op-node+op-batcher: replace fallback-auth lead time with derivation-side enforcement delay

op-batcher/batcher/config.go

@@ -152,11 +152,6 @@ type CLIConfig struct {
 	PprofConfig   oppprof.CLIConfig
 	RPC           oprpc.CLIConfig
 	AltDA         altda.CLIConfig
-
-	// FallbackAuthLeadTime is the lead time for the fallback batcher's
-	// authentication gate. See BatcherConfig.FallbackAuthLeadTime in
-	// service.go and isFallbackAuthRequired in espresso_active.go.
-	FallbackAuthLeadTime time.Duration
 }
 
 func (c *CLIConfig) Check() error {
@@ -196,9 +191,6 @@ func (c *CLIConfig) Check() error {
 	if !flags.ValidDataAvailabilityType(c.DataAvailabilityType) {
 		return fmt.Errorf("unknown data availability type: %q", c.DataAvailabilityType)
 	}
-	if c.FallbackAuthLeadTime <= 0 {
-		return fmt.Errorf("FallbackAuthLeadTime must be positive: %v", c.FallbackAuthLeadTime)
-	}
 	// Most chains' L1s still have only Cancun active, but we don't want to
 	// overcomplicate this check with a dynamic L1 query, so we just use maxBlobsPerBlock.
 	// We want to check for both, blobs and auto da-type.
@@ -256,7 +248,6 @@ func NewConfig(ctx *cli.Context) *CLIConfig {
 		PprofConfig:                  oppprof.ReadCLIConfig(ctx),
 		RPC:                          oprpc.ReadCLIConfig(ctx),
 		AltDA:                        altda.ReadCLIConfig(ctx),
-		FallbackAuthLeadTime:         ctx.Duration(flags.FallbackAuthLeadTimeFlag.Name),
 		ThrottleConfig: ThrottleConfig{
 			AdditionalEndpoints: ctx.StringSlice(flags.AdditionalThrottlingEndpointsFlag.Name),
 			TxSizeLowerLimit:    ctx.Uint64(flags.ThrottleTxSizeLowerLimitFlag.Name),

op-batcher/batcher/config_test.go

@@ -34,7 +34,6 @@ func validBatcherConfig() batcher.CLIConfig {
 		BatchType:              0,
 		DataAvailabilityType:   flags.CalldataType,
 		TxMgrConfig:            txmgr.NewCLIConfig("fake", txmgr.DefaultBatcherFlagValues),
-		FallbackAuthLeadTime:   flags.FallbackAuthLeadTimeFlag.Value,
 		LogConfig:              log.DefaultCLIConfig(),
 		MetricsConfig:          metrics.DefaultCLIConfig(),
 		PprofConfig:            oppprof.DefaultCLIConfig(),
@@ -107,16 +106,6 @@ func TestBatcherConfig(t *testing.T) {
 			override:  func(c *batcher.CLIConfig) { c.DataAvailabilityType = "foo" },
 			errString: "unknown data availability type: \"foo\"",
 		},
-		{
-			name:      "negative fallback auth lead time",
-			override:  func(c *batcher.CLIConfig) { c.FallbackAuthLeadTime = -time.Second },
-			errString: "FallbackAuthLeadTime must be positive",
-		},
-		{
-			name:      "zero fallback auth lead time",
-			override:  func(c *batcher.CLIConfig) { c.FallbackAuthLeadTime = 0 },
-			errString: "FallbackAuthLeadTime must be positive",
-		},
 		{
 			name:      "zero TargetNumFrames",
 			override:  func(c *batcher.CLIConfig) { c.TargetNumFrames = 0 },

op-batcher/batcher/espresso_active.go

@@ -3,7 +3,6 @@ package batcher
 import (
 	"context"
 	"fmt"
-	"time"
 
 	"github.com/ethereum/go-ethereum/common"
 )
@@ -14,25 +13,10 @@ import (
 // zero BatchAuthenticatorAddress, indicating that the BatchAuthenticator-based
 // authentication path is not in use.
 //
-// This decision must align with the verifier's per-L1-block fork gate
-// (rollupCfg.IsEspresso(l1OriginTime) in data_source.go, which evaluates the
-// hardfork activation predicate against the *containing* L1 block's timestamp). Since
-// the tx is not yet mined at decision time, its eventual containing block
-// has a strictly greater timestamp than the L1 tip the batcher observes:
-//
-//	l1Tip.Time (batcher's view) < l1OriginTime (block containing the tx)
-//
-// Without compensation, in the window [forkTime − maxL1InclusionDelay, forkTime)
-// the batcher would skip authenticateBatchInfo while the verifier — once the
-// tx lands in a post-fork block — would require the resulting
-// BatchInfoAuthenticated event, silently dropping the batch.
-//
-// To prevent this, we add Config.FallbackAuthLeadTime to the L1 tip's
-// timestamp before evaluating the fork predicate. This makes the batcher
-// start authenticating slightly before the verifier requires it. The reverse
-// asymmetry (authenticated tx lands pre-fork) is harmless: pre-fork the
-// verifier uses sender-based authorization and the auth event is just an
-// unrelated L1 tx that does not affect derivation.
+// The gate switches at plain Espresso activation (tip.Time >= EspressoTime), a full grace
+// period before the verifier enforces event-based authentication. See
+// derive.BatchAuthEnforcementDelaySecs for the full grace-period mechanism and why the
+// batcher and verifier gates are offset.
 func (l *BatchSubmitter) isFallbackAuthRequired(ctx context.Context) (bool, error) {
 	if l.RollupConfig.BatchAuthenticatorAddress == (common.Address{}) {
 		return false, nil
@@ -41,6 +25,5 @@ func (l *BatchSubmitter) isFallbackAuthRequired(ctx context.Context) (bool, erro
 	if err != nil {
 		return false, fmt.Errorf("failed to fetch L1 tip for fallback-auth gate: %w", err)
 	}
-	leadSec := uint64(l.Config.FallbackAuthLeadTime / time.Second)
-	return l.RollupConfig.IsEspresso(tip.Time + leadSec), nil
+	return l.RollupConfig.IsEspresso(tip.Time), nil
 }

op-batcher/batcher/service.go

@@ -50,14 +50,6 @@ type BatcherConfig struct {
 
 	// For throttling DA. See CLIConfig in config.go for details on these parameters.
 	ThrottleParams config.ThrottleParams
-
-	// FallbackAuthLeadTime is consulted by the fallback batcher's
-	// authentication gate to advance the switch to authenticated batches
-	// relative to the on-chain EspressoTime hardfork. It absorbs the
-	// worst-case L1 inclusion delay between batcher decision time (L1 tip)
-	// and verifier evaluation time (containing L1 block). See
-	// isFallbackAuthRequired in espresso_active.go for details.
-	FallbackAuthLeadTime time.Duration
 }
 
 // BatcherService represents a full batch-submitter instance and its resources,
@@ -117,7 +109,6 @@ func (bs *BatcherService) initFromCLIConfig(ctx context.Context, closeApp contex
 	bs.NetworkTimeout = cfg.TxMgrConfig.NetworkTimeout
 	bs.CheckRecentTxsDepth = cfg.CheckRecentTxsDepth
 	bs.WaitNodeSync = cfg.WaitNodeSync
-	bs.FallbackAuthLeadTime = cfg.FallbackAuthLeadTime
 
 	bs.ThrottleParams = config.ThrottleParams{
 		LowerThreshold:      cfg.ThrottleConfig.LowerThreshold,

op-batcher/flags/flags.go

@@ -160,21 +160,6 @@ var (
 		Value:   false,
 		EnvVars: prefixEnvVars("WAIT_NODE_SYNC"),
 	}
-	FallbackAuthLeadTimeFlag = &cli.DurationFlag{
-		Name: "espresso.fallback-auth-lead-time",
-		Usage: "Lead time for the fallback batcher's Espresso authentication gate. " +
-			"How far ahead of the on-chain EspressoTime the fallback batcher " +
-			"starts routing batch txs through BatchAuthenticator.authenticateBatchInfo. " +
-			"This absorbs worst-case L1 inclusion delay between the batcher's decision " +
-			"(based on L1 tip time) and the verifier's gate (based on the containing " +
-			"L1 block's time). Has no effect outside the boundary window around the " +
-			"EspressoTime hardfork. Must not be negative, and must exceed the worst-case " +
-			"L1 inclusion delay: with 0 the safety margin is gone, and a batch decided " +
-			"pre-fork that lands in a post-fork block is silently dropped by the verifier.",
-		Value:   5 * time.Minute,
-		EnvVars: prefixEnvVars("ESPRESSO_FALLBACK_AUTH_LEAD_TIME"),
-	}
-
 	// Legacy Flags
 	SequencerHDPathFlag = txmgr.SequencerHDPathFlag
 )
@@ -203,7 +188,6 @@ var optionalFlags = []cli.Flag{
 	DataAvailabilityTypeFlag,
 	ActiveSequencerCheckDurationFlag,
 	CompressionAlgoFlag,
-	FallbackAuthLeadTimeFlag,
 }
 
 func init() {

op-node/rollup/derive/batch_authenticator.go

@@ -13,9 +13,19 @@ import (
 	"github.com/ethereum/go-ethereum/crypto"
 	"github.com/ethereum/go-ethereum/log"
 
+	"github.com/ethereum-optimism/optimism/op-node/rollup"
 	"github.com/ethereum-optimism/optimism/op-service/eth"
 )
 
+// isEspressoAuthEnforced returns true once event-based batch authentication is enforced
+// at the given L1 origin time: the Espresso fork is active AND at least
+// BatchAuthEnforcementDelaySecs has elapsed since activation. Before that, derivation
+// keeps accepting sender-authenticated batches. See BatchAuthEnforcementDelaySecs
+// (params.go) for the full grace-period mechanism.
+func isEspressoAuthEnforced(cfg *rollup.Config, l1OriginTime uint64) bool {
+	return cfg.IsEspresso(l1OriginTime) && l1OriginTime >= *cfg.EspressoTime+BatchAuthEnforcementDelaySecs
+}
+
 var (
 	// BatchInfoAuthenticatedABI is the event signature for
 	// BatchInfoAuthenticated(bytes32 commitment, address indexed caller).

op-node/rollup/derive/blob_data_source.go

@@ -119,21 +119,21 @@ func (ds *BlobDataSource) open(ctx context.Context) ([]blobOrCalldata, error) {
 // creates a placeholder blobOrCalldata element for each returned blob hash that must be populated
 // by fillBlobPointers after blob bodies are retrieved.
 //
-// Pre-Espresso (the L1 origin time of `ref` is < *EspressoTime, or unset),
-// this runs upstream Optimism semantics: filter by batch inbox + sender ==
-// batcher.
+// Before Espresso event-auth is enforced (Espresso inactive at the L1 origin time of
+// `ref`, or within BatchAuthEnforcementDelaySecs of activation), this runs upstream
+// Optimism semantics: filter by batch inbox + sender == batcher.
 //
-// Post-Espresso, it collects all authenticated batch hashes from a lookback
+// Once enforced, it collects all authenticated batch hashes from a lookback
 // window once and rejects any batch whose commitment hash is not in the
 // authenticated set. For blob transactions, the batch hash is computed from
 // the concatenated blob versioned hashes.
 func dataAndHashesFromTxs(ctx context.Context, txs types.Transactions, config *DataSourceConfig, batcherAddr common.Address, fetcher L1Fetcher, ref eth.L1BlockRef, logger log.Logger) ([]blobOrCalldata, []common.Hash, error) {
-	// Only collect authenticated batch commitments when the Espresso fork is
-	// active at the L1 origin time of the block we're scanning. Pre-fork, the
-	// upstream sender-based authorization path is used and authenticatedHashes
-	// is unused.
+	// Only collect authenticated batch commitments once event-based authentication is
+	// enforced at the L1 origin time of the block we're scanning (Espresso active plus
+	// the enforcement grace period). Before that, the upstream sender-based
+	// authorization path is used and authenticatedHashes is unused.
 	var authenticatedHashes map[common.Hash]common.Address
-	if config.rollupCfg.IsEspresso(ref.Time) {
+	if isEspressoAuthEnforced(config.rollupCfg, ref.Time) {
 		var err error
 		authenticatedHashes, err = CollectAuthenticatedBatches(
 			ctx, fetcher, ref, config.rollupCfg.BatchAuthenticatorAddress, config.batchAuthCaches, logger,
@@ -159,7 +159,7 @@ func dataAndHashesFromTxs(ctx context.Context, txs types.Transactions, config *D
 			batchHash = ComputeCalldataBatchHash(tx.Data())
 		}
 
-		// Check authorization (sender-based pre-fork; event-based post-fork).
+		// Check authorization (sender-based before enforcement; event-based once enforced).
 		if !isBatchTxAuthorized(tx, *config, batcherAddr, batchHash, authenticatedHashes, ref.Time, logger) {
 			continue
 		}

op-node/rollup/derive/data_source.go

@@ -165,12 +165,13 @@ func isAuthorizedBatchSender(tx *types.Transaction, l1Signer types.Signer, batch
 // block (passed as l1OriginTime), mirroring the data-source layer's ecotoneTime
 // treatment.
 //
-// Pre-Espresso (l1OriginTime < *EspressoTime, or unset):
+// Before enforcement (Espresso inactive, or within BatchAuthEnforcementDelaySecs of
+// activation):
 //
 //	upstream behavior — the L1 sender of the transaction must match the configured
 //	batcher address. The authenticatedHashes map is unused.
 //
-// Post-Espresso:
+// Once enforced:
 //
 //	the batch's commitment hash must appear in authenticatedHashes (i.e. a
 //	BatchInfoAuthenticated event was emitted for this commitment within the
@@ -188,11 +189,13 @@ func isBatchTxAuthorized(
 	l1OriginTime uint64,
 	logger log.Logger,
 ) bool {
-	if !dsCfg.rollupCfg.IsEspresso(l1OriginTime) {
-		// Pre-fork: upstream sender-based authorization.
+	if !isEspressoAuthEnforced(dsCfg.rollupCfg, l1OriginTime) {
+		// Pre-enforcement (pre-fork or within the grace period): upstream
+		// sender-based authorization.
 		return isAuthorizedBatchSender(tx, dsCfg.l1Signer, batcherAddr, logger)
 	}
-	// Post-fork: the commitment must have been authenticated within the lookback window.
+	// Once enforced (fork active and past the grace period): the commitment must have been
+	// authenticated within the lookback window.
 	authCaller, ok := authenticatedHashes[batchHash]
 	if !ok {
 		logger.Warn("batch not authenticated",