorb-only). Parity/block/checkpoint-root inputs and conversion/server.ts mirror the field changes.
• Orchestrator DAG: parity proofs move from block-proving-state.ts to checkpoint-proving-state.ts; the sub-tree enqueues parity once per checkpoint and surfaces it in SubTreeResult; block roots no longer gate on parity. Transitional wiring: first block carries the checkpoint's messages padded to 1024 (num_msgs=1024), non-first blocks carry empty bundles inheriting the checkpoint sponge.

Constants

L1_TO_L2_MESSAGE_SPONGE_LENGTH = 10; BLOCK_ROLLUP_PUBLIC_INPUTS_LENGTH 58 → 76. Circuit ABIs changed, so pinned-build.tar.gz is regenerated and committed.

Testing

• noir rollup_lib 386 passed (adds sponge-threading, is_first_block structural, and checkpoint-root parity/sponge-mismatch failure cases); transitional equivalence held (append_matches_subtree_insert_1024, unchanged checkpoint-header fixtures).
• yarn build, yarn lint/format, forge, orchestrator suites (15), and touched stdlib suites (22) all green.
• Cross-chain l1_to_l2 e2e: the real send+consume path (the new per-block bundle circuit path) works; the suite's only two cases are the duplicate re-consumption ones, which hit a pre-existing PXE nullifier-sync issue registered flaky in .test_patterns.yml, unrelated to this change.
• A codex cross-layer review found no correctness bugs; it confirmed sponge chunking associativity, tree/list pinning, is_first_block soundness, header sourcing/continuity, the blob-flag derivation, and TS↔noir serde order.

Proving-broker scheduling (relocated from A-1427)

This branch now carries the oldest-epoch-first proving-broker scheduling fix (originally the head commit of #24759 / A-1427), moved down to the base of this segment. On the intermediate stack the single prover agent otherwise starves PARITY_BASE behind later-epoch BLOCK_ROOT jobs, so long_proving_time deterministically times out here; with the commit present it passes (generates proof over multiple epochs, verified on a bb-capable box). The move is content-neutral at the stack top — only the commit's position changed.

The relocated commit's proving-broker test asserts an older epoch beats a higher-priority proof type from a younger epoch. It needs a proof type that is (a) lower-priority than PRIVATE_TX_BASE_ROLLUP and (b) present under the same name across the whole stack, since this commit sits at the base and its content flows up unchanged. No parity name qualifies: it originally used INBOX_PARITY (only exists at A-1427 and above), and PARITY_BASE only exists at A-1374/A-1375 because A-1427 replaces both PARITY_BASE/PARITY_ROOT with a single INBOX_PARITY. The test now uses PUBLIC_VM, which is stable across the entire stack and sits just below PRIVATE_TX_BASE_ROLLUP in PROOF_TYPES_IN_PRIORITY_ORDER at every branch. Verified with a real tsc (not jest) at the owning branch (below the flip), at A-1384 (above the flip), and at the stack top.

[spalladino]

Is this flag temporary? Can we remove it once we allow any block to add messages to the tree, and just check that the start sponge of the leftmost block is empty, as we do with the blob sponge?

[spalladino]

Mostly yes — after the flip, and only after the blob-format question is settled. The flag does two jobs today:

1. Structural leftmost pinning (the old in_hash != 0 role). This one the sponge can take over exactly like SpongeBlob: leftmost start_msg_sponge == empty + merge continuity. One wrinkle: pre-flip, non-first blocks inherit the checkpoint sponge which is never empty (the padded 1024-zero bundle is absorbed even for an empty checkpoint), so the check is airtight; post-flip, an empty checkpoint gives every block an empty sponge, so a non-first variant could sit leftmost. What stops that from mattering is (2).
2. The blob-absorb gate: absorb_block_end_data emits the l1-to-l2 root only when is_first_block, premised on the root being checkpoint-constant — which stops being true post-flip anyway. Once the flip decides the blob format (absorb the root on every block, or derive it from the replayed message stream), this gate — and with it the flag — can go.

So: keep it through the transition, revisit together with the blob decision. Two things to do in the same change: (a) remove BLOCK_ROOT_MSGS_ONLY_ROLLUP_VK_INDEX from the single-block checkpoint root's allowlist first — today is_first_block is the only thing making a message-only sole block unprovable, so dropping the flag without that tweak silently legalizes a new checkpoint shape; (b) decide whether a "messages-only checkpoint" should in fact be provable post-flip (it's arguably desirable for Inbox draining) — if yes, that's a deliberate follow-up, not a side effect.

I've added a comment on that allowlist entry in #24612 flagging the coupling, so the two changes stay tied together and the entry isn't dropped independently.

[spalladino]

Superseded by #25036.

The Fast Inbox stack has been regrouped from 20 per-issue PRs (plus 2 umbrellas) down to 3 area PRs plus an umbrella, and rebased onto merge-train/spartan including #25007 (the noir-projects fnd//labs/ split). This PR's diff is preserved verbatim as a single squashed commit in #25036, and this description is preserved in that commit's message.

New structure: #25036 (circuits + L1) → #25037 (node + flip) → #25038 (cleanup), with #25039 as the full-stack umbrella. The original branch for this PR is left on the remote as a recovery point.

Closing here to cut the rebase and review overhead of maintaining 22 PRs; the work is not abandoned.