feat(coprocessor): drift detection in gw-listener

.github/workflows/test-suite-e2e-tests.yml

@@ -238,6 +238,11 @@ jobs:
         run: |
           ./fhevm-cli test hcu-block-cap
 
+      - name: Ciphertext drift test
+        working-directory: test-suite/fhevm
+        run: |
+          ./fhevm-cli test ciphertext-drift
+
       - name: Host listener poller test
         working-directory: test-suite/fhevm
         run: |

charts/coprocessor/Chart.yaml

@@ -1,6 +1,6 @@
 name: coprocessor
 description: A helm chart to distribute and deploy Zama fhevm Co-Processor services
-version: 0.8.4
+version: 0.8.5
 apiVersion: v2
 keywords:
   - fhevm

charts/coprocessor/values.yaml

@@ -417,12 +417,31 @@ gwListener:
   replicas: 1
 
   env:
-    # =========================================================================
-    # NEW ENVIRONMENT VARIABLES
-    # =========================================================================
-    # The address of the KMSGeneration contract
+    - name: DATABASE_URL
+      valueFrom:
+        secretKeyRef:
+          name: coprocessor-db-url
+          key: coprocessor-db-url
+    - name: INPUT_VERIFICATION_ADDRESS
+      valueFrom:
+        configMapKeyRef:
+          name: gateway-sc-addresses
+          key: input_verification.address
     - name: KMS_GENERATION_ADDRESS
-      value: ""
+      valueFrom:
+        configMapKeyRef:
+          name: gateway-sc-addresses
+          key: kms_generation.address
+    - name: CIPHERTEXT_COMMITS_ADDRESS
+      valueFrom:
+        configMapKeyRef:
+          name: gateway-sc-addresses
+          key: ciphertext_commits.address
+    - name: GATEWAY_CONFIG_ADDRESS
+      valueFrom:
+        configMapKeyRef:
+          name: gateway-sc-addresses
+          key: gateway_config.address
 
   # Command line arguments for the gateway listener
   args:
@@ -432,6 +451,8 @@ gwListener:
     - --gw-url=ws://gateway-rpc-node:8548
     - --input-verification-address=$(INPUT_VERIFICATION_ADDRESS)
     - --kms-generation-address=$(KMS_GENERATION_ADDRESS)
+    - --ciphertext-commits-address=$(CIPHERTEXT_COMMITS_ADDRESS)
+    - --gateway-config-address=$(GATEWAY_CONFIG_ADDRESS)
     - --error-sleep-initial-secs=1
     - --error-sleep-max-secs=10
     - --health-check-port=8080

coprocessor/fhevm-engine/db-migration/migrations/20260311154000_gw_listener_earliest_open_ct_block.sql

@@ -0,0 +1,3 @@
+ALTER TABLE gw_listener_last_block
+ADD COLUMN IF NOT EXISTS earliest_open_ct_commits_block BIGINT
+CHECK (earliest_open_ct_commits_block >= 0);

coprocessor/fhevm-engine/gw-listener/src/bin/gw_listener.rs

@@ -89,6 +89,31 @@ struct Conf {
         help = "Skip VerifyProofRequest events during replay"
     )]
     pub replay_skip_verify_proof: bool,
+
+    #[arg(
+        long,
+        requires = "gateway_config_address",
+        help = "CiphertextCommits contract address for drift detection"
+    )]
+    ciphertext_commits_address: Option<Address>,
+
+    #[arg(
+        long,
+        requires = "ciphertext_commits_address",
+        help = "GatewayConfig contract address used to fetch coprocessor tx-senders"
+    )]
+    gateway_config_address: Option<Address>,
+
+    /// How long to wait for the gateway to emit a consensus event after the
+    /// first submission is seen. Wall-clock duration — the default of 5 minutes
+    /// accommodates coprocessors that may be stuck for a few minutes.
+    #[arg(long, default_value = "5m", value_parser = parse_duration, requires = "ciphertext_commits_address")]
+    drift_no_consensus_timeout: Duration,
+
+    /// After consensus, how many additional blocks to wait for remaining
+    /// coprocessors to submit their ciphertext material. Wall-clock duration.
+    #[arg(long, default_value = "5m", value_parser = parse_duration, requires = "ciphertext_commits_address")]
+    drift_post_consensus_grace: Duration,
 }
 
 fn install_signal_handlers(cancel_token: CancellationToken) -> anyhow::Result<()> {
@@ -171,6 +196,10 @@ async fn main() -> anyhow::Result<()> {
         replay_from_block: conf.replay_from_block,
         replay_skip_verify_proof: conf.replay_skip_verify_proof,
         log_last_processed_every_number_of_updates: conf.log_last_processed_every_number_of_updates,
+        ciphertext_commits_address: conf.ciphertext_commits_address,
+        gateway_config_address: conf.gateway_config_address,
+        drift_no_consensus_timeout: conf.drift_no_consensus_timeout,
+        drift_post_consensus_grace: conf.drift_post_consensus_grace,
     };
 
     let gw_listener = GatewayListener::new(