[davidtaikocha]

Summary

Glamsterdam L1 headers carry the EIP-7928 block access list hash, and the L1 block hash commits to it.

• gaiko2 currently rejects that field in every decoded header (field block_access_list_hash is not supported by taiko-geth replay). Once L1 forks, every proposal whose origin block is post-fork fails to prove (fail-closed).
• Removing that check alone is not enough. The pinned taiko-geth types.Header has no such field, so the recomputed taiko.l1_header hash would not match proposal.originBlockHash, and the anchor checkpoint hashes would not match either.

Changes:

• Bump taiko-geth to the merged taikoxyz/taiko-geth#611 commit on taiko, 8a71a2ecb3b7 (v1.18.1-0.20261009020728-8a71a2ecb3b7). Its types.Header keeps BlockAccessListHash in the canonical position, before SlotNumber. Its tree is identical to the reviewed PR head f2fe2fd498d2.
• decodeL1Header keeps the field for taiko.l1_header and taiko.l1_ancestor_headers. decodeHeader, which decodes L2 headers, still rejects it with the same error.

Rollout

• Merge order: taiko-geth#611 is merged, and this PR now pins its taiko squash commit, so it is ready to merge.
• taiko-geth delta from the current pin 8e98046bfd6a: five CI-only commits (#602, #603, #606, #607, #609), plus #611.
• New enclave identity: this changes the gaiko2 binary, so the SGX enclave measurement changes. That means a new key, a new quote and a new registration, and on mainnet that is a DAO step.
• Timing:
  • The new binary still accepts pre-fork L1 headers, so it can be registered before the forks.
  • It needs to be live before Hoodi's Glamsterdam fork. The proposed time is epoch 132352 = 2026-10-26 17:42:48 UTC (eth-clients/hoodi#31, not final yet).
  • It also needs to be live before mainnet's fork, which is not yet scheduled.
• This PR does not build, publish, register or deploy an enclave image.

Verification

• TestDecodeGuestInputL1HeadersKeepsGlamsterdamHeaderHash: real Sepolia block 11873940 (testdata/l1_header_sepolia_11873940_glamsterdam.json). The decoded origin and ancestor hash 0xfd4eb21751cb7c7d94d75f61c9f6364558923a2db73599f9ed917ee65d8c5680 matches eth_getBlockByNumber.
• TestValidateManifestBindingAcceptsGlamsterdamL1Headers: full manifest binding with L1 headers that carry a block access list hash and slot number.
• Both tests failed before the decoder change with the error above. The existing TestDecodeHeaderRejectsNonNullBlockAccessListHash still passes.
• Commands:
  • go mod verify
  • go mod tidy -diff
  • go vet ./...
  • go build ./...
  • go test -count=1 ./...
  • go test -race -count=1 ./cmd/gaiko2 ./internal/api ./internal/tee
  • git diff --check origin/main
  • internal/prover tests also pass with GOTOOLCHAIN=go1.24.0, the CI toolchain.

🤖 Generated with Claude Code

[smtmfft]

Reviewed at ee13f4f. The L1-only decoder preserves the Glamsterdam block access list hash for canonical header hashing while L2 replay continues to reject the field. The pinned taiko-geth squash commit matches the reviewed #611 tree, real-header and manifest-binding regressions cover the affected paths, and CI is green.