chore(fast-inbox): umbrella stack for circuits and L1

docs/examples/ts/aave_bridge/index.ts

@@ -351,6 +351,8 @@ const INBOX_ABI = [
       { name: "index", type: "uint256", indexed: false },
       { name: "hash", type: "bytes32", indexed: true },
       { name: "rollingHash", type: "bytes16", indexed: false },
+      { name: "inboxRollingHash", type: "bytes32", indexed: false },
+      { name: "bucketSeq", type: "uint256", indexed: false },
     ],
   },
 ] as const;

docs/examples/ts/example_swap/index.ts

@@ -263,6 +263,8 @@ const INBOX_ABI = [
       { name: "index", type: "uint256", indexed: false },
       { name: "hash", type: "bytes32", indexed: true },
       { name: "rollingHash", type: "bytes16", indexed: false },
+      { name: "inboxRollingHash", type: "bytes32", indexed: false },
+      { name: "bucketSeq", type: "uint256", indexed: false },
     ],
   },
 ] as const;

docs/examples/ts/token_bridge/index.ts

@@ -168,6 +168,8 @@ const INBOX_ABI = [
       { name: "index", type: "uint256", indexed: false },
       { name: "hash", type: "bytes32", indexed: true },
       { name: "rollingHash", type: "bytes16", indexed: false },
+      { name: "inboxRollingHash", type: "bytes32", indexed: false },
+      { name: "bucketSeq", type: "uint256", indexed: false },
     ],
   },
 ] as const;

l1-contracts/src/core/RollupCore.sol

@@ -27,7 +27,7 @@ import {ProposeArgs} from "@aztec/core/libraries/rollup/ProposeLib.sol";
 import {STFLib, GenesisState} from "@aztec/core/libraries/rollup/STFLib.sol";
 import {StakingLib} from "@aztec/core/libraries/rollup/StakingLib.sol";
 import {Timestamp, Slot, Epoch, TimeLib} from "@aztec/core/libraries/TimeLib.sol";
-import {Inbox} from "@aztec/core/messagebridge/Inbox.sol";
+import {Inbox, INBOX_BUCKET_RING_SIZE} from "@aztec/core/messagebridge/Inbox.sol";
 import {Outbox} from "@aztec/core/messagebridge/Outbox.sol";
 import {ISlasher} from "@aztec/core/slashing/Slasher.sol";
 import {GSE} from "@aztec/governance/GSE.sol";
@@ -621,7 +621,14 @@ contract RollupCore is EIP712("Aztec Rollup", "1"), Ownable, IStakingCore, IVali
 
     IInbox inbox = IInbox(
       address(
-        new Inbox(address(this), _feeAsset, _config.version, Constants.L1_TO_L2_MSG_SUBTREE_HEIGHT, _config.inboxLag)
+        new Inbox(
+          address(this),
+          _feeAsset,
+          _config.version,
+          Constants.L1_TO_L2_MSG_SUBTREE_HEIGHT,
+          _config.inboxLag,
+          INBOX_BUCKET_RING_SIZE
+        )
       )
     );
 

l1-contracts/src/core/interfaces/IRollup.sol

@@ -27,6 +27,11 @@ struct PublicInputArgs {
   bytes32 previousArchive;
   bytes32 endArchive;
   bytes32 outHash;
+  // Inbox rolling-hash chain segment consumed across the proven epoch (AZIP-22 Fast Inbox). Deliberately UNVALIDATED
+  // until the Fast Inbox flip, when they get checked against per-checkpoint records written at propose; for now they
+  // are only passed through to the proof's public inputs.
+  bytes32 previousInboxRollingHash;
+  bytes32 endInboxRollingHash;
   address proverId;
 }
 

l1-contracts/src/core/interfaces/messagebridge/IInbox.sol

@@ -13,6 +13,8 @@ interface IInbox {
   struct InboxState {
     // Rolling hash of all messages inserted into the inbox.
     // Used by clients to check for consistency.
+    // TODO: remove once the streaming inbox (AZIP-22 Fast Inbox) flips on and clients rely on the
+    // consensus rolling hash tracked in the buckets instead.
     bytes16 rollingHash;
     // This value is not used much by the contract, but it is useful for synching the node faster
     // as it can more easily figure out if it can just skip looking for events for a time period.
@@ -21,14 +23,43 @@ interface IInbox {
     uint64 inProgress;
   }
 
+  /**
+   * @notice Snapshot of the consensus rolling hash over the messages inserted into the Inbox, stored in a
+   * fixed-size ring indexed by a dense bucket sequence number (`seq % ringSize`). A bucket only accumulates
+   * messages sent within a single L1 block, so its final state is the chain position as of the end of that
+   * block; the censorship check at `propose` compares the checkpoint header's rolling hash against these
+   * snapshots (AZIP-22 Fast Inbox).
+   */
+  struct InboxBucket {
+    // Rolling hash after the last message absorbed into this bucket. Each link is
+    // `sha256ToField(previousRollingHash || leaf)`; the genesis value is zero.
+    bytes32 rollingHash;
+    // Cumulative number of messages inserted into the Inbox up to and including this bucket.
+    uint64 totalMsgCount;
+    // L1 block timestamp at which this bucket was opened. Recency comparisons (message lag,
+    // censorship cutoff) are done in seconds against this value.
+    uint64 timestamp;
+    // Number of messages absorbed into this bucket, capped at the per-bucket maximum.
+    uint32 msgCount;
+  }
+
   /**
    * @notice Emitted when a message is sent
    * @param checkpointNumber - The checkpoint number in which the message is included
    * @param index - The index of the message in the L1 to L2 messages tree
    * @param hash - The hash of the message
    * @param rollingHash - The rolling hash of all messages inserted into the inbox
+   * @param inboxRollingHash - The consensus rolling hash (truncated sha256 chain) after this message
+   * @param bucketSeq - The sequence number of the bucket this message was absorbed into
    */
-  event MessageSent(uint256 indexed checkpointNumber, uint256 index, bytes32 indexed hash, bytes16 rollingHash);
+  event MessageSent(
+    uint256 indexed checkpointNumber,
+    uint256 index,
+    bytes32 indexed hash,
+    bytes16 rollingHash,
+    bytes32 inboxRollingHash,
+    uint256 bucketSeq
+  );
 
   // docs:start:send_l1_to_l2_message
   /**
@@ -68,4 +99,18 @@ interface IInbox {
   function getTotalMessagesInserted() external view returns (uint64);
 
   function getInProgress() external view returns (uint64);
+
+  /**
+   * @notice Returns the sequence number of the bucket currently accumulating messages
+   * @return The current bucket sequence number
+   */
+  function getCurrentBucketSeq() external view returns (uint64);
+
+  /**
+   * @notice Returns the bucket with the given sequence number
+   * @dev Reverts if the bucket is ahead of the current one or has already been overwritten in the ring
+   * @param _seq - The bucket sequence number
+   * @return The bucket
+   */
+  function getBucket(uint256 _seq) external view returns (InboxBucket memory);
 }

l1-contracts/src/core/libraries/ConstantsGen.sol

@@ -25,7 +25,7 @@ library Constants {
     355_785_372_471_781_095_838_790_036_702_437_931_769_306_153_278_986_832_745_847_530_947_941_691_539;
   uint256 internal constant FEE_JUICE_ADDRESS = 3;
   uint256 internal constant BLS12_POINT_COMPRESSED_BYTES = 48;
-  uint256 internal constant ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH = 111;
+  uint256 internal constant ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH = 113;
   uint256 internal constant NUM_MSGS_PER_BASE_PARITY = 256;
   uint256 internal constant NUM_BASE_PARITY_PER_ROOT_PARITY = 4;
 }

l1-contracts/src/core/libraries/Errors.sol

@@ -28,6 +28,7 @@ library Errors {
   error Inbox__ContentTooLarge(bytes32 content); // 0x47452014
   error Inbox__SecretHashTooLarge(bytes32 secretHash); // 0xecde7e2c
   error Inbox__MustBuildBeforeConsume(); // 0xc4901999
+  error Inbox__BucketOutOfWindow(uint256 seq, uint256 current); // 0xfee255b7
 
   // Outbox
   error Outbox__Unauthorized(); // 0x2c9490c2
@@ -58,6 +59,10 @@ library Errors {
   error Rollup__InvalidCheckpointHeaderCount(uint256 expected, uint256 actual);
   error Rollup__InvalidCheckpointNumber(uint256 expected, uint256 actual); // 0xd1ba9bfa
   error Rollup__InvalidInHash(bytes32 expected, bytes32 actual); // 0xcd6f4233
+  error Rollup__InvalidInboxRollingHash(bytes32 expected, bytes32 actual); // 0xed1f7bb5
+  error Rollup__UnconsumedInboxMessages(uint256 nextBucketSeq); // 0x2bd4bf10
+  error Rollup__InboxConsumptionBehindParent(uint256 expected, uint256 actual); // 0x54e0c025
+  error Rollup__TooManyInboxMessagesConsumed(uint256 consumed); // 0xf76d1426
   error Rollup__InvalidOutHash(bytes32 expected, bytes32 actual); // 0x8eb39062
   error Rollup__InvalidPreviousArchive(bytes32 expected, bytes32 actual); // 0xb682a40e
   error Rollup__InvalidProof(); // 0xa5b2ba17

l1-contracts/src/core/libraries/crypto/Hash.sol

@@ -49,4 +49,16 @@ library Hash {
   function sha256ToField(bytes memory _data) internal pure returns (bytes32) {
     return bytes32(bytes.concat(new bytes(1), bytes31(sha256(_data))));
   }
+
+  /**
+   * @notice Advances the Inbox consensus rolling hash by one message leaf
+   * @dev Truncated at every link so the value is always a field element; the rollup circuits recompute the
+   * identical chain over the message leaves they insert (AZIP-22 Fast Inbox). The genesis value is zero.
+   * @param _rollingHash - The current rolling hash
+   * @param _leaf - The message leaf to absorb
+   * @return The updated rolling hash
+   */
+  function accumulateInboxRollingHash(bytes32 _rollingHash, bytes32 _leaf) internal pure returns (bytes32) {
+    return sha256ToField(abi.encodePacked(_rollingHash, _leaf));
+  }
 }

l1-contracts/src/core/libraries/rollup/EpochProofLib.sol

@@ -183,6 +183,11 @@ library EpochProofLib {
       }
     }
 
+    // The fee recipient/value below are sourced from the supplied headers, so the header hashes must be validated here
+    // as well as on the submit path - otherwise an off-chain caller of this getter would assemble public inputs from
+    // unverified fee fields and only discover the mismatch when the on-chain proof reverts.
+    verifyHeaders(_start, _end, _headers);
+
     bytes32[] memory publicInputs = new bytes32[](Constants.ROOT_ROLLUP_PUBLIC_INPUTS_LENGTH);
 
     // Structure of the root rollup public inputs we need to reassemble:
@@ -191,6 +196,8 @@ library EpochProofLib {
     //   previous_archive_root: Field,
     //   end_archive_root: Field,
     //   out_hash: Field,
+    //   previous_inbox_rolling_hash: Field,
+    //   end_inbox_rolling_hash: Field,
     //   checkpointHeaderHashes: [Field; Constants.MAX_CHECKPOINTS_PER_EPOCH],
     //   fees: [FeeRecipient; Constants.MAX_CHECKPOINTS_PER_EPOCH],
     //   chain_id: Field,
@@ -208,15 +215,21 @@ library EpochProofLib {
       publicInputs[1] = _args.endArchive;
 
       publicInputs[2] = _args.outHash;
+
+      // Inbox rolling-hash chain segment consumed across the epoch (AZIP-22 Fast Inbox). Deliberately UNVALIDATED
+      // until the Fast Inbox flip, when they get checked against per-checkpoint records written at propose; for now
+      // they are only passed through to the proof's public inputs.
+      publicInputs[3] = _args.previousInboxRollingHash;
+      publicInputs[4] = _args.endInboxRollingHash;
     }
 
     uint256 numCheckpoints = _end - _start + 1;
 
     for (uint256 i = 0; i < numCheckpoints; i++) {
-      publicInputs[3 + i] = STFLib.getHeaderHash(_start + i);
+      publicInputs[5 + i] = STFLib.getHeaderHash(_start + i);
     }
 
-    uint256 offset = 3 + Constants.MAX_CHECKPOINTS_PER_EPOCH;
+    uint256 offset = 5 + Constants.MAX_CHECKPOINTS_PER_EPOCH;
 
     // Taking recipient/value from the checkpoint headers rather than the prover
     // as defense in depth. Slots past numCheckpoints stay zero.

l1-contracts/src/core/libraries/rollup/ProposeLib.sol

@@ -5,6 +5,7 @@ pragma solidity >=0.8.27;
 import {BlobLib} from "@aztec-blob-lib/BlobLib.sol";
 import {IEscapeHatch} from "@aztec/core/interfaces/IEscapeHatch.sol";
 import {RollupStore, IRollupCore, CheckpointHeaderValidationFlags} from "@aztec/core/interfaces/IRollup.sol";
+import {IInbox} from "@aztec/core/interfaces/messagebridge/IInbox.sol";
 import {TempCheckpointLog} from "@aztec/core/libraries/compressed-data/CheckpointLog.sol";
 import {FeeHeader} from "@aztec/core/libraries/compressed-data/fees/FeeStructs.sol";
 import {ChainTipsLib, CompressedChainTips} from "@aztec/core/libraries/compressed-data/Tips.sol";
@@ -20,6 +21,14 @@ import {Signature} from "@aztec/shared/libraries/SignatureLib.sol";
 import {ProposedHeader, ProposedHeaderLib} from "./ProposedHeaderLib.sol";
 import {STFLib} from "./STFLib.sol";
 
+// Streaming-inbox protocol constants (AZIP-22 Fast Inbox). These mirror the protocol circuit constants and
+// should move into the generated Constants library once the Solidity emitter includes them.
+// Minimum bucket age, in seconds, at the start of a checkpoint's build frame for its consumption to be
+// mandatory. One L1 slot: validators cannot be required to act on buckets they may not have seen.
+uint256 constant INBOX_LAG_SECONDS = 12;
+// Maximum number of L1 to L2 messages a single checkpoint can insert.
+uint256 constant MAX_L1_TO_L2_MSGS_PER_CHECKPOINT = 1024;
+
 struct ProposeArgs {
   bytes32 archive;
   OracleInput oracleInput;
@@ -370,6 +379,78 @@ library ProposeLib {
     );
   }
 
+  /**
+   * @notice Validates a checkpoint's Inbox consumption against the streaming inbox buckets and returns how
+   *         far consumption has reached. Not yet called from propose(): the legacy `consume()`/`inHash` flow
+   *         remains the enforced path until the streaming inbox (AZIP-22 Fast Inbox) flips on.
+   *
+   * @dev Read-only; performs no Inbox write. Checks, in order:
+   *      1. The checkpoint header's `inboxRollingHash` must equal the rolling hash snapshotted in the Inbox
+   *         bucket referenced by `_bucketHint`. The hint is a plain calldata lookup aid, not signed and not
+   *         part of the header: a wrong hint cannot change what gets accepted, it only reverts. A checkpoint
+   *         that consumes no messages references the same bucket as its parent.
+   *      2. Consumption moves forward: the referenced bucket's cumulative total must be at least the parent
+   *         checkpoint's (equal consumes nothing; behind is a hard revert). This precedes the subtractions
+   *         below, which rely on `bucket.totalMsgCount >= _parentTotalMsgCount` to not underflow.
+   *      3. Cap upper bound: a single checkpoint cannot consume more than MAX_L1_TO_L2_MSGS_PER_CHECKPOINT
+   *         messages, the maximum the circuits can insert.
+   *      4. Mandatory consumption (the censorship assert): the first unconsumed bucket (`_bucketHint + 1`)
+   *         must either not exist, sit past the consumption cutoff, or be cap-escaped — consuming through it
+   *         would exceed MAX_L1_TO_L2_MSGS_PER_CHECKPOINT messages since the parent checkpoint's cumulative
+   *         total. The cutoff is the start of the checkpoint's build frame minus INBOX_LAG_SECONDS: a
+   *         checkpoint proposed in slot S is built during slot S-1, and validators are not required to have
+   *         seen buckets younger than one L1 slot at build start.
+   *
+   *      No consumed-bucket pointer is written here. The caller (FI-14) stores the returned consumed
+   *      position in the checkpoint's temp-log record, which is the authoritative consumed total: temp logs
+   *      rewind with the pending chain on a prune, so the record stays prune-consistent — unlike an
+   *      Inbox-side pointer advanced with the pending chain, which would sit ahead of the replacement chain.
+   *
+   * @param _inbox - The Inbox holding the rolling-hash buckets
+   * @param _inboxRollingHash - The checkpoint header's inbox rolling hash
+   * @param _bucketHint - Sequence number of the bucket the header's rolling hash corresponds to
+   * @param _slotNumber - The slot the checkpoint is proposed in
+   * @param _parentTotalMsgCount - Cumulative Inbox message count consumed as of the parent checkpoint
+   * @return The cumulative Inbox message count consumed as of this checkpoint (`bucket.totalMsgCount`), for
+   *         the caller to store in the checkpoint's temp-log record
+   */
+  function validateInboxConsumption(
+    IInbox _inbox,
+    bytes32 _inboxRollingHash,
+    uint256 _bucketHint,
+    Slot _slotNumber,
+    uint256 _parentTotalMsgCount
+  ) internal view returns (uint256) {
+    IInbox.InboxBucket memory bucket = _inbox.getBucket(_bucketHint);
+    require(
+      bucket.rollingHash == _inboxRollingHash,
+      Errors.Rollup__InvalidInboxRollingHash(bucket.rollingHash, _inboxRollingHash)
+    );
+
+    require(
+      bucket.totalMsgCount >= _parentTotalMsgCount,
+      Errors.Rollup__InboxConsumptionBehindParent(_parentTotalMsgCount, bucket.totalMsgCount)
+    );
+
+    require(
+      bucket.totalMsgCount - _parentTotalMsgCount <= MAX_L1_TO_L2_MSGS_PER_CHECKPOINT,
+      Errors.Rollup__TooManyInboxMessagesConsumed(bucket.totalMsgCount - _parentTotalMsgCount)
+    );
+
+    if (_bucketHint < _inbox.getCurrentBucketSeq()) {
+      IInbox.InboxBucket memory next = _inbox.getBucket(_bucketHint + 1);
+      Timestamp buildFrameStart = TimeLib.toTimestamp(_slotNumber - Slot.wrap(1));
+      Timestamp cutoff = buildFrameStart - Timestamp.wrap(INBOX_LAG_SECONDS);
+      require(
+        next.timestamp > Timestamp.unwrap(cutoff)
+          || next.totalMsgCount - _parentTotalMsgCount > MAX_L1_TO_L2_MSGS_PER_CHECKPOINT,
+        Errors.Rollup__UnconsumedInboxMessages(_bucketHint + 1)
+      );
+    }
+
+    return bucket.totalMsgCount;
+  }
+
   /**
    * @notice  Gets the mana min fee components
    *          For more context, consult:

l1-contracts/src/core/libraries/rollup/ProposedHeaderLib.sol

@@ -22,6 +22,7 @@ struct ProposedHeader {
   bytes32 blockHeadersHash;
   bytes32 blobsHash;
   bytes32 inHash;
+  bytes32 inboxRollingHash;
   bytes32 outHash;
   Slot slotNumber;
   Timestamp timestamp;
@@ -56,6 +57,7 @@ library ProposedHeaderLib {
         _header.blockHeadersHash,
         _header.blobsHash,
         _header.inHash,
+        _header.inboxRollingHash,
         _header.outHash,
         _header.slotNumber,
         Timestamp.unwrap(_header.timestamp).toUint64(),