docs(protocol): add design spec for L2-native ephemeral blobs by dantaik · Pull Request #22014 · taikoxyz/taiko-mono

dantaik · 2026-08-13T09:29:39Z

Summary

Adds packages/protocol/docs/l2_native_blobs.md — a detailed design specification for native EIP-4844 type-3 transaction support on Taiko L2, with blob bodies retained and served by Taiko's node network and never posted to L1 ("ephemeral native blobs", the design sketched in #19832).

Core design points:

Invariant: execution state depends only on blobVersionedHashes (which ride to L1 inside the ordinary txlist manifest), never on blob bodies — so derivation, proving, and the L1 contracts are untouched by body availability. A lost body strands its buyer; it cannot fork the chain or block a proof.
Retention: BLOB_RETENTION_SECONDS_MIN = 6_291_456 (~72.8 days) — exactly 4× Ethereum's 4096-epoch (~18.2-day) sidecar window, with a 90-day default for serving nodes. Retention is a service role (preconfers MUST, RPC providers SHOULD serve); other full nodes may prune freely.
Launch throughput/fee lane: target 1 / max 3 blobs per block, EIP-4844 excess-blob-gas market with the EIP-7918 reserve mechanism (structure quoted from the Final EIP, including the leading early return; L1-identical arithmetic widths) and a Taiko-specific update fraction giving ×1.125-per-full-block max growth — deliberately the responsiveness of L1's original Cancun market (current L1 runs ≈×1.0817); blob fees burn at launch, with the routing decision due before mainnet and implementation deferred to a follow-up fork.
Availability guarantee at launch: bonded-preconfer custody — one uniform acceptance predicate (cells recomputed from the blob, proofs batch-verified) so honest nodes can never disagree on an envelope, and the envelope signature commits to a fixed sha256 sidecar digest, making in-transit stripping detectable and never blamed on the operator. Documented as committee-grade DA (governance-grade enforcement) with a PeerDAS-style sampling upgrade path; the fake-hash/sidecar-less vector is analyzed and gated on the permissioned proposer set (§12.5).
IPFS archival profile (§7.4): an optional, off-by-default Kubo-sidecar profile (put-on-receipt, pin-on-seal) — blobs stored as single raw CIDv1 blocks, grouped into deterministic per-1000-block dag-cbor bundles whose range-root CIDs converge bit-for-bit across independent archivers (seal-log nodes carry lineage and are the DHT-announced pin roots; empty ranges are sealed so skippedRanges means only "incomplete"); bundle metadata outlives body retention so post-window retrieval has a discovery bootstrap; the versionedHash → CID index is untrusted because retrieval is doubly self-verifying (CID check + KZG re-derivation). Explicitly a replication/archival layer, not part of the availability guarantee.
Zero required L1 contract changes; modest, mostly upstream-inherited prover changes (bodies are never proven; the type-3 STF rules come from revm/reth with mandatory parity vectors gating devnet; blob opcodes already carry Unzen zk-gas prices). The bulk of the work is preconf sidecar gossip, the per-node sidecar store/serving API, and execution-client fork gating — the engine_getBlobsV2/V3 Osaka fork gate is already satisfied (Unzen mapped OsakaTime) and must simply not regress.
Forced-inclusion sources exclude type-3 at launch with per-transaction skipping anchored to the on-chain isForcedInclusion flag, wallets/RPCs guarding users from paying forced-inclusion fees for unexecutable type-3 txs, and a security analysis covering withholding grief, storage-DoS bounds, fake-hash inclusion, and zk-gas truncation interplay. Appendix C consolidates the mandatory test-vector checklist.

Also flags an immediate hygiene item independent of this design, tracked in #22015: post-Unzen the blobpool is Cancun-active and Pending() isn't filtered, so a type-3 tx can enter a proposed txlist today only to be dropped by every sealer at import — the pool should reject type-3 (with a normative error message) until the fork activates.

Review notes

@davidtaikocha — requesting your review, particularly on:

Launch parameters (§3, §15.2): TARGET 1 / MAX 3 per block, MAX_BLOBS_PER_TX = 2, and the 90-day serving default over the 72.8-day minimum.
The sidecar hand-off path (§6): sealer includes envelopes → driver pulls sidecars via engine_getBlobsV2 → preconf envelope carries blobSidecars — vs. alternatives you may prefer in the taiko-reth/Rust-driver architecture.
The §4.3.3 forced-inclusion restriction and the §12.4 censorship trade-off (plus the §15.3 envelope-only middle path).
Whether phase-0 hygiene (taiko-geth: post-Unzen txpool accepts type-3 txs that every sealer drops, so proposers pay L1 DA for dead bytes #22015) should land in taiko-geth now.
The IPFS profile (§7.4): duplicated Kubo blockstore (~2× disk, simple) vs filestore dedup — resolve before phase 3 — and whether sealed bundle CARs should feed a Filecoin/EthStorage incentivized tier (§15.7).
Blob-fee posture: launch burn with the routing decision due before mainnet activation (§5, §15.5).

Testing

Documentation-only change; no code paths affected. Markdown/mermaid rendering verified.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Specifies native EIP-4844 type-3 transaction support on Taiko L2 with blob bodies retained and served by the Taiko node network for at least 6,291,456 seconds (~72.8 days, 4x Ethereum's 4096-epoch sidecar window) and never posted to L1. Covers consensus rules, fee lane, preconf sidecar propagation, retention/serving policy, component-level changes, security analysis, and rollout plan. Follow-up to #19832. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…decar Adds section 7.4 to the L2-native blobs spec: an optional, off-by-default node profile replicating received blobs into IPFS. Blobs map to single raw CIDv1 blocks grouped into deterministic per-1000-block dag-cbor bundles (identical root CIDs across independent archivers), with an untrusted versionedHash-to-CID index made safe by KZG re-derivation on retrieval. Only bundle roots are announced to the DHT to avoid reprovide storms. Includes the Kubo sidecar design: async pin-on-receipt worker off the import/serving hot path, interim direct pins promoted to recursive bundle-root pins on L1-canonical sealing, retention-aligned unpinning, flags, metrics, and failure semantics. Explicitly not part of the section 7.1 availability guarantee. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6784a65b3f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Switch the sidecar wire format to the Osaka cell-proof form (BlobSidecarVersion1) end-to-end, since engine_getBlobsV2 only serves V1 sidecars and current tooling already produces them; clarify that type-3 envelopes count toward maxBytesPerTxList (only bodies are excluded); align the serving API response with the existing BlobServerResponse schema so current client parsers work unchanged; and make blob-fee sharing an explicit state-transition work item with prover parity (stock 4844 burns the blob fee), with L1-style burn as the reviewed fallback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

github-actions · 2026-08-13T09:44:59Z

🐋 DeepSeek Code Review

🟡 Warnings

Fee arithmetic width is under-specified. §5 says the reserve comparison operates on “full-width (unbounded/256-bit)” integers, but BLOB_BASE_COST * parent.base_fee_per_gas can reach 8192 * (2^256-1), which overflows fixed 256-bit arithmetic. Clients must be explicitly required to use arbitrary-precision integers for these multiplications, not uint256/64-bit arithmetic.
excess_blob_gas overflow behavior is undefined. §5 requires arbitrary-precision calculation but stores the result as a uint64, and FEE-14 only tests values near 2^64, not above it. The spec never says whether clients must clamp, error, or wrap on overflow. Even if economically unreachable, this is consensus-critical; define it now to prevent divergent implementations.
IPFS sealing vs fake-hash type-3 txs is ambiguous. §7.4’s sealing rule assumes every finalized type-3 envelope can be completed with a commitment/body. But §12.5 permits sidecar-less type-3 transactions with no recoverable commitment or body. Such bundles can never be sealed, yet the spec treats all missing bodies as “backfillable.” It should explicitly state these ranges are permanently unsealable and recorded in skippedRanges, not retried as ordinary backfill gaps.

🔵 Suggestions

Add domain separation to the sidecar digest. §6.3’s digest is sha256(concat(sha256(blob_i ‖ commitment_i ‖ proofs_i) ...)) with no chain ID, envelope codec version, or purpose tag. Since the digest feeds signed envelopes and later attestations, include chainId/version in the inner hash to avoid cross-context ambiguity.
Extract the normative byte-level formats (sidecar digest, DAG-CBOR bundle schema, fee pseudocode) into standalone short spec blocks. The current prose is dense; implementation teams are likely to miss normative details.

🟢 What Looks Good

The core invariant — execution derives from versioned hashes only, never blob bodies — is stated cleanly and reinforced throughout.
Storage/bandwidth DoS math is concrete and checkable, with clear provisioning guidance.
The mandatory test-vector checklist is a strong cross-client consistency mechanism.

Automatically triggered on PR update • model: deepseek-v4-pro

Remove two stale single-proof-wrapper references left over from the cell-proof format decision; make bundle sealing deterministic by requiring the block range to derive from a finalized L1 origin (the precondition for bit-identical archiver convergence); specify the builder behavior when engine_getBlobsV2 returns null (rebuild without the affected txs, never publish an under-equipped envelope); correct KiB/GB unit mixing in the storage math (412 GB min-window, 510 GB at 90 days, 17 GB/day ceiling); clarify submission uses the standard EIP-4844 network wrapper; separate the blob-fee balance check from the actual debit; drop interim IPFS pins in favor of disabled auto-GC so nothing per-blob is ever announced; add a disk-pressure rule; and link the phase-0 hygiene item to its tracking issue #22015. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Spell out the exact EIP-7918 calc_excess_blob_gas pseudocode and note that price-hold at sub-target demand below the floor is intended behavior; require cell recomputation from the received blob before cell-proof verification (verifying supplied cells binds nothing); make forced-inclusion type-3 rejection per-transaction instead of source-fatal to narrow the censorship blast radius; add a normative DAG-CBOR encoding row with a test-vector requirement for bundle convergence; pin Kubo strategy naming and version-check expectations; lower MAX_BLOBS_PER_TX to 2 so one tx cannot monopolize the blob lane; give exact field types for both serving endpoints; date-stamp the preconfer operator names; and pin the revisions that file:line references point to. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ge cases Flip fee routing to stock EIP-4844 burn at launch so the V7 state transition carries no bespoke credit path (routing becomes a self-contained follow-up fork, section 15.5); pin the reserve floor to EIP-7918 as deployed in Fusaka and require calc_excess_blob_gas test vectors; cite that per-transaction skipping of prohibited txs is today's sealer behavior, not a new semantic; specify duplicate versioned-hash handling across envelope, store, and getBlobsV2; make the no-auto-GC Kubo requirement an explicit daemon-flag instruction; allow rate limiting on serving endpoints without it counting as withholding; and mark phase-0 hygiene as a hard prerequisite. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Require the builder to verify the one-sidecar-per-hash invariant itself instead of trusting the engine API's all-or-nothing behavior; specify the bundle prev field as raw binary CIDv1 bytes with the empty string for the first bundle; add the fork-boundary rule (first V7 block treats its pre-V7 parent's blob fields as zero); clarify the L1 per-tx/per- block cap comparison (6 vs post-BPO2 max 21); record the force-include- envelope-only alternative in the open questions; note fee routing should be resolved before mainnet activation; and offer a binary serving response alongside hex JSON. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ng gaps Require bundles to be sealed only from complete blob sets (backfill first, never announce divergent roots); clarify the SignedTransaction change extends only the typed docs table while wire encoding is untouched; order sidecar retrieval and persistence strictly before block import so client-specific pool eviction cannot lose bodies; and have serving nodes export a retention-horizon metric so under-retention is externally observable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Inline the reserve-condition fake_exponential call so the pseudocode has no undefined helper; cite that getBlobsV3 exists in the pinned taiko-geth; require receiving nodes to persist sidecars before block import (mirror of the builder rule); version the preconf envelope extension for mixed-client rollout; spell out DAG-CBOR key ordering (length-first then bytewise); and point the operator-set claim at the on-chain preconf whitelist as source of truth. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Scope the deployed-L1-values claim to BLOB_BASE_COST and the 7918 mechanism, and show the derivation of Taiko's own update fraction so neither constant gets copied across chains; correct the reserve-floor prose (price holds only at exactly zero usage and rises gently with any usage below the floor); disambiguate BlobSidecarVersion1 as geth's type constant vs engine method numbering; and attribute the blob tx type to Cancun rather than calling it an Osaka feature. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

… framing Restructure the sidecar-format sentence so the cell-proof description can no longer read as describing V0; require one index entry per (block, tx, blob) occurrence with duplicates never deduplicated so archiver roots stay bit-identical; reframe provisioning guidance against both retention windows with the adversarial ceilings called out as monitor-only; and document the fork-activation exception where the reserve floor cannot raise the price from zero excess. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ver gate Distinguish EIP-4844 structural validity from Taiko's consensus-level schedule caps and specify the deterministic per-tx skip for adversarial over-cap txlists; make zk-gas/STF prover parity a MUST with a devnet hard gate; state the forced-inclusion skip is part of the proven state transition; reword the activation-floor note; mark prev as an intentionally non-link field; cover sidecar-less adversarial proposals explicitly; bound the getBlobsV2 retry path; and add a BLOBBASEFEE compatibility note for contracts deployed since Unzen. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Redefine prev as the most recent sealed root and add skippedRanges with a mandatory bundle-adoption step before declaring a gap, so one unrecoverable range can never stall the archival log and divergent local completeness heals through self-verifying bundle adoption; state the update-fraction derivation honestly (truncated ln(1.125), realized growth x1.12502) instead of implying exactness; date and source the first-L2 claim; pin integer semantics in the fee pseudocode; align truncation with envelope assembly ordering; add IPFS store reconciliation so queue drops self-heal; and define serving-API error semantics (404 vs 410). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ergence Separate the bundle into a range-contents node (a pure function of the finalized chain, unconditionally convergent — the cross-check anchor) and a seal-log node carrying prev and skippedRanges lineage, so honest archivers racing a catastrophic gap can fork lineage without breaking the single-CID cross-check property; scope the convergence claim accordingly; name the reserve floor an anti-decay floor rather than an instantaneous lower bound; and require Derivation.md to state the forced-inclusion per-transaction rule at V7. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ector Add section 12.5: consensus-valid type-3 envelopes with fabricated hashes could pump the blob lane and sell no availability; at launch the vector is contained because all non-forced inclusion flows through the bonded preconfer whitelist whose validation refuses sidecar-less envelopes and forced inclusion excludes type-3 — making it attributable slashable misbehavior whose perpetrator pays the price they pump — and re-closing it (preconf-path provenance or inclusion-time availability attestations) is a hard precondition for permissionless proposing. Cross-reference from the derivation tolerance and custody sections, and fix a parameter-tuning section pointer. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ment Include cell-proof overhead in the worst-case preconf bandwidth figure (~402 KiB per block, not 384); distinguish the doubled steady-state bound from the one-third ceiling increase in the 2/4 parameter note; state explicitly that launch enforcement of the serving obligation is governance-grade rather than an automatic on-chain rule; and mark the force-include-envelope alternative as a distinct availability tier needing its own threat model. The EIP-7918 formula stands as written — the (MAX-TARGET)/MAX scaling is the deployed EIP's reserve branch and preserves max-growth continuity across the floor. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

State that the type-3 skip inside forced sources is scoped by the on-chain DerivationSource.isForcedInclusion flag replayed identically by sealer and prover, closing the provenance ambiguity; correct rounded-vs-truncated wording in the fraction derivation; fix the bundle size to 375 MiB; make bundleRoots an array since a hash can occur in many ranges; define the blob_bundles response shape; and extend the fee test vectors with the sub-16-wei threshold edge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…lection Record that the reserve-branch pseudocode was re-verified verbatim against the EIP specification (no max() clamp exists in the deployed EIP; the floor acts solely through the excess update); define the deterministic greedy in-order selection rule for over-cap txlists with mandatory vectors; correct the IPFS rationale to the block-size limit rather than the file-chunking target; and require a multi-bundle prev chain in the convergence vectors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Base the retention and ingest bounds on blob plus cell proofs plus commitment (~137 KiB per record) instead of bare blob bytes, updating the steady-state and ceiling figures accordingly while noting the Kubo blockstore holds bodies only; name the minimum serving metrics; mark range roots vs seal-log roots in the API metadata; and give the pre-V7 pool rejection a distinct user-facing error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

State that the on-chain preconf whitelist is also the inbox proposer checker, closing the proposer-but-not-preconfer question by construction; scope the IPFS archive explicitly to bodies plus commitments with cell proofs recomputable on demand (redundant to archive, bounded to reconstruct, never on the serving path); define the disk-full-inside-the-window precedence (import never blocks, last- resort within-window eviction is a surfaced obligation breach); and tighten sidecar ordering, range inclusivity, and bundleRoots client guidance. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ore serving Limit the persist-before-import durability rule to the serving-node custody set with validate-then-discard for everyone else, resolving the contradiction with prune-freely full nodes; require cell proofs to be batch-verified or recomputed before the API may return them; state why skip-based construction is existing derivation semantics rather than new consensus logic (based-rollup blocks are derived from adversarial txlists via the same filtering path the prover replicates); rephrase the proposer-preconfer identity as attributability rather than a closed path; add the serve/retention config split; and record the envelope- only forced-inclusion variant as a lower tier in the semantics table. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…b edge Note that Fusaka and Osaka name the same fork (upgrade vs EL name); position the blob-gas cap check at the gas-pool point in the existing sequential filter with cross-client vectors locking the predicate order; align the no-sidecar-less-route phrasing with attributable operator misbehavior; and specify that a forced source containing only type-3 transactions derives to an anchor-only block with L1-side queue consumption unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…tails Restructure fake-hash containment into explicit preconf-gossip, direct-to-L1, and forced-inclusion cases so mechanical refusal is not conflated with attributability; document the strict-greater-than boundary behavior of the reserve branch (one sub-floor decay step, deployed-L1-exact, vectored); pin version and chainId as minimal-width unsigned integers; and spell out the DHT traversal from seal-log root to range root. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Back the proposer-permissioning claim with exact code citations (PreconfWhitelist implements IProposerChecker, enforced on every proposal by the inbox); extend the persistence ordering to L1 submission so sidecars are durable before the proposal broadcast, closing the crash window between preconf announcement and L1 confirmation, with a direct-to-L1 sidecar-less vector required; reconcile section 7.1's universal with the direct path; make the absolute retention seconds normative with the 4x relationship as provenance; require publicly reachable serving endpoints or formal delegation; and correct the DHT description to a provider-location mechanism rather than a discovery bootstrap. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…efaults State that archival sidecar reconstruction is one compute_cells_and_kzg_proofs invocation producing all 128 proofs; record the realized x1.12502 growth in the constants table; link EIP-4844, EIP-7594, and EIP-7918 at first mention; give role-based defaults for the serve flag; and add the committee-grade-custody governance sign-off to the mainnet rollout gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…lure mode Add explicit parentheses so the multiply-before-floor-divide ordering cannot be misimplemented as a zero integer ratio, and state the sharpest form of the concentrated-custody failure mode as the explicit subject of the phase-4 governance sign-off. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ion cost Specify that a skipped range may be sealed later once recovered (range roots are lineage-independent, the seal-log is append-only, consumers locate ranges by blockRange), quantify the sidecar-validation CPU budget (milliseconds per blob, far under preconf cadence, fail-fast on first error), and add malformed-prev rejection cases to the convergence vectors. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…, fork gate Quote calc_excess_blob_gas with the EIP's leading sub-target early return, which precedes the reserve branch and flushes sub-target residual excess even below the floor — a reachable corner where the previous else-branch-only max() form diverged from the deployed EIP — and add the per-gas floor equivalent; require the preconf envelope signature to commit to the blobSidecars digest so custody is non-repudiable and relayers cannot strip sidecars to frame honest operators; state that getBlobsV2/V3 gate on LatestFork >= Osaka and that OsakaTime must stay mapped to the Unzen/V7 activation, with the blob schedule keyed to the Osaka slot; make sealed-bundle metadata outlive body retention so post-window IPFS retrieval has a discovery bootstrap; and fix the go.mod pin citation to the root replace directive. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Declare the integer update-fraction constant normative with the derivation as provenance only; specify prev bytes as standard binary CIDv1 (varint version, varint codec, multihash, no multibase); and require the Kubo blockstore-dedup decision before phase 3. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…r digest Correct the fee-market framing: the x1.125 per-full-block growth mirrors L1's original Cancun market, while current L1 since EIP-7691 runs about x1.0817 — Taiko deliberately keeps the faster rate; pin the envelope sidecar digest to one concrete sha256 construction; vector the exactly-16-wei strict-inequality edge; gloss fake_exponential inline; and note non-blob Kubo overhead rides in headroom. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ision Require bundle CARs to contain seal-log node, range root, and all raw leaves; spell out the DHT retrieval sequence (providers of the seal-log root serve the whole traversal, leaf CIDs never announced); and state precisely that OsakaTime has equaled the Unzen activation since August 2026 so V7 adds no EVM fork ID and must only avoid regressing the mapping. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…V7 inertness State exactly what the signed sidecar digest buys — stripping stays physically possible but becomes detectable and non-attributable, with re-fetch by digest — and what the signature covers; return sealLogRoots alongside bundleRoots since only seal-log nodes carry provider records; explain why the Osaka-keyed Taiko schedule is inert pre-V7 (no type-3 can enter a payload, keeping the zero pins true); and CI-check the announce set, not just the Kubo config. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…condition Fix the sidecar digest at byte level (raw fixed-length concatenation, proofs in cell-index order, mandatory vector); require the preconf transport to admit the worst-case envelope; state the whitelisted- proposer launch precondition in the phase-4 gate; exercise the pre-V7 zero pins in phase-2 CI with the schedule shipped; and paginate the bundle endpoint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…nd ratio State that forced sources follow the per-transaction skip rule regardless of sync path with explicit rule precedence; pin the empty sidecar digest to sha256 of the empty byte string and note envelope sidecars are purely positional so the digest covers all wire content; and show the constant delta-to-fraction ratio behind the x1.0817 figure so era-mixed arithmetic cannot dispute it again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ase-1 item Close the eviction window between txlist selection and sidecar retrieval by retrieving and persisting at selection time, with a drop counter so a starvation loop can never look healthy; and pin the Derivation.md forced-inclusion update as a phase-1 deliverable since the censorship exception is user-visible. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…review asks Add Appendix C consolidating every mandated vector case (fee branches and boundaries, greedy selection, forced-inclusion edges, digest, envelope codec, bundle encoding, prover parity) with cross-references — values remain implementation-generated; gate the phase-3 IPFS pilot on the Kubo announce-set/no-GC CI checks; add validation-latency benchmarks to the phase-2 soak; pin the normative pre-V7 rejection message string; and state the sidecar record shape explicitly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Distinguish the pre-mainnet routing decision from the burn-only launch implementation; state the floor-regime precondition on the sub-target flush corner in prose and vectors; forbid the pinned reprovider strategy as a roots substitute since it would restore per-blob announces; note the section-15.N cross-reference convention; require clients to re-verify data against commitment and versioned hash; and pin proof bytes to the canonical compressed G1 encoding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…rder Close the preconf-split vector by making cell recomputation plus batch proof verification the single mandatory acceptance predicate for every node (corrupt-proof sidecars are rejected uniformly and attributably), scoping commitment-only re-derivation to HTTP/backfill where proofs are recomputable; state that greedy selection order is the L1-committed manifest txlist order everywhere; disambiguate the stripping attribution wording; and remove a doubled em-dash. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…tatus Qualify the fraction derivation with blob-count symbols so gas values cannot be substituted; add 503 with Retry-After for bodies missing inside the retention window; state why occurrence keys are deliberately omitted from the bundle index; pin uint64 L1-identical arithmetic; make the bulk endpoint per-occurrence explicit; and make the phase-4 sign-off public. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…profile Correct the round-40 over-narrowing: only excess_blob_gas and blob_gas_used are uint64, while the reserve comparison and fake_exponential operate on 256-bit fee values whose 64-bit evaluation could overflow and diverge from L1; seal empty ranges so skippedRanges means only incomplete; rename the Kubo section to put-on-receipt, pin-on-seal to match the actual flow; have wallets and RPCs refuse forced-inclusion submissions containing type-3 txs; and make the engine getBlobs semantics an explicit phase-2 hard gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…ntics State the exact convergence argument (range roots are functions of the chain plus bodies the chain uniquely determines via binding commitments, so sealed roots for a range are bit-identical); note that body dedup is safe because per-occurrence order reconstructs from block envelopes at serving time; map the EIP snake_case names to the header camelCase fields; and pin blockRange inclusivity in the bundle table. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

Define serving-endpoint discovery (operator-registered URLs shipped in client releases, flag-overridable, preconf peers as extras) so in-window bodies are locatable, not merely existent; require a permanent seen-hash index with prune timestamps for correct 404/410/503 classification, forbidding 404 without it; reword the count-vs-gas parenthetical; scope range roots to content authentication vs chain-level audit; tighten the Fusaka/Osaka EL wording; and pin the benchmark toolchain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…lignment Scope the forced-inclusion blast-radius guarantee accurately (same- sender nonce gaps skip per standard rules; other senders unaffected); state the full computation runs in unbounded integers with uint64 storage and L1-identical semantics; align the sidecar-retrieval prose with the selection-time rule; check the fork gate with continuous alerting before treating a getBlobsV2 null as pool eviction; and add a near-2^64 excess vector. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

…eep-link EIP - Fix the permanent seen-hash index estimate: at full target (1 blob per ~2 s block) a year is ~15.8M hashes, so 32 B/hash is ~505 MB/year (~630 MB with prune timestamps), not 45 MB. Still trivial next to body volumes, but the arithmetic is now right. - Add ASSUMED_BLOCK_CADENCE (~2 s) to the section 3 constants table, explicitly marked non-consensus, so every sizing figure in sections 6/7/12 names its shared assumption and gets recomputed if cadence changes. - Deep-link EIP-7918's Specification section and note its Final status where the spec claims exact mechanism equivalence. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Jo9EivPkB9G8vxYB4rcVZU

dantaik requested a review from davidtaikocha August 13, 2026 09:29

dantaik assigned davidtaikocha Aug 13, 2026

dantaik marked this pull request as ready for review August 13, 2026 09:33

dantaik requested a review from ggonzalez94 as a code owner August 13, 2026 09:33

dantaik and others added 2 commits August 13, 2026 17:33

Merge branch 'main' into claude/taiko-blob-support-g6da43

6784a65

dantaik changed the title ~~docs(protocol): L2-native ephemeral blobs design spec~~ docs(protocol): add design spec for L2-native ephemeral blobs Aug 13, 2026

chatgpt-codex-connector Bot reviewed Aug 13, 2026

View reviewed changes

Comment thread packages/protocol/docs/l2_native_blobs.md Outdated

Comment thread packages/protocol/docs/l2_native_blobs.md Outdated

Comment thread packages/protocol/docs/l2_native_blobs.md Outdated

Comment thread packages/protocol/docs/l2_native_blobs.md Outdated

dantaik mentioned this pull request Aug 13, 2026

taiko-geth: post-Unzen txpool accepts type-3 txs that every sealer drops, so proposers pay L1 DA for dead bytes #22015

Open

claude added 18 commits August 13, 2026 09:48

claude added 6 commits August 13, 2026 12:01