Devnet4: dual-key validators, block signing, and type migration

.claude/skills/devnet-log-review/references/CLIENT_LOG_PATTERNS.md

@@ -54,7 +54,6 @@ ethlambda_p2p: Published block to gossipsub slot=X proposer=Y
 ```
 ethlambda_blockchain: Published attestation slot=X validator_id=Y
 ethlambda_p2p::gossipsub::handler: Received new attestation from gossipsub, sending for processing slot=X validator=Y
-ethlambda_blockchain: Skipping attestation for proposer slot=X (expected: proposers don't attest to their own slot)
 ```
 
 ### Block Processing

CLAUDE.md

@@ -48,7 +48,7 @@ crates/
 ### Tick-Based Validator Duties (4-second slots, 5 intervals per slot)
 ```
 Interval 0: Block proposal → accept attestations if proposal exists
-Interval 1: Vote propagation (no action)
+Interval 1: Attestation production (all validators, including proposer)
 Interval 2: Aggregation (aggregators create proofs from gossip signatures)
 Interval 3: Safe target update (fork choice)
 Interval 4: Accept accumulated attestations
@@ -106,7 +106,7 @@ let byte: u8 = code.into();
 ### Ownership for Large Structures
 ```rust
 // Prefer taking ownership to avoid cloning large data (signatures ~3KB)
-pub fn insert_signed_block(&mut self, root: H256, signed_block: SignedBlockWithAttestation) { ... }
+pub fn insert_signed_block(&mut self, root: H256, signed_block: SignedBlock) { ... }
 
 // Add .clone() at call site if needed - makes cost explicit
 store.insert_signed_block(block_root, signed_block.clone());
@@ -310,8 +310,8 @@ Both servers are spawned as independent `tokio::spawn` tasks from `main.rs`. Bin
 ```yaml
 GENESIS_TIME: 1770407233
 GENESIS_VALIDATORS:
-  - "cd323f232b34ab26d6db7402c886e74ca81cfd3a..."  # 52-byte XMSS pubkeys (hex)
-  - "b7b0f72e24801b02bda64073cb4de6699a416b37..."
+  - attestation_pubkey: "cd323f232b34ab26d6db7402c886e74ca81cfd3a..."  # 52-byte XMSS pubkeys (hex)
+    proposal_pubkey: "b7b0f72e24801b02bda64073cb4de6699a416b37..."
 ```
 - Validator indices are assigned sequentially (0, 1, 2, ...) based on array order
 - All genesis state fields (checkpoints, justified_slots, etc.) initialize to zero/empty defaults
@@ -363,7 +363,7 @@ cargo test -p ethlambda-blockchain --test forkchoice_spectests -- --test-threads
 |-------|-------------|---------|
 | `BlockHeaders` | H256 → BlockHeader | Block headers by root |
 | `BlockBodies` | H256 → BlockBody | Block bodies (empty for genesis) |
-| `BlockSignatures` | H256 → BlockSignaturesWithAttestation | Signatures (absent for genesis) |
+| `BlockSignatures` | H256 → BlockSignatures | Signatures (absent for genesis) |
 | `States` | H256 → State | Beacon states by root |
 | `LatestKnownAttestations` | u64 → AttestationData | Fork-choice-active attestations |
 | `LatestNewAttestations` | u64 → AttestationData | Pending (pre-promotion) attestations |

Makefile

@@ -24,11 +24,12 @@ docker-build: ## 🐳 Build the Docker image
 		-t ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG) .
 	@echo
 
-LEAN_SPEC_COMMIT_HASH:=d39d10195414921e979e2fdd43723d89cee13c8b
+LEAN_SPEC_COMMIT_HASH:=9c30436bf4c073d1a994f37a3241e83ef5a3ce6f
 
 leanSpec:
 	git clone https://github.com/leanEthereum/leanSpec.git --single-branch
 	cd leanSpec && git checkout $(LEAN_SPEC_COMMIT_HASH)
+	cd leanSpec && git apply ../patches/fix-lexicographic-tiebreaker-test.patch
 
 leanSpec/fixtures: leanSpec
 	cd leanSpec && uv run fill --fork devnet --scheme=prod -o fixtures

bin/ethlambda/src/checkpoint_sync.rs

@@ -35,7 +35,7 @@ pub enum CheckpointSyncError {
         expected: u64,
         got: u64,
     },
-    #[error("validator {index} pubkey mismatch")]
+    #[error("validator {index} pubkey mismatch (attestation or proposal key)")]
     ValidatorPubkeyMismatch { index: usize },
     #[error("finalized slot cannot exceed state slot")]
     FinalizedExceedsStateSlot,
@@ -145,7 +145,9 @@ fn verify_checkpoint_state(
         .zip(expected_validators.iter())
         .enumerate()
     {
-        if state_val.pubkey != expected_val.pubkey {
+        if state_val.attestation_pubkey != expected_val.attestation_pubkey
+            || state_val.proposal_pubkey != expected_val.proposal_pubkey
+        {
             return Err(CheckpointSyncError::ValidatorPubkeyMismatch { index: i });
         }
     }
@@ -229,22 +231,25 @@ mod tests {
 
     fn create_test_validator() -> Validator {
         Validator {
-            pubkey: [1u8; 52],
+            attestation_pubkey: [1u8; 52],
+            proposal_pubkey: [11u8; 52],
             index: 0,
         }
     }
 
     fn create_different_validator() -> Validator {
         Validator {
-            pubkey: [2u8; 52],
+            attestation_pubkey: [2u8; 52],
+            proposal_pubkey: [22u8; 52],
             index: 0,
         }
     }
 
     fn create_validators_with_indices(count: usize) -> Vec<Validator> {
         (0..count)
             .map(|i| Validator {
-                pubkey: [i as u8 + 1; 52],
+                attestation_pubkey: [i as u8 + 1; 52],
+                proposal_pubkey: [i as u8 + 101; 52],
                 index: i as u64,
             })
             .collect()

bin/ethlambda/src/main.rs

@@ -18,6 +18,7 @@ use std::{
 };
 
 use clap::Parser;
+use ethlambda_blockchain::key_manager::ValidatorKeyPair;
 use ethlambda_network_api::{InitBlockChain, InitP2P, ToBlockChainToP2PRef, ToP2PToBlockChainRef};
 use ethlambda_p2p::{Bootnode, P2P, SwarmConfig, build_swarm, parse_enrs};
 use ethlambda_types::primitives::H256;
@@ -135,7 +136,8 @@ async fn main() -> eyre::Result<()> {
     let bootnodes = read_bootnodes(&bootnodes_path);
 
     let validator_keys =
-        read_validator_keys(&validators_path, &validator_keys_dir, &options.node_id);
+        read_validator_keys(&validators_path, &validator_keys_dir, &options.node_id)
+            .expect("Failed to load validator keys");
 
     let data_dir =
         std::path::absolute(&options.data_dir).unwrap_or_else(|_| options.data_dir.clone());
@@ -237,13 +239,10 @@ fn read_bootnodes(bootnodes_path: impl AsRef<Path>) -> Vec<Bootnode> {
 #[derive(Debug, Deserialize)]
 struct AnnotatedValidator {
     index: u64,
-    #[serde(rename = "pubkey_hex")]
-    #[serde(deserialize_with = "deser_pubkey_hex")]
-    _pubkey: ValidatorPubkeyBytes,
-    privkey_file: PathBuf,
+    attestation_privkey_file: PathBuf,
+    proposal_privkey_file: PathBuf,
 }
 
-// Taken from ethrex-common
 pub fn deser_pubkey_hex<'de, D>(d: D) -> Result<ValidatorPubkeyBytes, D::Error>
 where
     D: serde::Deserializer<'de>,
@@ -262,53 +261,67 @@ fn read_validator_keys(
     validators_path: impl AsRef<Path>,
     validator_keys_dir: impl AsRef<Path>,
     node_id: &str,
-) -> HashMap<u64, ValidatorSecretKey> {
+) -> Result<HashMap<u64, ValidatorKeyPair>, String> {
     let validators_path = validators_path.as_ref();
     let validator_keys_dir = validator_keys_dir.as_ref();
-    let validators_yaml =
-        std::fs::read_to_string(validators_path).expect("Failed to read validators file");
-    // File is a map from validator name to its annotated info (the info is inside a vec for some reason)
+    let validators_yaml = std::fs::read_to_string(validators_path)
+        .map_err(|err| format!("Failed to read validators file: {err}"))?;
     let validator_infos: BTreeMap<String, Vec<AnnotatedValidator>> =
-        serde_yaml_ng::from_str(&validators_yaml).expect("Failed to parse validators file");
+        serde_yaml_ng::from_str(&validators_yaml)
+            .map_err(|err| format!("Failed to parse validators file: {err}"))?;
 
     let validator_vec = validator_infos
         .get(node_id)
-        .unwrap_or_else(|| panic!("Node ID '{}' not found in validators config", node_id));
+        .ok_or_else(|| format!("Node ID '{node_id}' not found in validators config"))?;
 
     let mut validator_keys = HashMap::new();
 
     for validator in validator_vec {
         let validator_index = validator.index;
 
-        // Resolve the secret key file path relative to the validators config directory
-        let secret_key_path = if validator.privkey_file.is_absolute() {
-            validator.privkey_file.clone()
-        } else {
-            validator_keys_dir.join(&validator.privkey_file)
+        let resolve_path = |file: &PathBuf| -> PathBuf {
+            if file.is_absolute() {
+                file.clone()
+            } else {
+                validator_keys_dir.join(file)
+            }
         };
 
-        info!(node_id=%node_id, index=validator_index, secret_key_file=?secret_key_path, "Loading validator secret key");
+        let att_key_path = resolve_path(&validator.attestation_privkey_file);
+        let prop_key_path = resolve_path(&validator.proposal_privkey_file);
 
-        // Read the hex-encoded secret key file
-        let secret_key_bytes =
-            std::fs::read(&secret_key_path).expect("Failed to read validator secret key file");
+        info!(%node_id, index=validator_index, attestation_key=?att_key_path, proposal_key=?prop_key_path, "Loading validator key pair");
 
-        // Parse the secret key
-        let secret_key = ValidatorSecretKey::from_bytes(&secret_key_bytes).unwrap_or_else(|err| {
-            error!(node_id=%node_id, index=validator_index, secret_key_file=?secret_key_path, ?err, "Failed to parse validator secret key");
-            std::process::exit(1);
-        });
+        let load_key = |path: &Path, purpose: &str| -> Result<ValidatorSecretKey, String> {
+            let bytes = std::fs::read(path).map_err(|err| {
+                format!(
+                    "Failed to read {purpose} key file {}: {err}",
+                    path.display()
+                )
+            })?;
+            ValidatorSecretKey::from_bytes(&bytes)
+                .map_err(|err| format!("Failed to parse {purpose} key {}: {err:?}", path.display()))
+        };
+
+        let attestation_key = load_key(&att_key_path, "attestation")?;
+        let proposal_key = load_key(&prop_key_path, "proposal")?;
 
-        validator_keys.insert(validator_index, secret_key);
+        validator_keys.insert(
+            validator_index,
+            ValidatorKeyPair {
+                attestation_key,
+                proposal_key,
+            },
+        );
     }
 
     info!(
-        node_id = %node_id,
+        %node_id,
         count = validator_keys.len(),
-        "Loaded validator secret keys"
+        "Loaded validator key pairs"
     );
 
-    validator_keys
+    Ok(validator_keys)
 }
 
 fn read_hex_file_bytes(path: impl AsRef<Path>) -> Vec<u8> {