feat(testutil/validatormock): port Phase 1 foundation

Mirrors `charon/testutil/validatormock` (Go) into Rust. This first phase lays
the foundation that the propose/attest/synccomm/component ports build on:

- `meta.rs`  - SpecMeta + MetaSlot + MetaEpoch value types (port of meta.go).
- `sign.rs`  - `Sign` trait + `Signer` + `SignFunc = Arc<dyn Sign>` (Go's
  SignFunc + NewSigner) backed by `pluto-crypto` BlstImpl.
- `validators.rs` - local `ActiveValidators` newtype + `active_validators(client)`
  helper. Avoids a `pluto-testutil -> pluto-app` dep, since `pluto-app` already
  dev-depends on this crate.
- `capture.rs` - test-only `SubmissionCapture` wiremock helper. Equivalent of
  Go's `beaconMock.SubmitAttestationsFunc = ...` callback fields - mounts a
  high-priority `Mock` on `BeaconMock::server()` and records POST bodies.
- `error.rs`  - module-wide `Error` + `SignError` (thiserror).
- `testdata/TestAttest_*.golden` - byte-for-byte copies of the Go fixtures
  used by the Phase-2 attest port.

The Cargo cycle `pluto-eth2util <-> pluto-testutil` is broken by moving
`pluto-testutil` from `[dependencies]` to `[dev-dependencies]` in
`crates/eth2util/Cargo.toml`. The three call sites in `eth2util` (signing,
eth2exp, enr tests) are all `#[cfg(test)]`, so the move is a no-op for
production code.

11 unit tests pass; clippy + nightly fmt clean.

Author: varex83

Cargo.lock

@@ -21,7 +21,6 @@ pbkdf2.workspace = true
 scrypt.workspace = true
 unicode-normalization.workspace = true
 zeroize.workspace = true
-pluto-testutil.workspace = true
 pluto-k1util.workspace = true
 chrono.workspace = true
 regex.workspace = true
@@ -41,8 +40,9 @@ reqwest = { workspace = true, features = ["json"] }
 url.workspace = true
 
 [dev-dependencies]
-tempfile.workspace = true
 assert-json-diff.workspace = true
+pluto-testutil.workspace = true
+tempfile.workspace = true
 test-case.workspace = true
 wiremock.workspace = true
 

crates/eth2util/Cargo.toml

@@ -12,21 +12,28 @@ serde_json.workspace = true
 
 [dependencies]
 anyhow.workspace = true
+async-trait.workspace = true
 bon.workspace = true
 chrono.workspace = true
+futures = { workspace = true }
+hex.workspace = true
 k256.workspace = true
+pluto-core.workspace = true
 pluto-crypto.workspace = true
 pluto-eth2api.workspace = true
+pluto-eth2util.workspace = true
 rand.workspace = true
-hex.workspace = true
+serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 tokio.workspace = true
 tokio-util.workspace = true
+tracing.workspace = true
 tree_hash.workspace = true
 wiremock.workspace = true
 
 [dev-dependencies]
+assert-json-diff.workspace = true
 reqwest.workspace = true
 
 [lints]

crates/testutil/Cargo.toml

@@ -14,8 +14,16 @@ pub mod random;
 /// Beacon node API mock utilities.
 pub mod beaconmock;
 
+/// Validator mock — drives validator-side duties against a [`BeaconMock`].
+pub mod validatormock;
+
 pub use beaconmock::{BeaconMock, MockState, Validator, ValidatorSet};
 pub use random::{
     random_deneb_versioned_attestation, random_eth2_signature, random_eth2_signature_bytes,
     random_root, random_root_bytes, random_slot, random_v_idx,
 };
+pub use validatormock::{
+    ActiveValidators, EndpointMatch, Error as ValidatorMockError, MetaEpoch, MetaSlot,
+    Result as ValidatorMockResult, Sign, SignError, SignFunc, Signer, SpecMeta, SubmissionCapture,
+    active_validators,
+};

crates/testutil/src/lib.rs

@@ -0,0 +1,162 @@
+//! Test-only request-capture helper for [`crate::BeaconMock`].
+//!
+//! The Go validator mock tests assert on what the SUT submits by setting
+//! callback fields on `beaconmock.Mock` (`SubmitAttestationsFunc`,
+//! `SubmitAggregateAttestationsFunc`, ...). `BeaconMock` has no such hook, so
+//! tests register a high-priority [`wiremock::Mock`] that decodes the POST body
+//! into JSON and appends it into a shared buffer.
+//!
+//! Mounts above [`mount_endpoint_override`](crate::beaconmock) and the default
+//! routes, so the SUT sees a 200 and the test sees the request body.
+
+use std::sync::{Arc, Mutex};
+
+use serde_json::Value;
+use wiremock::{
+    Mock, MockServer, Request, ResponseTemplate,
+    matchers::{method, path, path_regex},
+};
+
+/// Priority used by [`SubmissionCapture`]. Wiremock matches the lowest priority
+/// first (and rejects `0`); `1` wins over both [`crate::beaconmock`]'s defaults
+/// (`255`) and the override layer (`50`).
+pub const CAPTURE_PRIORITY: u8 = 1;
+
+/// Endpoint matcher — plain path or wiremock regex.
+#[derive(Debug, Clone)]
+pub enum EndpointMatch {
+    /// Exact path (e.g. `"/eth/v1/beacon/pool/attestations"`).
+    Path(String),
+    /// `wiremock` path regex (must start with `^`).
+    Regex(String),
+}
+
+impl EndpointMatch {
+    /// Returns an [`EndpointMatch::Path`] from any string-like input.
+    pub fn path(p: impl Into<String>) -> Self {
+        Self::Path(p.into())
+    }
+
+    /// Returns an [`EndpointMatch::Regex`] from any string-like input.
+    pub fn regex(p: impl Into<String>) -> Self {
+        Self::Regex(p.into())
+    }
+}
+
+/// Shared buffer of captured POST/PUT bodies, parsed as JSON.
+#[derive(Debug, Clone, Default)]
+pub struct SubmissionCapture {
+    inner: Arc<Mutex<Vec<Value>>>,
+}
+
+impl SubmissionCapture {
+    /// Mounts a capture handler on `server` matching `http_method` +
+    /// `endpoint`, responding with `response_body` (200) and recording every
+    /// request body for later inspection.
+    pub async fn mount(
+        server: &MockServer,
+        http_method: &'static str,
+        endpoint: EndpointMatch,
+        response_body: Value,
+    ) -> Self {
+        let capture = Self::default();
+        let writer = Arc::clone(&capture.inner);
+        let response = ResponseTemplate::new(200).set_body_json(response_body);
+
+        let route = Mock::given(method(http_method));
+        let route = match endpoint {
+            EndpointMatch::Path(p) => route.and(path(p)),
+            EndpointMatch::Regex(r) => route.and(path_regex(r)),
+        };
+
+        route
+            .respond_with(move |request: &Request| {
+                if let Ok(value) = serde_json::from_slice::<Value>(&request.body) {
+                    writer.lock().expect("capture mutex poisoned").push(value);
+                }
+                response.clone()
+            })
+            .with_priority(CAPTURE_PRIORITY)
+            .mount(server)
+            .await;
+
+        capture
+    }
+
+    /// Captured bodies in submission order. Does not drain.
+    pub fn snapshot(&self) -> Vec<Value> {
+        self.inner.lock().expect("capture mutex poisoned").clone()
+    }
+
+    /// Drains the buffer and returns every captured body in submission order.
+    pub fn take(&self) -> Vec<Value> {
+        std::mem::take(&mut *self.inner.lock().expect("capture mutex poisoned"))
+    }
+
+    /// Number of captured submissions.
+    pub fn len(&self) -> usize {
+        self.inner.lock().expect("capture mutex poisoned").len()
+    }
+
+    /// True if nothing has been captured.
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::beaconmock::BeaconMock;
+    use serde_json::json;
+
+    #[tokio::test]
+    async fn captures_post_body() {
+        let mock = BeaconMock::builder().build().await.expect("build mock");
+        let capture = SubmissionCapture::mount(
+            mock.server(),
+            "POST",
+            EndpointMatch::path("/eth/v1/beacon/pool/attestations"),
+            json!({}),
+        )
+        .await;
+
+        let url = format!("{}/eth/v1/beacon/pool/attestations", mock.uri());
+        let body = json!([{ "slot": "1", "index": "0" }]);
+        let status = reqwest::Client::new()
+            .post(&url)
+            .json(&body)
+            .send()
+            .await
+            .expect("send")
+            .status();
+        assert_eq!(status, 200);
+
+        let captured = capture.take();
+        assert_eq!(captured.len(), 1);
+        assert_eq!(captured[0], body);
+    }
+
+    #[tokio::test]
+    async fn regex_endpoint_matches() {
+        let mock = BeaconMock::builder().build().await.expect("build mock");
+        let capture = SubmissionCapture::mount(
+            mock.server(),
+            "POST",
+            EndpointMatch::regex(r"^/eth/v1/validator/duties/attester/[0-9]+$"),
+            json!({"data": []}),
+        )
+        .await;
+
+        let url = format!("{}/eth/v1/validator/duties/attester/3", mock.uri());
+        let status = reqwest::Client::new()
+            .post(&url)
+            .json(&json!(["1"]))
+            .send()
+            .await
+            .expect("send")
+            .status();
+        assert_eq!(status, 200);
+        assert_eq!(capture.len(), 1);
+    }
+}

crates/testutil/src/validatormock/capture.rs

@@ -0,0 +1,60 @@
+//! Module-wide error type for the validator mock.
+//!
+//! Mirrors the structure of `pluto_eth2util::signing::SigningError`: a single
+//! `thiserror::Error` enum that the public API returns. Phase-2/3 submodules
+//! add new variants as their failure modes appear.
+
+use pluto_eth2api::EthBeaconNodeApiClientError;
+use pluto_eth2util::{helpers::HelperError, signing::SigningError};
+
+/// Result alias used by the validator mock.
+pub type Result<T> = std::result::Result<T, Error>;
+
+/// Errors returned by the validator mock.
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    /// Beacon-node API call failed.
+    #[error(transparent)]
+    BeaconNode(#[from] EthBeaconNodeApiClientError),
+
+    /// Signing-helper failure (resolving domains, hashing roots, etc.).
+    #[error(transparent)]
+    Signing(#[from] SigningError),
+
+    /// Helper utility (slot/epoch arithmetic against the spec) failure.
+    #[error(transparent)]
+    Helper(#[from] HelperError),
+
+    /// Local signer could not produce a signature for the requested pubkey.
+    #[error(transparent)]
+    Sign(#[from] SignError),
+
+    /// Hash-tree-root computation failed.
+    #[error("hash tree root: {0}")]
+    HashTreeRoot(String),
+
+    /// Beacon response was malformed or missing data.
+    #[error("malformed beacon response: {0}")]
+    Malformed(String),
+
+    /// Required validator index missing from the active set.
+    #[error("missing validator index {0}")]
+    MissingValidatorIndex(u64),
+
+    /// Builder/proposal/block variant not supported.
+    #[error("unsupported variant: {0}")]
+    UnsupportedVariant(&'static str),
+}
+
+/// Signer-specific errors. Wrapped into [`Error::Sign`] when surfaced from the
+/// validator-mock public API.
+#[derive(Debug, thiserror::Error)]
+pub enum SignError {
+    /// No private key is registered for the requested public key.
+    #[error("no secret found for pubkey")]
+    UnknownPubkey,
+
+    /// Underlying BLS error.
+    #[error(transparent)]
+    Bls(#[from] pluto_crypto::types::Error),
+}