Skip to content

apollo_consensus_orchestrator: verify retrospective state commitment infos before proposing - #14895

Open
yoavGrs wants to merge 1 commit into
mainfrom
cende-delta-5-retrospective-wait
Open

apollo_consensus_orchestrator: verify retrospective state commitment infos before proposing#14895
yoavGrs wants to merge 1 commit into
mainfrom
cende-delta-5-retrospective-wait

Conversation

@yoavGrs

@yoavGrs yoavGrs commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Before proposing at height H, query the batcher's and the cende
recorder's commitment infos height offsets and require that at least
one of them has stored the commitment infos of the next height's
retrospective block, H + 1 - STORED_BLOCK_HASH_BUFFER. Height H's blob
carries the commitment-info delta the recorder is missing and is
written to the recorder when height H + 1 is built, so either source
having the infos now guarantees the recorder has its retrospective
block's commitment infos when the next height is built.

A single check, no retries: if the infos are missing on both sources
the build fails.

When neither side has stored any commitment infos at all the
validation is skipped with a warning: they will never exist for
pre-feature blocks, and requiring them would block proposing forever.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

@reviewable-StarkWare

Copy link
Copy Markdown

This change is Reviewable

yoavGrs commented Jul 29, 2026

Copy link
Copy Markdown
Contributor Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@cursor

cursor Bot commented Jul 29, 2026

Copy link
Copy Markdown

PR Summary

Medium Risk
Adds a hard check on the consensus proposer path that can block block production if commitment infos lag on both batcher and recorder after feature activation.

Overview
Under os_input, proposal build now fails fast if the batcher and Cende recorder both lack state commitment infos for the next height’s retrospective block (H + 1 - STORED_BLOCK_HASH_BUFFER), so height H’s blob is only proposed when at least one side already has what the recorder needs for the following height.

verify_retrospective_state_commitment_infos queries the batcher for infos at that block and the recorder’s commitment_infos_height_offset; pass if the batcher has infos, or the recorder offset is past that block. If the recorder has never stored any infos, validation is skipped with a warning (pre-feature blocks). BuildProposalError gains RetrospectiveStateCommitmentInfosError; unit tests cover pass/fail and early exit when the buffer does not apply.

Reviewed by Cursor Bugbot for commit 0b53933. Bugbot is set up for automated code reviews on this repo. Configure here.

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 25c4d6e. Configure here.

Comment thread crates/apollo_consensus_orchestrator/src/utils.rs Outdated
…infos before proposing

Before proposing at height H, require that the commitment infos of the
next height's retrospective block, H + 1 - STORED_BLOCK_HASH_BUFFER, are
stored on the batcher or on the cende recorder. Height H's blob carries
the commitment-info delta the recorder is missing and is written to the
recorder when height H + 1 is built, so either source having the infos
now guarantees the recorder has its retrospective block's commitment
infos when the next height is built.

The batcher is queried at the retrospective height itself rather than
by a height offset: apollo storage doesn't guarantee the commitment
infos of every height are stored (e.g. blocks added via sync), so the
latest stored height says nothing about lower heights. The recorder's
storage is contiguous, so its height offset is used.

A single check, no retries: if the infos are missing on both sources
the build fails.

When the batcher doesn't have the infos and the recorder has stored
none at all the validation is skipped with a warning: they will never
exist for pre-feature blocks, and requiring them would block proposing
forever.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@yoavGrs
yoavGrs changed the base branch from cende-delta-5-batcher-offset-query to graphite-base/14895 July 29, 2026 12:17
@yoavGrs
yoavGrs force-pushed the graphite-base/14895 branch from dd730c3 to 74720f0 Compare July 29, 2026 12:17
@yoavGrs
yoavGrs force-pushed the cende-delta-5-retrospective-wait branch from 25c4d6e to 0b53933 Compare July 29, 2026 12:17
@yoavGrs
yoavGrs changed the base branch from graphite-base/14895 to main July 29, 2026 12:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants