ePBS (EIP-7732 / Gloas) — SIP-94

[iurii-ssv]

Node-side ePBS (EIP-7732 / Gloas) support, per SIP ssvlabs/SIPs#94.

Built on the Boole code baseline — consolidated roles, ProposerConsensusData, and the node-side role switches — which has already merged to stage (via the integration/boole-convergence merge). This is a compile-time dependency on that code being present; it is not a dependency on the Boole fork activating. ePBS gates every execution path on the beacon node's GLOAS_FORK_EPOCH alone and runs correctly with Boole dormant (Forks.Boole = math.MaxUint64 — the default on every network, mainnet/sepolia/hoodi/holesky and now local-testnet), which is exactly the state the Glamsterdam transition runs in.

The ePBS wire constants (runner/beacon roles, partial-sig types, beacon domains 0x0B/0C/0D, and the #2962 request-auth pair DomainBuilderRequestAuth 0x0B000001 / RequestAuthPartialSig(9)) live in ssv-spec via PR #632 — the established spectypes pattern, and required because ekm/ssvsigner reaches signing domains only through spectypes. Their golden test lives there; both go.mods pin the top of that stack (ssv-spec#643) until the stack merges and is tagged. Those pins (and the go-eth2-client fork's) require go-bitfield under its renamed module path, github.com/OffchainLabs/go-bitfield; the node's last two imports of the old prysmaticlabs path (the ENR subnets entry and a discovery test) follow, so the library is not carried twice — the old path is frozen at its last pre-rename commit and cannot be bumped.

What's here

• protocol/v2/types/gloas package — the Gloas beacon-chain containers (the §4 block family with the EIP-8282 five-list ExecutionRequests, the §6 envelope, the PTC containers, ProposerPreferences) are go-eth2-client's spec/gloas types, aliased here; their SSZ is pk910/dynamic-ssz with the progressive-container/list merkleization of EIP-7688/EIP-7916 (Gloas SSZ types give a wrong hash_tree_root. All Gloas proposals fail. #3008). The SSV-owned types (GloasBeaconVote — fixed 120-byte, cross-fork decode fails cleanly — GloasProposalData (the §4 decided value: the block plus the self-build payload_root), the blinded envelope, PTCDuty, builder config and request auth) have dynamic-ssz encoders. Roots are pinned by a devnet-8 golden fixture: a finalized Gloas block whose HashTreeRoot must equal the chain's header root and whose proposer signature must verify, plus its execution-payload envelope.
• Fork gating & retiming (SIP §1) — GLOAS_FORK_EPOCH read from the BN spec into the fork map; IsGloas/IsGloasAtSlot, safe on pre-Gloas networks. IntervalDuration becomes slot-keyed (1/3 of the slot → 1/4 at the fork) and drives duty deadlines, QBFT round-1 head starts, aggregation waits, and attestation fetch budgets. QuickTimeout is deliberately not retimed — the Gloas proposer is round-1-must-succeed pending real round-trip data. roundtimer.RoundRelativeRole (the proposer's round-relative timing, also what message validation's round-spread exemption keys off) covers the proposer alone: §6 adds no QBFT instance of its own.
• §2 Gloas attestations — the committee runner agrees on GloasBeaconVote (carrying the BN's payload-status index) on Gloas slots: fork-aware decode across runner, post-consensus validation, committee observer, and duty tracer; NewGloasVoteChecker, which also applies SIP §2's same-slot SHOULD: it rejects index 1 for a block the operator's head events place at the duty slot (the spec reference has no such view and skips the check; gloas value check: SIP #94's new optional same-slot AttestationDataIndex check is not implemented #3035); index-preserving aggregation; and a hand-rolled attestation-data GET on Gloas slots (go-eth2-client's post-Electra Index==0 check rejects the healthy FULL status). Aggregation on Gloas slots uses go-eth2-client's dedicated gloas.AggregateAndProof/SignedAggregateAndProof end to end (fetch, consensus-data decode, signed submit): the container serializes like Electra's but merkleizes differently, so the Electra path would sign the wrong root (All AGGREGATOR duties fail after the Gloas fork. The library refuses the version header "gloas". #3009). ForkAtEpoch resolves Gloas from GLOAS_FORK_EPOCH on (no more Fulu cap, in both the node and ssvsigner), so attestations ride gloas.Attestation and the aggregator-committee consensus data stamps DataVersionGloas — the SIP §2 byte-parity stamp Anchor uses (ePBS/Gloas: stamp DataVersionGloas into AggregatorCommitteeConsensusData.Version (drop the Fulu-cap workaround) #2998). This relies on ssv-spec's Gloas arms building the Gloas containers (on the dynssz branch, ssv-spec#643, vectors regenerated); with the Electra-reusing arms the fork's submit path would reject the attestations.
• §3 PTC attestation — full slice — goclient endpoints; PTCAttesterRunner (no consensus, partial-signature only, honest convergence over the frozen 75%-cutoff observation, abstains when no block is seen); scheduler handler firing at the cutoff; duty store + message validation; ekm signing.
• §4 Gloas block proposal — produce/publish via the merged beacon-APIs endpoints (v4 produce, include_payload=true); the QBFT value is GloasProposalData{block, payload_root} — the bid-only block (no blinding) plus the self-build payload_root (see §6) — bound to the running duty's slot (the value check, re-run on the decided value, and post-consensus validation); every operator submits the decided block (BN dedupes by root — to be re-confirmed on a Gloas BN); slashing-protected local signing (check→record→sign under a dedicated lock); build-source telemetry; new ProposerDelayEPBS knob (hard-capped at 1s, no dangerous override).
• §5 Proposer preferences — one duty per upcoming proposal slot across the lookahead, with the next epoch's emitted from slot 15 of the current one (the MIN_SEED_LOOKAHEAD pre-fork emission included); a multi-slot dispatcher runner (honest convergence over fee recipient / target gas limit / dependent_root, singleflighted dependent_root fetch); message validation with a future-slot allowance and a bounded distinct-root dedup (admitting dependent_root re-emissions), its state kept for the role's whole acceptance window; ValidatorRegistration is deprecated at the fork (rejected wire-side, drained scheduler-side, and every registration is ignored from the epoch after the fork, so pre-fork partials can't be replayed).
• §6 Execution-payload envelope (self-build only) — no QBFT instance of its own. The §4 decided value is GloasProposalData{block, payload_root}; the value check pins the version to the slot's fork, the block's slot and proposer to the duty, and payload_root != 0 exactly when builder_index == SELF_BUILD. On the self-build path every operator derives the blinded envelope from the decided value alone and signs its root under DomainBeaconBuilder as the second entry of the block's post-consensus packet (the block root under DomainProposer is the required first entry; §7 caps the packet at two entries on Gloas slots). Receivers match entries by signing root, each expected root at most once, and reconstruct each root independently from the same 2f+1 shares as the block; the envelope is published only once this operator has attempted the block submit (a beacon node ignores an envelope whose block it hasn't seen), even when the envelope's quorum forms first; a failed submit doesn't hold it back, as other operators submit the block too (ssv-spec does the same). Only the operator whose beacon node produced the decided block holds the payload — its produced envelope's blinded root must equal the derived root (builtDecidedEnvelope) — and it alone publishes the full SignedExecutionPayloadEnvelope; the other operators contribute their envelope share and nothing else. The proposer keeps accepting the duty slot's post-consensus packets after the block has been submitted (awaitingEnvelope), so late envelope shares still count. The reveal data (payload, blobs, proofs) is released as soon as this operator can no longer publish it — another operator's block decided, the reveal attempted, or a terminal failure before it — while a failed block submit keeps it for the envelope quorum that may still follow; a duty that never concludes holds it until the next proposal (#3043). Publication is due by PAYLOAD_DUE_BPS = 50% of the slot — consensus-specs#5414 lowered it 75%→50% (§3 PTC's PAYLOAD_ATTESTATION_DUE stays 75%).
• ePBS/Gloas: external-builder authentication & per-builder bid preferences — design & implementation plan #2962 — direct-builder request auth + overlay (opt-in) — the threshold BuilderRequestAuth{data, proposal_slot} signing (builder-specs DOMAIN_BUILDER_REQUEST_AUTH, genesis-style) rides the §5 dispatcher: per configured builder — Builders cluster config in keymanager-APIs#88 vocabulary, validated at startup, required identical across all n operators — one RequestAuthPartialSig packet per proposal slot carrying a partial per distinct auth root (1 to 8 entries; AuthData defaults to the URL's hostname per builder-specs#168), collected entry by entry in a dedicated container with no succeeded-gate, reconstructed into a per-validator auth cache. Message validation admits the new type under role 8 with its own distinct-root budget: a packet that adds no new root, or would take its signer past the budget, is IGNOREd (SIP §7). Sub-quorum degrades silently to the enshrined flow — never blocks the proposal; reconstructions and auth-unavailable are counted, and the §4 build-source telemetry is a typed enum. The upstream specs this was written against have merged and the branch is reconciled to them (builder-specs#165 renames; keymanager-APIs#88 supersedes validate change round justification signer uniqueness like we do in regular agg. messages #87; beacon-APIs#630 supersedes Verify signed message with domain #625), and phases 2–3 are implemented here: the produceBlockV4 POST attach with the Eth-Builder-Url block-forwarding echo (§4), and the BN-mediated ahead-of-time submitBuilderPreferences — both e2e-gated on a Round Timer Fix #630 beacon node. Design record: #2962 — closed, its three phases being implemented here; its remaining tails are tracked in the checklist below, ssvlabs/aetheria#173 and #3000.
• Riding along (not Gloas-specific) — duty-fetch retry when no validators are eligible yet (attester/proposer/sync-committee handlers); scheme-less beacon-address normalization; zero-registry-address guard in SSVConfigByName; GetStateRoot nil-state guard; runner-state JSON dedup; a bad partial signature in a quorum no longer fails the duty, in any runner: the fallback drops it, the next honest share completes the duty, and a root still at quorum after the drop is retried at once. The sync-committee-contribution runner also no longer drops the other subnets over one bad root, from consensus or from submission.
• Exporter cleanup (unrelated tagalong) — removed a dead vendor/ sszgen directive; documented that exporter/model_encoding.go is hand-maintained.

Validation — hermetic Gloas devnet (local_testnet_gloas)

Validated on a hermetic Gloas devnet (geth/lighthouse glamsterdam-devnet-6, lighthouse v8.2.0-36b70da, Gloas fork @ epoch 2), read from Loki node logs + the beacon API. Suites: ssvlabs/aetheria#130 (proposer, §4/§5/§6) + #128 (ptc, §3).

§	Duty	Status
§2	Attestation	✅ works
§2	Aggregation	🔁 Gloas arms landed (#3009 / #3021); Aetheria re-run pending
§3	PTC (payload attestation)	✅ works post-fork
§4	Proposer block	✅ works — publication passes; proposed block canonical on-chain
§5	ProposerPreferences	✅ works — emit → submit, 0 errors; POST …/validator/proposer_preferences → 200
§6	Execution-payload envelope	✅ publishes + lands on Lodestar v1.43.0 (#2921 — full/unblinded body); residual all-publish dedup on the shared-BN devnet → #2923

The node's ePBS implementation is spec-correct — §2–§5 are confirmed working on-chain, and §6 publishes and lands on Lodestar v1.43.0 (the live devnet-6 CL). §6 produce is missing in lighthouse v8.2.0 (a generic beacon-APIs#580 404) but works on Lodestar. #2921 now publishes the full/unblinded envelope (SignedExecutionPayloadEnvelopeContents), which Lodestar accepts — the earlier 400 "Offset out of bounds" (blinded body) is gone and the envelope lands on-chain. #2922 makes the all-operators §4 submit handle Lodestar's 500 BLOCK_ERROR_ALREADY_KNOWN as success (the "BN dedupes by root" assumption doesn't hold on Lodestar; the block still lands). Residual: on the devnet §6 showed the same all-publish dedup as §4 — every operator published the identical envelope, so the redundant ones hit 500 EXECUTION_PAYLOAD_ENVELOPE_ERROR_ALREADY_KNOWN (the §6 analog of #2922, tracked in #2923). That only holds because the devnet's operators share one beacon node, which produces the same envelope for all of them; with a beacon node per operator only the builder holds the payload and publishes; the other operators contribute their envelope shares and nothing else (see §6 above) — a topology not yet exercised end to end. E2E-verify context in #2920 (V1/V2/V6 — resolved there; the issue is closed, see the e2e strategy below). (§3 also shows a transient pre-fork 500 IncorrectStateVariant on lighthouse's PTC-duties lookahead, self-clearing once the head crosses the fork.)

E2E strategy. The hermetic Aetheria local_testnet_gloas net above is the ePBS proving ground, and public-network e2e rides the Sepolia/Hoodi Gloas forks on the existing SSV deployments there — GLOAS_FORK_EPOCH is read from the BN at runtime, so no new networkconfig is needed. A dedicated SSV cluster on the public glamsterdam devnet was considered and dropped: standing up a fresh SSV environment (contract deploy, registry bootstrap, operator onboarding) buys little over those two paths. #2920 is closed accordingly, its remaining verify items split across the successors: the manual Sepolia fork log-check (#2953), the node-design verification items V5/V8/V9/V11 (#2954), the Aetheria harness on Hoodi post-fork (ssvlabs/aetheria#139), and automated fork-transition coverage (ssvlabs/aetheria#141). The GlamsterdamDevnet networkconfig stub has been dropped from the branch accordingly (the zero-registry-address guard it motivated in SSVConfigByName stays).

Known limitations / deferred

• Remote signing (Web3Signer): no request types for the four new domains (incl. ePBS/Gloas: external-builder authentication & per-builder bid preferences — design & implementation plan #2962's request auth) and no Gloas block path — remote-signing operators fail those duties (bounded: the cluster reconstructs while ≤ f operators are remote). Remote fork_info now carries the Gloas fork so every other remote duty signs under the correct domain (whether that alone satisfies a live Web3Signer is an e2e-confirm — #2954 (V11)). Deferred §4 fix direction: pass the block header (HTR-equal to the block, nameable across the module boundary) instead of the Gloas block; whether Web3Signer accepts a Gloas-version block request is unverified.
• §5 publish-finality: preferences publish on quorum with no hold-until-final guard, so a preference published just before a reorg shifts its dependent_root is not retracted. Re-emission itself now works — message validation admits up to N=4 distinct signing roots per (slot, signer) and the scheduler re-emits only on a real dependent_root change (the now-agreed SIP-94 §5 rule, still to be matched by Anchor). Only the pre-publish finality hold stays deferred. Low severity (reorg-gated, §5 is observational).
• Upstream-gated: the Gloas endpoints are hand-rolled HTTP — the repinned go-eth2-client fork now ships typed calls for the PTC and envelope endpoints (moving onto them is a follow-up) but none for proposer/builder preferences or the proposer-duties dependent_root, and its ePBS proposal call is the pre-Round Timer Fix #630 GET with no BuilderConfig body or Eth-Builder-Url echo; DataVersionGloas aliases the fork's spec.DataVersionGloas, ForkAtEpoch resolves it, and the aggregator consensus data stamps it (ePBS/Gloas: stamp DataVersionGloas into AggregatorCommitteeConsensusData.Version (drop the Fulu-cap workaround) #2998 — done on the branch). ssv-spec's Gloas arms (GetAggregateAndProofs/GetAggregateAndProofHashRoot, the reference constructor, the attestation helpers) switch from the Electra container to the fork's Gloas one on the dynssz branch (ssv-spec#643), which both go.mods pin; what remains for ePBS/Gloas: stamp DataVersionGloas into AggregatorCommitteeConsensusData.Version (drop the Fulu-cap workaround) #2998 is the Anchor byte-parity check; eth2-key-manager purpose-named root signer.

Merge & follow-up checklist

Merge blockers — to clear before this PR lands on stage:

• Land the outstanding ePBS/Gloas: external-builder authentication & per-builder bid preferences — design & implementation plan #2962 review fixes on the branch: the stash-replay gate on re-emission (hasDutyRunning → hasDutyAssigned), domain-fetch hard-fail, and minor polish
• ssv-spec's Gloas container arms for the §2 aggregate and attestation landed on the dynssz branch (ssv-spec#643) → both go.mods pin the same build of it (its head as of 24 Sep; Use round-robin leader selector #643 has since been rebased, see the re-pin below). Required pairing: with the previous pin's Electra-reusing arms, the node's ForkAtEpoch Gloas resolution would make attestation submits fail on Gloas slots.
• SIP-94 conformance fixes tracked in #3050 (its done list): the attestation-data refetch deadline, batched request auths, the hostname auth default, the reveal after the block, preferences-state retention, the spec's running-slot binding / PTC observation / duplicate-root fixes, the go.mod re-pin, and post-fork registration replays
• ssv-spec#632, ssv-spec#633 and ssv-spec#643 merge (each builds on the one before) and a release is tagged → re-point both go.mods at the tagged ssv-spec (today they pin a 24 Sep build of ssv-spec#643, which carries the ePBS/Gloas: external-builder authentication & per-builder bid preferences — design & implementation plan #2962 request-auth constants and no longer defines an envelope role). → Post-merge: tracked in go.mod: re-pin ssv-spec to the ssv-spec#643 head, then to the tagged release #3086.
• Re-pin both go.mods to the current ssv-spec#643 head (#3050 item 1): the 24 Sep build is off-branch since Use round-robin leader selector #643's 25 Sep rebase. The head also adds the spec's U+0130 rule for the default builder auth data, which the node derives through the spec → Post-merge: tracked in go.mod: re-pin ssv-spec to the ssv-spec#643 head, then to the tagged release #3086.
• Resolve the 8 unresolved review threads (#3050 item 2). Each already has a reply and the fix is on the branch, but stage requires every review thread resolved before merge → Done: all 23 threads resolved before merge.
• Boole lands on stage → move the ePBS commits onto stage — done: Boole landed via the integration/boole-convergence merge (so the merge-base was already on stage and a plain rebase sufficed), and the branch is rebased onto the latest stage tip (136 commits, linear; 134/136 patches byte-identical per range-diff, two mechanical conflict resolutions in committee.go/aggregator.go) — and re-rebased onto the current stage tip after the review round (one import-block conflict in aggregator_committee.go), then again once validator: purge a queue's stale messages when an idle runner starts a duty #3039–qbft: give up at the role's round cap instead of the cluster-wide cutoff #3041 landed (180 commits, 173 patches byte-identical per range-diff; the round-cap table and the queue consumer's stale-message floor reconciled with the branch's Gloas roles, the multi-slot preferences dispatcher kept off the floor)
• Re-run the Aetheria local_testnet_gloas suites (proposer + ptc) after the rebase and after each boole-fork refresh

Tracked follow-ups (not merge blockers):

• E2E verify — the ePBS devnet e2e — glamsterdam-devnet (SIP-94, #2901) #2920 successors (that issue is closed; no dedicated SSV cluster on the public glamsterdam devnet, see the e2e strategy under Validation): manual Sepolia fork log-check #2953; node-design verification items V5/V8/V9/V11 #2954; Aetheria harness on Hoodi post-fork ssvlabs/aetheria#139; automated fork-transition coverage ssvlabs/aetheria#141. The hermetic local net is done & green — ssvlabs/aetheria#125.
• Builders-configured local_testnet_gloas run — gauge the re-broadcast cost (a restart mid-lookahead re-broadcasts every auth root, which peers IGNORE as recorded; once ePBS (#2901): SIP-94 conformance fixes and follow-ups #3050 item 3 lands, so does every re-emission) and the request-auth reconstruction telemetry — the overlay's suite coverage, the beacon-APIs#630-gated half included, is ssvlabs/aetheria#173; that gate lifted with ChainSafe/lodestar#9832 merging
• #3050 open items. Re-audited against ssv-spec#643 and SIP-94 on 25 Sep, with no consensus-critical divergence found. Open: §5 re-emission re-broadcast, aligning the node with the SIP and ssv-spec (item 3); the error codes and §5 round order the spec vectors assert (item 4); the ePBS/Gloas: map ssv-spec's Gloas runner/committee spec vectors onto the node's mapping suites #3017 mapping scope (item 5); the fork stamp, the §6 envelope publish retry and proposer running-slot parity (items 6–8); SIP-94 wording, raised on SIPs#94 and waiting on the SIP author (item 9); the cleanups (items 10–12)
• Fork schedule at startup (#3051) — take the newest compatible fork schedule across clients rather than the first client's, so a restart during a staggered client upgrade no longer depends on which client connects first
• Produce telemetry method label — GetGloasBeaconBlock counts a per-node GET fallback (a pre-Round Timer Fix #630 beacon node) under the POST label (noted at the call); thread the method actually used into the label, or let it go with the GET fallback's removal (moved here from ePBS/Gloas: external-builder authentication & per-builder bid preferences — design & implementation plan #2962) → Fixed in goclient: record a Gloas produce GET fallback as its own request #3083.
• Cross-client / upstream: re-check the §5/§6 wire constants against Anchor once it implements them (PTC already verified against sigp/anchor) — now also RequestAuthPartialSig(9)/DomainBuilderRequestAuth and the role-8 dual-type validation rule; run a computational SSZ/HTR cross-check (incl. the EIP-8282 five-list ExecutionRequests) once canonical Gloas spec vectors exist. The node-vs-ssv-spec cross-check already matches byte for byte and root for root on the devnet-8 block and envelope, a non-empty five-list ExecutionRequests, and the small containers (ePBS (#2901): SIP-94 conformance fixes and follow-ups #3050 audit, 25 Sep) → Tracked in ssvlabs/aetheria#180 (Anchor constants incl. the request-auth pair and the role-8 rule, and the SSZ/HTR vector cross-check); the aggregator byte-parity check is ePBS/Gloas: stamp DataVersionGloas into AggregatorCommitteeConsensusData.Version (drop the Fulu-cap workaround) #2998.
• §6 on separate beacon nodes — run a topology with a beacon node per operator (the hermetic devnet shares one BN, so every operator produced the same envelope there): confirm that only the builder operator publishes the envelope, that a non-builder's envelope produce fails or mismatches the decided value as expected, and that the envelope still reconstructs from the other operators' shares. In the same pass, move the PTC and envelope requests onto the go-eth2-client fork's typed calls. → Topology check: ePBS/Gloas §6: verify the envelope flow with one beacon node per operator #3084; typed calls: ePBS/Gloas: adopt go-eth2-client Gloas support (progressive SSZ types + gloas version + transport) #3014.
• Map the spec's Gloas runner/committee vectors onto the node (#3017) — 15 Gloas runner vectors are skipped and 674 Gloas subtests are filtered out of multi-tests under gloasSpecRunnerSkipReason (the Gloas valcheck vectors already run against the node's real checkers). Not a merge blocker, by decision; recommended before Gloas is scheduled on a public network. The node-side deltas to reconcile first are ePBS (#2901): SIP-94 conformance fixes and follow-ups #3050 items 3–5. Natural to do together with the ssv-spec tag repoint above
• ePBS/Gloas: external-builder authentication & per-builder bid preferences — design & implementation plan #2962 phases 2–3 — implemented on this branch: the produceBlockV4 GET→POST attach (the BuilderConfig body assembled from config + the per-slot auth cache, Eth-Builder-Url block-forwarding echo gated by the §6-style owner-match, per-node GET fallback) and the BN-mediated ahead-of-time submitBuilderPreferences (reuses the reconstructed auth, all-operators submit). E2E gated on a beacon node shipping beacon-APIs#630 (ChainSafe/lodestar#9832 merged on 27 Aug); the GET fallback keeps older beacon nodes working.
• Flip §4 produce to POST-first (beacon-APIs#630 POST) — done: produce always POSTs a BuilderConfig body (the direct-builder overlay when configured, else a neutral local-build config — builders: [], builder_boost_factor 100); the per-node GET fallback stays for pre-Round Timer Fix #630 nodes (only on a 404/405). Round Timer Fix #630 merged and Teku went POST-only, so this became a live bug (reported in produceBlockV4 must use the POST method and send a BuilderConfig body #3002), not just a future risk.
• MEV knobs: docs/MEV_CONSIDERATIONS.md ePBS rewrite (config.example.yaml already points readers there for ProposerDelayEPBS); re-evaluate proposals: mev/commit-boost driven MEV flow #2855 (ProposalSoftDeadline) against the tighter 25% proposal deadline once ePBS lands — decision + rationale recorded on proposals: mev/commit-boost driven MEV flow #2855. → Rewrite: docs: ProposerDelayEPBS guidance under the 3s Gloas attestation deadline #3058; proposals: mev/commit-boost driven MEV flow #2855 re-evaluation: ePBS/Gloas: re-evaluate ProposalSoftDeadline (#2855) against the 25% Gloas proposal deadline #3085.
• §5 publish-finality — re-emission (N=4 distinct-root dedup + dependent_root-gated re-emit) is implemented; only the pre-publish finality hold remains deferred (low severity). Anchor still to match the §5 validation rule. → Tracked in ePBS/Gloas §5: read the proposer-preferences fee recipient as of a per-epoch cutoff, so operators don't split on an update #3072.
• ssv-spec: pin the Gloas block's proposer index to the duty's validator index in the value check (ssv-spec#647) — landed on ssv-spec#643's head, whose fixture block now carries the duty's validator; the node pins it too.
• Deferred code refinements: assert the Eth-Consensus-Version response header on Gloas produce; unify the hand-rolled JSON/SSZ HTTP helpers (shared httpDo core + a single httpStatusError); reuse the shared Gloas test-block fixture in the goclient proposer tests.

[greptile-apps]

Greptile Summary

This PR adds the node-side foundation for ePBS/Gloas. The main changes are:

• New Gloas wire types and SSZ/JSON encoders.
• Beacon API clients for PTC, proposer preferences, Gloas blocks, and envelopes.
• Fork gating and Glamsterdam devnet configuration.
• PTC, ProposerPreferences, and EnvelopeBuilder runner wiring.
• Local signer support for the new Gloas domains.

Confidence Score: 4/5

The Gloas message validation and block production paths need fixes before merging.

• First-fork ProposerPreferences messages can be rejected during the intended lookahead window.
• Valid payload-included Gloas block responses can fail to decode and skip proposal work.
• The new runner and type surfaces otherwise look consistent with the inspected changes.

message/validation/signed_ssv_message.go; beacon/goclient/gloas_proposer.go

Important Files Changed

Filename	Overview
message/validation/signed_ssv_message.go	Adds fork-aware role validation for new Gloas roles, but ProposerPreferences does not account for the intended prior-window broadcast.
beacon/goclient/gloas_proposer.go	Adds Gloas block produce and publish clients, but produce response handling only supports the bare block variant.
protocol/v2/types/gloas	Adds node-side Gloas wire structures with generated SSZ support and round-trip tests.
protocol/v2/ssv/runner	Adds PTC, proposer-preferences, envelope, and Gloas proposer runner paths.
operator/duties	Adds duty handlers and scheduler wiring for PTC and ProposerPreferences.

_{Reviews (1): Last reviewed commit: "gloas: log §2 vote index + §5 proposer-p..." | Re-trigger Greptile}

[iurii-ssv]

The ePBS validation log that lived in this comment has been moved into the PR description (the Validation section) — so it sits alongside the implementation summary and is easy to find. This comment is kept only as a pointer.

[momosh-ssv]

amazing, gj!