zkevm@v0.4.0 eip8025_optional_proofs witness_validation_* are stateless-verifier negative tests, not producer outputs

[awskii]

The eip8025_optional_proofs/witness_validation_{codes,state,headers} fixtures (plus witness_headers/witness_headers_extra_unused_older_ancestor) are stateless-verifier tests: each stores a deliberately mutated executionWitness (an item removed → "…should fail", or an extra item added → "…should still validate") and exercises the verifier's accept/reject.

The eest_zkevm_witness suite compares the witness that debug_executionWitness produces against the stored one. For these fixtures that always diverges by exactly the mutated item — erigon's produced witness is the canonical (correct) one, so no producer change can make them pass; greening one reds its twin. Confirmed e.g. validation_codes_extra_unused_bytecode ("Adding an unused bytecode preimage should still validate") stores canonical+1, which a producer never emits.

22 affected files. They need a stateless-verify consumer mode in the suite (feed statelessInputBytes, assert reject/accept against statelessOutputBytes), which does not exist yet. Skipped via SkipLoad in execution/tests/eest_zkevm_witness/witness_test.go; remove the skips once that consumer mode lands.

Related: #21563 (stale-gas skips in the same suite).

[VBulikov]

yperbasis added Imp2 as Importance

[awskii]

Re-checked against main (8e08e28cee) with the corpus on its pinned tests-zkevm@v0.4.1. Still out of scope for our runner — the skips are correct and load-bearing. Full suite at v0.4.1: 21604/21604 pass with the 22 expected failures in place.

What these 22 fixtures are

eip8025_optional_proofs/witness_validation_{codes,state,headers} (plus witness_headers/witness_headers_extra_unused_older_ancestor) are stateless-verifier negative tests. Each stores a deliberately mutated executionWitness alongside statelessInputBytes/statelessOutputBytes:

• _missing_* — an item removed; a stateless verifier must reject.
• _extra_unused_* — an unused item added; a stateless verifier must still accept.
• _malformed_* — corrupted RLP; must reject.

EEST states this directly in ethereum/execution-specs#2872: these fixtures "don't make sense to be run in stateful-ELs".

Why they can't pass here

cmd/evm/zkevmrunner.go is a stateful-EL check: it imports the chain and compares debug_executionWitness (canonical) against the stored witness. erigon never consumes the witness as input — it produces it, and always produces the canonical one. So the comparison diverges by exactly the mutation. Passing one would require erigon to emit a wrong witness.

Ran the 22 with the expected-failure matcher disabled — all 22 fail with <state|codes|headers> witness mismatch, off by exactly the injected item:

• validation_state_missing_storage_proof_node — expected 10 nodes, got 11 (erigon includes the storage proof node the fixture deleted).
• validation_codes_extra_unused_bytecode — expected 7, got 6 (erigon omits the unused bytecode the fixture added).
• validation_headers_malformed_rlp_header — can't even decode the fixture's expected header (rlp: value size exceeds available input length).

Pattern across all 22: _missing_* → erigon emits one more, _extra_unused_* → one fewer, _malformed_* → undecodable.

v0.4.1 note

v0.4.1 adds an executionWitnessMutated flag (ethereum/execution-specs#2872), but only in the blockchain_tests_engine format — not the blockchain_tests format our runner reads — so it can't drive the skip set directly. The flag marks 25 fixtures: our 22 plus 3 order-only mutations (*_unsorted_but_complete ×2, validation_headers_non_contiguous_chain). Those 3 pass here because our comparison is an order-insensitive multiset, so they correctly need no skip.

To close this

Add a stateless-verify consumer mode: feed statelessInputBytes, assert accept/reject against statelessOutputBytes. Both fields are present in the blockchain_tests fixtures. Until then the Fails patterns in newZkevmFailMatcher stay — removing them turns the divergences into red CI.