feat(sentinel): end-of-epoch evaluation with re-execution outcomes

[PhilWindle]

Summary

• End-of-epoch sentinel evaluation. Sentinel now evaluates per-epoch validator performance once sentinelEpochEndBufferSlots (default 2) has elapsed past an epoch's last slot, instead of waiting for the chain-proven event. Inactivity slashing fires without depending on L1 proof publication (AZIP-7).
• Six-case proposer status taxonomy driven by the checkpoint re-execution tracker: checkpoint-mined, checkpoint-valid, checkpoint-invalid, checkpoint-unvalidated, checkpoint-missed, blocks-missed. Missing-attestor faults apply only when status is checkpoint-mined or checkpoint-valid.
• Re-execution tracker overhaul (CheckpointReexecutionTracker):
  • Drops the redundant interface; single class exported under its plain name. Maps are brand-typed (Map<CheckpointNumber, …>, Map<SlotNumber, Entry>) so callers don't lose brand info on lookup.
  • Records a three-way ReexecutionOutcome (valid / invalid / unvalidated) keyed by slot; hasReexecuted keeps its prior contract.
  • New recordTxsCollected(slot, indexWithinCheckpoint, collected) / getTxsCollectedRecord(slot, idx). The validator's proposal handler calls this immediately after getTxsForBlockProposal; the data-withholding watcher short-circuits when every block in a published checkpoint has a true record. A false (deadline missed) does not slash by itself because the data-withholding tolerance window is longer than the re-execution deadline.
• ProposalHandler.validateCheckpointProposal records an outcome at every early-return; invalid_signature and checkpoint_already_published deliberately skip.
• New broadcastInvalidCheckpointProposalOnly config flag (SequencerConfig). Lets tests corrupt the checkpoint archive while keeping the underlying block proposals valid — exercises the 'invalid' path cleanly. When unset, behaviour follows broadcastInvalidBlockProposal (existing behaviour).

Scope

Closes A-538. The tracker enhancement also lays groundwork for A-537's PROPOSER_INVALID_PROPOSAL offence — invalid outcomes are recorded but not yet consumed by a watcher; that watcher is a follow-on owned separately.

Breaking changes

• SentinelStore.SCHEMA_VERSION bumped 3 → 4; legacy provenMap data is wiped on upgrade.
• SingleValidatorStats.allTimeProvenPerformance renamed to allTimeEpochPerformance.
• provenMap / getProvenPerformance / updateProvenPerformance renamed to epochMap / getEpochPerformance / updateEpochPerformance.
• Env var SENTINEL_HISTORIC_PROVEN_PERFORMANCE_LENGTH_IN_EPOCHS renamed to SENTINEL_HISTORIC_EPOCH_PERFORMANCE_LENGTH_IN_EPOCHS.
• InMemoryCheckpointReexecutionTracker renamed to CheckpointReexecutionTracker (interface dropped).

Base branch

Based on phil/a-523-... because it shares the CheckpointReexecutionTracker plumbing. Will rebase onto merge-train/spartan once A-523 merges.

Test plan

• Unit tests for the new tracker outcomes + recordTxsCollected / getTxsCollectedRecord (stdlib/src/checkpoint/checkpoint_reexecution_tracker.test.ts).
• Sentinel unit tests rewritten around the six-case taxonomy and end-of-epoch trigger (aztec-node/src/sentinel/sentinel.test.ts — 46 tests passing).
• Store unit tests updated for renamed APIs (aztec-node/src/sentinel/store.test.ts).
• Existing proposal_handler.test.ts and data_withholding_watcher.test.ts continue to pass.
• multiple_validators_sentinel.parallel.test.ts updated for new status names; new test asserts per-epoch performance is recorded shortly after epoch end without waiting for L1 proof.
• New sentinel_status_slash.parallel.test.ts drives all three slashable sentinel statuses end-to-end via config flags (no jest stubbing):
  • 'unvalidated' via broadcastInvalidBlockProposal
  • 'invalid' via broadcastInvalidCheckpointProposalOnly
  • missing-attestor via tryStop on one node
    Each malicious-proposer test warps the L1 clock to the slot just before the target's proposer slot (accounting for pipelining) to keep wall-clock time down. All three pass locally in ~4 min total.

Docs

• New yarn-project/aztec-node/src/sentinel/README.md documenting the module.
• yarn-project/slasher/README.md Inactivity section updated to match the new behaviour.

[spalladino]

Looks great! One thing that Claude found: since proposals-from-self skip the proposal handler, a node will always report itself as inactive in its sentinel. It's no big deal since nodes are smart enough not to slash themselves, but it can be annoying for a node that relies on its own sentinel for tracking its activity.

[spalladino]

Refactoring nit: I'd set up a mapping from validation result to outcome, and just record this on the caller.

[PhilWindle]

Done

[spalladino]

All e2e tests should read like this

[PhilWindle]

Looks great! One thing that Claude found: since proposals-from-self skip the proposal handler, a node will always report itself as inactive in its sentinel. It's no big deal since nodes are smart enough not to slash themselves, but it can be annoying for a node that relies on its own sentinel for tracking its activity.

This should be addressed now. Proposers record their own proposals as valid.