fix(rsk): run installed BlockVerifier regardless of TrustRPC

[fedejinich]

Summary

• run an installed BlockVerifier from blockCall and payloadCall even when TrustRPC=true
• preserve upstream behavior when the hook is nil
• add RSK-specific coverage for hook execution, mismatch propagation/no-cache behavior, and the known TrustRPC=false RSKIP-92 header fallback limit
• leave receipts production, headerCall, and GetProof unchanged

Implements the fork portion of PAYROLLUP-117. Jira comment 176763 records the approved hybrid policy, rationale, header-verifier exclusion, and trust limits.

Validation

• go test ./op-service/sources/... -run 'TestRSK_' -count=1 — PASS
• go test ./op-service/sources/... -count=1 — PASS
• go build ./op-service/sources/... — PASS
• cd op-service && just test — PASS
• mise exec -- just lint-go — not run: mise is not installed
• just lint-go fallback — reports two pre-existing goimports findings in op-service/txmgr/cli.go and op-service/txmgr/metrics/tx_metrics.go; both files have an empty diff against rsk/develop, and the touched package has no lint finding

Correction validation on f3360d4f189b9cdaa64ae64ef5fc19fde0b7a8b4:

• the rejected AGENTS_rsk.md expansion is reverted; the complete fork tree matches code/test head f139cc22adfd9c260f400b461bd23624749ca97c
• git diff --check — PASS
• focused PAYROLLUP-117 regression tests in op-service/sources — PASS
• go test ./op-service/sources/... -count=1 — PASS

Port review

PASS: fork/rebase and L1-hook groups checked; go.work absent; receipts production unchanged; deploy/config N/A. Rootstack parent PR ethereum-optimism#83 pins f3360d4f189b9cdaa64ae64ef5fc19fde0b7a8b4; detailed divergence documentation remains Rootstack-owned. After squash merge, Rootstack must reconcile the gitlink to the resulting rsk/develop commit before merge.

[github-actions]

PR Triager kept risk/high. It was already set, so the model was not consulted again for this revision. It came either from a path listed in .github/rsk-pr-triager.yml or from an earlier revision's assessment.

[Copilot]

Pull request overview

This PR updates op-service/sources EthClient verification behavior for the RSK fork to enforce the approved “hybrid policy”: TrustRPC=true skips the default Ethereum block verification, but an explicitly installed BlockVerifier hook must still run on blockCall/payloadCall paths (while headerCall remains fully gated by !TrustRPC).

Changes:

• Run BlockVerifier from blockCall and payloadCall when TrustRPC=true (hook present), preserving upstream behavior when the hook is nil.
• Clarify the intended TrustRPC/hook interaction via updated in-code comments.
• Add RSK-specific tests covering hook execution under TrustRPC, mismatch propagation/no-cache behavior, and the known TrustRPC=false RSKIP-92 header fallback limitation.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
op-service/sources/eth_client.go	Adjusts block/payload verification gating to always execute an installed BlockVerifier hook even when TrustRPC=true, while leaving header verification behavior unchanged.
op-service/sources/eth_client_rsk_test.go	Adds characterization/coverage tests for the hybrid policy behavior and related RSK-specific boundaries.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

op-service/sources/eth_client.go:265

• The comment says that with trustRPC=true "no header verification runs at all", but headerCall still runs post-merge validation via rpcHdr.Header(true, mustBePostMerge). This is really about skipping hash verification (default VerifyHash / HeaderVerifier hook), not all checks; the current wording is misleading for readers.

// Unlike blockCall/payloadCall, header verification stays gated on !trustRPC
// even when a HeaderVerifier hook is set: with trustRPC=true no header
// verification runs at all (hybrid policy, PAYROLLUP-117).