ePBS (Gloas / SIP-94) reference implementation — epic tracking

[iurii-ssv]

Tracking issue for the ssv-spec side of ePBS (EIP-7732 / Gloas, Glamsterdam fork), per SIP-94 (ssvlabs/SIPs#94). Node-side counterpart: ssvlabs/ssv#2901, with the direct-builder extension in ssvlabs/ssv#2962.

PR structure: #632 (wire constants, targets main) → #633 (reference implementation, stacked on #632; accumulates the slices below and auto-retargets to main when #632 merges).

Landed

• Wire constants (types: add ePBS (Gloas) domains, roles, and partial-sig types #632 — green, awaiting review): Gloas domains 0x0B/0x0C/0x0D + builder-specs' DomainBuilderRequestAuth 0x0B000001, beacon/runner roles 7/8/9, partial-sig types 7/8/9, and a golden test pinning the exact values.
• Type layer (on types: ePBS (Gloas / SIP-94) reference implementation — WIP #633): types/gloas package (§3/§4/§5/§6 containers, DataVersionGloas placeholder), flat GloasBeaconVote / EnvelopeConsensusData, fork machinery, six encoding-vector suites in new anchor-safe package prefixes.
• §2 attestations (on types: ePBS (Gloas / SIP-94) reference implementation — WIP #633, activated): fork-aware committee-runner path (Gloas vote carries the BN-supplied 0/1 payload-status index), aggregator-committee Gloas arms (Electra shape under the Gloas version tag), GloasBeaconVoteValueCheckF + six value-check vectors; SupportedAttestationVersions / SupportedAggregatorVersions include Gloas.
• §4 groundwork (on types: ePBS (Gloas / SIP-94) reference implementation — WIP #633): ProposerValueCheckF decodes gloas.BeaconBlock and pins block slot == duty slot; types stays free of concrete Gloas decoding.

Verification state: full generate + test green on #633; fixture delta vs base: 567 Gloas subtests added, none removed, 3 pre-Gloas changed (details in #633's description).

Process

• Merge types: add ePBS (Gloas) domains, roles, and partial-sig types #632, delete its branch (types: ePBS (Gloas / SIP-94) reference implementation — WIP #633 auto-retargets to main)
• Merge types: refresh sszgen Hash comments so go generate is idempotent #641 (sszgen hash refresh on main)
• Decide the tag checkpoint — ePBS (EIP-7732 / Gloas) — SIP-94 ssv#2901 needs a tag carrying the constants and the §2 AggregatorCommitteeConsensusData Gloas arm (currently on types: ePBS (Gloas / SIP-94) reference implementation — WIP #633). Options: (a) merge types: ePBS (Gloas / SIP-94) reference implementation — WIP #633 at the current §2-complete checkpoint and continue the runners in a follow-up PR; (b) split the §2 arm into a micro-PR; (c) the tag waits for the full epic. This decides whether ssv#2901 can land on stage before the remaining slices exist.
• Ping spec_tests: fork-gate proposer block decode for Gloas sigp/anchor#1073 / chore: remove fake_crypto from spec tests once ssv-spec fixtures are fixed sigp/anchor#953 with the new fixture prefixes (gloasbeaconvote, envelopeconsensusdata, payloadattestationdata, payloadattestationmessage, proposerpreferences, signedproposerpreferences) — Gloas fixtures live only in new packages so anchor's prefix dispatcher never runs pre-Gloas decoders on them; ping again after the §4 slice.

Remaining implementation slices (landing order)

• §4 proposer runner — Gloas produce/submit, SupportedBlockVersions += Gloas, TestingGloasBeaconBlock fixtures; valcheckproposer Gloas cases + Gloas full-happy-flow (every SupportedBlockVersions iterator picks up a Gloas case). Closes anchor's spec_tests: fork-gate proposer block decode for Gloas sigp/anchor#1073 acceptance criterion.
• §3 PTC runner (depends only on the type layer; reorderable) — VR-shaped, no QBFT: partial signatures over PayloadAttestationData under DomainPTCAttester; joins the preconsensus multi-tests; PTC-specific vectors (convergence quorum, minority split no-reconstruct, abstain, wrong root, dutyexe role checks).
• §5 ProposerPreferences runner + ValidatorRegistration deprecation (reorderable) — per-slot-state runner, gas-limit config plumbing, VR rejected at Gloas slots (unchanged pre-Gloas); vectors include concurrent lookahead slots and re-emission-replaces-slot. (The request-auth §5 extension is node-side message validation; its spec-side surface is only the already-landed constants.)
• §6 EnvelopeProposer runner (depends on §4) — the one new QBFT runner: ProposedBlockRoots store + proposer-runner recording, EnvelopeValueCheckF, new valcheckenvelope suite (valid / wrong builder index / root ≠ §4 root / duty mismatch / decode garbage / no recorded root), publish-by-content-match; envelope entries joined across the consensus, postconsensus, and newduty suites and the full happy flow. Linkage decision resolved with no new mapper: a construction-driven root-linkage vector drives a real §4 proposer decision into a store shared with the envelope runner, so recording drift fails generation while consumers see a plain MsgProcessingSpecTest. The runner JSON path keeps the exported store; BuilderIndex marshals in beacon-API decimal-string form (the self-build sentinel exceeds float64 precision).
• (Optional, post-epic) cleanups: go list -m-based includes for the pre-existing sszgen directives, doc touch-ups.

Wiring checklist for each new runner (§3/§5/§6): DutyRunners construction, testingutils ConstructBaseRunner* case (single-share), message-ID helpers + DutyRunnerForMsgID, per-runner ssv_msgs_*.go, overrideStateComparison + run_test.go mapping; §6 additionally full QBFT config/controller wiring mirroring RoleProposer.

Externally gated / watch list

• Progressive HTR (EIP-7688) — positional roots are shipped deliberately (devnet-6 reality; 7688 is only CFI for Glamsterdam). The §4-block/§6-envelope signing-root goldens and the progressive-container encoding suites stay held until the devnet-7 fork scope settles; prefer go-eth2-client's progressive-SSZ work over hand-rolling the block-tree cascade.
• go-eth2-client Gloas support — when it ships, swap the DataVersionGloas placeholder for the upstream enum (values match by construction; the (unknown) fixture-name artifact resolves).
• SIP-94 request-auth amendment — ready to land per ePBS (EIP-7732 / Gloas) — SIP-94 ssv#2901; no further spec-repo code expected.
• Node-side lifecycle (ePBS (EIP-7732 / Gloas) — SIP-94 ssv#2901) — the spec model keeps ProposerPreferencesRunner.BySlot and the shared ProposedBlockRoots store unbounded (pruning is declared node-side in the code comments); the node implementation owns pruning both and the preferences runner's linear HasRunningDuty() scan.
• (Optional) index-aware mock slashability store, so the §2 cross-index equivocation rule becomes vector-assertable.