chore(deps): bump reth to the v2.4.1 (#225)

* chore(deps): bump reth to the v2.4.1-aligned pin f2eecc6

Move the reth workspace pin from 27bfddea to f2eecc65 (v2.4.0 + 9) and
the reth-optimism-trie pin to the OP monorepo rev 4f21ce6b that pins the
same reth commit, keeping a single reth git source in the graph. Align
crates.io deps with the reth v2.4.1 release set: alloy 2.1.1, alloy
core 1.6.1 (the release's only functional delta), alloy-evm 0.37,
reth-codecs/reth-primitives-traits 0.5, revm-database-interface 41,
tokio 1.52.3, Rust 1.95.0.

The reth umbrella crate is consumed with default-features = false minus
the new default jit feature, so no revmc/LLVM enters the build; the
upstream --jit flag is rejected explicitly. Replays the v2.4.x API
migration across consensus/evm/block/payload/primitives/rpc/node, ports
the Taiko LiveTrieCollector in-repo (upstream removed the live module),
adopts the new proof-history storage initialization with a legacy
migration, and adds a CI guard that fails when Cargo.lock resolves more
than one reth revision.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(node): fix --jit flag plural in build_evm doc

The guard checks only `ctx.config().jit.enabled` (the literal --jit
flag); the --jit.* tuning flags fall through untouched, so the doc's
plural overstated what is rejected. Doc-accuracy fix from a
code-simplifier pass over the PR diff, which otherwise confirmed the
changed surface is already minimal (33/46 files byte-identical to the
five-times-reviewed #222 hunks).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(primitives): fail closed on BAL input to block_to_payload

`PayloadTypes::block_to_payload` discarded its `bal` argument and always
built a sidecar with `block_access_list: None`. reth's `reth_newPayload`
BlockRlp arm (mounted unconditionally on the authenticated engine server
via `create_auth_module`) and the debug consensus clients pass
caller-supplied BAL data through this method, so an unsupported block
access list was silently dropped and the payload proceeded without it —
bypassing the validator's `BlockAccessListNotSupported` check and the
fail-closed Amsterdam invariant. Store the caller's BAL on the sidecar's
inbound-only sentinel instead so engine validation rejects it, and pin
the behavior with a validator regression test (Some(bal) rejected, None
still valid).

Note for the #222 rebase: its engine/mod.rs hunk carries the same
`_bal` discard and should adopt this fix.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(rpc): reject inbound sentinels at the engine-tree conversion

The previous BAL fix rejected the sentinels only in
EngineApiValidator::validate_version_specific_fields, which runs on the
engine_newPayloadVx handlers. reth's reth_newPayload extension submits
payloads straight to the engine tree (BeaconEngineMessage::RethNewPayload),
whose entry point is PayloadValidator::convert_payload_to_block — and the
tree decodes a present block access list into its BAL execution path
(BlockOrPayload::try_decoded_access_list), so a retained sentinel was
consumable instead of rejected on that route. Its ExecutionData arm also
accepts a caller-supplied sidecar, making slotNumber equally reachable.

Reject both inbound-only sentinels at the top of convert_payload_to_block,
the choke point every payload route funnels through. Regression tests now
exercise the production route: the block_to_payload BAL and JSON-borne
blockAccessList/slotNumber payloads are all rejected at conversion, and
sentinel-free payloads still convert.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: davidtaikocha

.github/scripts/check_reth_pin.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+# Fails when the lockfile resolves more than one paradigmxyz/reth revision. reth-optimism-trie
+# resolves its reth dependencies inside the OP monorepo workspace, so the graph only stays
+# coherent while Alethia's reth pin references the exact commit OP pins (see the
+# reth-optimism-trie note in Cargo.toml); a drifted pin splits the workspace into two
+# incompatible reth copies.
+set -euo pipefail
+
+revs=$(grep -oE 'github\.com/paradigmxyz/reth\?[^"]*#[0-9a-f]{40}' Cargo.lock | sed 's/.*#//' | sort -u)
+count=$(printf '%s' "$revs" | grep -c . || true)
+
+if [ "$count" -ne 1 ]; then
+    echo "Error: expected exactly one paradigmxyz/reth revision in Cargo.lock, found $count:" >&2
+    printf '%s\n' "$revs" >&2
+    exit 1
+fi
+
+echo "single reth revision in Cargo.lock: $revs"

.github/workflows/ci.yml

@@ -16,11 +16,13 @@ jobs:
     name: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
+      - name: Verify a single reth revision in Cargo.lock
+        run: .github/scripts/check_reth_pin.sh
       - uses: rui314/setup-mold@v1
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.0
+          toolchain: 1.95.0
       - uses: Swatinem/rust-cache@v2
         with:
           cache-on-failure: true
@@ -40,7 +42,7 @@ jobs:
       - uses: rui314/setup-mold@v1
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.0
+          toolchain: 1.95.0
           components: rustfmt
       - uses: extractions/setup-just@v2
         with:
@@ -56,7 +58,7 @@ jobs:
       - uses: rui314/setup-mold@v1
       - uses: dtolnay/rust-toolchain@master
         with:
-          toolchain: 1.94.0
+          toolchain: 1.95.0
           components: clippy
       - uses: Swatinem/rust-cache@v2
         with:

CLAUDE.md

@@ -8,8 +8,8 @@ Alethia-Reth is a Rust execution client for the Taiko protocol, built atop Parad
 
 ## Key Technologies
 
-- Language: Rust (`1.93.1` toolchain via `rust-toolchain.toml` / `justfile`)
-- Framework: Reth v2.0.0 APIs (`reth_node_builder`, `reth_rpc`, `reth_engine_primitives`, etc.)
+- Language: Rust (`1.95.0` toolchain via `rust-toolchain.toml` / `justfile`)
+- Framework: Reth v2.4.x APIs (`reth_node_builder`, `reth_rpc`, `reth_engine_primitives`, etc.)
 - Target protocol: Taiko rollup networks
 - Build & dependency manager: Cargo + `just`