CHAIN-3814: Add Multiproofs activation task (Sepolia)

sepolia/.env

@@ -10,13 +10,14 @@ export BASE_SECURITY_COUNCIL=0x6AF0674791925f767060Dd52f7fB20984E8639d8
 export BATCH_INBOX=0xff00000000000000000000000000000000084532
 export BATCH_SENDER=0x6CDEbe940BC0F26850285cacA097C11c33103E47
 export CB_MULTISIG=0x646132A1667ca7aD00d36616AFBA1A28116C770A
-export CHALLENGER=0x8b8c52B04A38f10515C52670fcb23f3C4C44474F
+export CHALLENGER=0xadc09b63a3ac57a2ce86d946617a18df9db029a1
 export INCIDENT_MULTISIG=0x646132A1667ca7aD00d36616AFBA1A28116C770A
-export PROPOSER=0x037637067c1DbE6d2430616d8f54Cb774Daa5999
+export PROPOSER=0xdb84125f2f4229c81c579f41bc129c71b174eb58
 export PROXY_ADMIN_OWNER=0x0fe884546476dDd290eC46318785046ef68a0BA9
 
 # L1 Addresses
 export ADDRESS_MANAGER=0x709c2B8ef4A9feFc629A8a2C1AF424Dc5BD6ad1B
+export AGGREGATE_VERIFIER=0x498313fB340CD5055c5568546364008299A47517
 export ANCHOR_STATE_REGISTRY_PROXY=0x2fF5cC82dBf333Ea30D8ee462178ab1707315355
 export BALANCE_TRACKER=0x8D1b5e5614300F5c7ADA01fFA4ccF8F1752D9A57
 export DISPUTE_GAME_FACTORY_PROXY=0xd6E6dBf4F7EA0ac412fD8b65ED297e64BB7a06E1
@@ -28,11 +29,17 @@ export L1_OPTIMISM_MINTABLE_ERC20_FACTORY=0xb1efB9650aD6d0CC1ed3Ac4a0B7f1D573269
 export L1_PROXY_ADMIN=0x0389E59Aa0a41E4A413Ae70f0008e76CAA34b1F3
 export L1_STANDARD_BRIDGE=0xfd0Bf71F60660E2f608ed56e1659C450eB113120
 export MIPS=0x6463dEE3828677F6270d83d45408044fc5eDB908
+export MULTIPROOF_DELAYED_WETH_PROXY=0xD6e2d9D4f1f8865AC983eE848983fb1979429914
+export NITRO_ENCLAVE_VERIFIER=0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72
 export OPTIMISM_PORTAL=0x49f53e41452C74589E85cA1677426Ba426459e85
 export PDG_DELAYED_WETH_PROXY=0x32cE910d9C6c8F78dc6779c1499aB05F281A054e
 export PERMISSIONED_DISPUTE_GAME_IMPL=0x58bf355C5d4EdFc723eF89d99582ECCfd143266A
 export PREIMAGE_ORACLE=0x1fb8cdFc6831fc866Ed9C51aF8817Da5c287aDD3
+export RISC_ZERO_SET_VERIFIER=0xcb9D14347b1e816831ECeE46EC199144F360B55c
+export RISC_ZERO_VERIFIER_ROUTER=0x925d8331ddc0a1F0d96E68CF073DFE1d92b69187
 export SYSTEM_CONFIG=0xf272670eb55e895584501d564AfEB048bEd26194
+export TEE_PROVER_REGISTRY_PROXY=0xf0d7E15673fBA052e83d7f2b26BB6071E86b972e
+export TEE_VERIFIER=0x92F6dD3501E51B8b20C77b959becaaebeB210e17
 
 # L2 Addresses
 export BASE_FEE_VAULT=0x4200000000000000000000000000000000000019

sepolia/2026-04-20-activate-multiproof/.env

@@ -0,0 +1,53 @@
+BASE_CONTRACTS_COMMIT=ddd5a09e4752707637648ab8d89ef2d2e479ac13
+
+# Multiproof identity and deployment constants.
+# These values are copied from the Zeronet activation task and should be kept in sync
+# with the intended multiproof release for Sepolia.
+GAME_TYPE=621
+TEE_IMAGE_HASH=0x11fb64617dfa2875d31b0cfb656666fd8cee65eb134fefeca171b9b6b4444a64
+ZK_RANGE_HASH=0x08b7a02a5f34c66f5f7ff6e731d881b2385712761d835de3588e00d977fb3a21
+ZK_AGGREGATE_HASH=0x0020f5df94945d8d40bc2b11128cbf2535565f5cde58960029017ee2ccef46d7
+CONFIG_HASH=0x12e9c45f19f9817c6d4385fad29e7a70c355502cf0883e76a9a7e478a85d1360
+
+# Deployment timings and economic parameters.
+# These match the current multiproof release constants used on Zeronet.
+BLOCK_INTERVAL=600
+INTERMEDIATE_BLOCK_INTERVAL=30
+PROOF_THRESHOLD=1
+INIT_BOND=50000000000000000
+PROOF_MATURITY_DELAY_SECONDS=0
+DISPUTE_GAME_FINALITY_DELAY_SECONDS=0
+DELAYED_WETH_DELAY_SECONDS=86400
+
+# TEE roles.
+# Owner is the Sepolia CB multisig. Manager is copied from the Zeronet task and can be
+# updated later if a different Sepolia operator is desired.
+TEE_PROVER_REGISTRY_OWNER=0x646132A1667ca7aD00d36616AFBA1A28116C770A
+TEE_PROVER_REGISTRY_MANAGER=0x8074b32bd7d06c8f27596f3d6fbf867a36ea22a3
+
+# NitroEnclaveVerifier deployment.
+NITRO_INITIAL_MAX_TIME_DIFF_SECONDS=3600
+NITRO_INITIAL_ROOT_CERT=0x641a0321a3e244efe456463195d606317ed7cdcc3c1756e09893f3c68f79bb5b
+RISC0_VERIFIER_ROUTER=0x925d8331ddc0a1F0d96E68CF073DFE1d92b69187
+RISC0_SET_VERIFIER=0xcb9D14347b1e816831ECeE46EC199144F360B55c
+RISC0_SET_BUILDER_IMAGE_ID=0x70909b25db0db00f1d4b4016aeb876f53568a3e5a8e6397cb562d79947a02cc9
+NITRO_ZK_VERIFIER_ID=0x15051db631d6ed382d957c795a558a0abdd00d0d22a1670455721bc2712d3d6e
+NITRO_REVOKER=0x8074b32bd7d06c8f27596f3d6fbf867a36ea22a3
+
+# AnchorStateRegistry bootstrap values for the reinitializer.
+STARTING_ANCHOR_ROOT=0x6c452877ba18e43fecb2a10b5ce458c2da3097f2262f23361659979395208c77
+STARTING_ANCHOR_L2_BLOCK_NUMBER=40307663
+
+# Re-exported for task simulation UI.
+PROXY_ADMIN_OWNER=0x0fe884546476dDd290eC46318785046ef68a0BA9
+L1_PROXY_ADMIN=0x0389E59Aa0a41E4A413Ae70f0008e76CAA34b1F3
+SYSTEM_CONFIG=0xf272670eb55e895584501d564AfEB048bEd26194
+OPTIMISM_PORTAL=0x49f53e41452C74589E85cA1677426Ba426459e85
+DISPUTE_GAME_FACTORY_PROXY=0xd6E6dBf4F7EA0ac412fD8b65ED297e64BB7a06E1
+ANCHOR_STATE_REGISTRY_PROXY=0x2fF5cC82dBf333Ea30D8ee462178ab1707315355
+PROPOSER=0xdb84125f2f4229c81c579f41bc129c71b174eb58
+CHALLENGER=0xadc09b63a3ac57a2ce86d946617a18df9db029a1
+L2_CHAIN_ID=84532
+
+# Validation generation.
+RECORD_STATE_DIFF=true

sepolia/2026-04-20-activate-multiproof/FACILITATOR.md

@@ -0,0 +1,129 @@
+# Facilitator Guide
+
+Guide for facilitators managing this task.
+
+## Finalize task inputs
+
+Before collecting signatures, confirm that the task parameters in `.env` match the intended Sepolia cutover values.
+
+Revalidate `STARTING_ANCHOR_*` against Sepolia before collecting signatures.
+
+## Deployment prerequisites
+
+Before collecting signatures, complete all deploy steps:
+
+```bash
+cd contract-deployments
+git pull
+cd sepolia/2026-04-20-activate-multiproof
+make deps
+make deploy-nitro-verifier
+make deploy-multiproof
+make setup-nitro
+```
+
+There is no `make deploy-cb-multicall` step here because `CBMulticall` is already deployed on Sepolia.
+
+`make deps` also reapplies the local `AnchorStateRegistry` patch so the ASR reinitializer clears the old `anchorGame` pointer and the new `STARTING_ANCHOR_*` values actually take effect after cutover.
+
+`make deploy-nitro-verifier` deploys `NitroEnclaveVerifier` (with the deployer as temporary owner) and wires the RiscZero verify route. Initializes `addresses.json`.
+
+`make deploy-multiproof` deploys the remaining contracts (`TEEProverRegistry`, `DelayedWETH`, `TEEVerifier`, `AggregateVerifier`, etc.). The `TEEProverRegistry` and `DelayedWETH` proxies are initialized at deploy time and their admin is transferred to the L1 `ProxyAdmin`. Appends addresses to `addresses.json`.
+
+`make setup-nitro` configures the `NitroEnclaveVerifier`: sets the `proofSubmitter` to the `TEEProverRegistry` proxy and transfers ownership to `TEE_PROVER_REGISTRY_OWNER`. This step runs directly via the deployer Ledger (no multisig signatures required).
+
+## Generate validation files
+
+```bash
+cd contract-deployments
+git pull
+cd sepolia/2026-04-20-activate-multiproof
+make deps
+make gen-validation-multiproof-cb
+make gen-validation-multiproof-sc
+```
+
+This produces:
+
+- `validations/multiproof-cb-signer.json`
+- `validations/multiproof-sc-signer.json`
+
+## Pre-sign check: `STARTING_ANCHOR_*` correctness
+
+`STARTING_ANCHOR_ROOT` and `STARTING_ANCHOR_L2_BLOCK_NUMBER` are chain-critical.
+Before collecting signatures, verify both values against the target RPC endpoints.
+
+### 1. Validate that the anchor block number is expected
+
+Confirm `STARTING_ANCHOR_L2_BLOCK_NUMBER` matches the planned cutover value.
+
+```bash
+BLOCK=$STARTING_ANCHOR_L2_BLOCK_NUMBER
+cast block $BLOCK --rpc-url $L2_RPC_URL
+```
+
+### 2. Derive output root from that exact block
+
+Use `optimism_outputAtBlock` with the same block and compare to `STARTING_ANCHOR_ROOT` from `.env`.
+
+```bash
+BLOCK=$STARTING_ANCHOR_L2_BLOCK_NUMBER
+OUTPUT_ROOT=$(cast rpc optimism_outputAtBlock $(cast 2h $BLOCK) --rpc-url $OP_NODE_RPC_URL | jq -r '.outputRoot')
+echo $OUTPUT_ROOT
+echo $STARTING_ANCHOR_ROOT
+```
+
+Expected result:
+
+- `OUTPUT_ROOT == STARTING_ANCHOR_ROOT`
+
+### 3. RPC requirements
+
+- `L2_RPC_URL` should point to the target L2 execution RPC.
+- `OP_NODE_RPC_URL` must expose `optimism_outputAtBlock` (typically an OP node RPC).
+- Depending on block age and provider retention, an archive-capable RPC may be required.
+
+## Execute the transaction
+
+### 1. Update repo
+
+```bash
+cd contract-deployments
+git pull
+cd sepolia/2026-04-20-activate-multiproof
+make deps
+```
+
+### 2. Collect signatures for `CB_MULTISIG`
+
+Concatenate all signatures and export as the `SIGNATURES` environment variable:
+
+```bash
+export SIGNATURES="[SIGNATURE1][SIGNATURE2]..."
+```
+
+Then run:
+
+```bash
+SIGNATURES=$SIGNATURES make approve-multiproof-cb
+```
+
+### 3. Collect signatures for `BASE_SECURITY_COUNCIL`
+
+Concatenate all signatures and export as the `SIGNATURES` environment variable:
+
+```bash
+export SIGNATURES="[SIGNATURE1][SIGNATURE2]..."
+```
+
+Then run:
+
+```bash
+SIGNATURES=$SIGNATURES make approve-multiproof-sc
+```
+
+### 4. Execute the multiproof activation batch
+
+```bash
+make execute-activate-multiproof
+```

sepolia/2026-04-20-activate-multiproof/Makefile

@@ -0,0 +1,89 @@
+include ../../Makefile
+include ../../Multisig.mk
+include ../.env
+include .env
+
+SIGNER_TOOL_PATH = ../../signer-tool
+RPC_URL = $(L1_RPC_URL)
+DEPLOYER = $(shell cast wallet address --ledger --mnemonic-derivation-path $(LEDGER_HD_PATH))
+ACTIVATE_MULTIPROOF_SCRIPT_NAME = script/ActivateMultiproofStack.s.sol:ActivateMultiproofStack
+MULTIPROOF_CB_SENDER = $(shell cast call $(CB_MULTISIG) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+MULTIPROOF_SC_SENDER = $(shell cast call $(BASE_SECURITY_COUNCIL) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
+
+.PHONY: apply-patches
+# Reset ASR anchorGame during reinitialize so STARTING_ANCHOR_* takes effect after cutover.
+apply-patches:
+	cd lib/contracts && patch -p1 < ../../patch/asr-reset-anchor-game.patch
+
+.PHONY: deps
+deps: task-extra-deps apply-patches
+
+.PHONY: task-extra-deps
+task-extra-deps:
+	forge install --no-git github.com/base/op-enclave@a2d5398f04c3a8e4df929d58ee638ba4a037bfec
+	forge install --no-git github.com/risc0/risc0-ethereum@a78ac4a52fe9cfa14120c3b496430f0d42e1d8d3
+	forge install --no-git github.com/succinctlabs/sp1-contracts@22c4a47cd0a388cb4e25b4f2513954e4275c74ca
+	git clone --no-checkout https://github.com/OpenZeppelin/openzeppelin-contracts.git lib/openzeppelin-contracts-v5 && \
+		cd lib/openzeppelin-contracts-v5 && git checkout dbb6104ce834628e473d2173bbc9d47f81a9eec3
+	git clone --no-checkout https://github.com/Vectorized/solady.git lib/solady-v0.0.245 && \
+		cd lib/solady-v0.0.245 && git checkout e0ef35adb0ccd1032794731a995cb599bba7b537
+
+##
+# Deployment
+##
+# CBMulticall is already deployed on Sepolia, so this task starts at Nitro deployment.
+.PHONY: deploy-nitro-verifier
+deploy-nitro-verifier:
+ifndef VERIFIER_API_KEY
+	$(error VERIFIER_API_KEY is not set)
+endif
+	forge script --rpc-url $(L1_RPC_URL) script/DeployNitroVerifier.s.sol:DeployNitroVerifier \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast --verify \
+		--verifier custom \
+		--verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) \
+		-vvvv --sender $(DEPLOYER)
+
+.PHONY: deploy-multiproof
+deploy-multiproof:
+ifndef VERIFIER_API_KEY
+	$(error VERIFIER_API_KEY is not set)
+endif
+	forge script --rpc-url $(L1_RPC_URL) script/DeployMultiproofStack.s.sol:DeployMultiproofStack \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast --verify \
+		--verifier custom \
+		--verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) \
+		-vvvv --sender $(DEPLOYER)
+
+.PHONY: setup-nitro
+setup-nitro:
+	forge script --rpc-url $(L1_RPC_URL) script/SetupNitroEnclaveVerifier.s.sol:SetupNitroEnclaveVerifier \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv --sender $(DEPLOYER)
+
+##
+# Activate Multiproof
+##
+
+.PHONY: gen-validation-multiproof-cb
+gen-validation-multiproof-cb: deps-signer-tool
+	$(call GEN_VALIDATION,$(ACTIVATE_MULTIPROOF_SCRIPT_NAME),$(CB_MULTISIG),$(MULTIPROOF_CB_SENDER),multiproof-cb-signer.json,)
+
+.PHONY: gen-validation-multiproof-sc
+gen-validation-multiproof-sc: deps-signer-tool
+	$(call GEN_VALIDATION,$(ACTIVATE_MULTIPROOF_SCRIPT_NAME),$(BASE_SECURITY_COUNCIL),$(MULTIPROOF_SC_SENDER),multiproof-sc-signer.json,)
+
+.PHONY: approve-multiproof-cb
+approve-multiproof-cb: SCRIPT_NAME := $(ACTIVATE_MULTIPROOF_SCRIPT_NAME)
+approve-multiproof-cb:
+	$(call MULTISIG_APPROVE,$(CB_MULTISIG),$(SIGNATURES))
+
+.PHONY: approve-multiproof-sc
+approve-multiproof-sc: SCRIPT_NAME := $(ACTIVATE_MULTIPROOF_SCRIPT_NAME)
+approve-multiproof-sc:
+	$(call MULTISIG_APPROVE,$(BASE_SECURITY_COUNCIL),$(SIGNATURES))
+
+.PHONY: execute-activate-multiproof
+execute-activate-multiproof: SCRIPT_NAME := $(ACTIVATE_MULTIPROOF_SCRIPT_NAME)
+execute-activate-multiproof:
+	$(call MULTISIG_EXECUTE,0x)

sepolia/2026-04-20-activate-multiproof/README.md

@@ -0,0 +1,42 @@
+# Activate Multiproof
+
+Status: [EXECUTED](https://sepolia.etherscan.io/tx/0xb20fcd230ee76842637a508382886aa7596f36dd6fc8f47d147aeab213fbd55d)
+
+## Description
+
+This task deploys and activates multiproof on `sepolia`.
+
+It follows the same fresh-deploy + multisig activation flow as the Zeronet task, but deploys directly from the newer `BASE_CONTRACTS_COMMIT` so we do not need a separate follow-up upgrade task for the Nitro/TEE changes.
+
+`CBMulticall` is already deployed on Sepolia, so this task starts directly at the Nitro deployment step.
+
+Before collecting signatures, verify that the task parameters in `.env` match the intended Sepolia cutover values.
+
+## Procedure
+
+## Sign Task
+
+### 1. Update repo
+
+```bash
+cd contract-deployments
+git pull
+```
+
+### 2. Run the signing tool
+
+```bash
+cd contract-deployments
+make sign-task
+```
+
+### 3. Open the UI at [http://localhost:3000](http://localhost:3000)
+
+- Select the correct signer role from the list of available users to sign.
+- After completion, close the signer tool with `Ctrl + C`.
+
+### 4. Send signature to facilitator
+
+Copy the signature output and send it to the designated facilitator via the agreed communication channel.
+
+For facilitator instructions, see `FACILITATOR.md`.

sepolia/2026-04-20-activate-multiproof/addresses.json

@@ -0,0 +1,12 @@
+{
+  "nitroEnclaveVerifier": "0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72",
+  "teeProverRegistryImpl": "0xF9Ab55c35cE7Fb183A50E611B63558499130D849",
+  "teeProverRegistryProxy": "0xf0d7E15673fBA052e83d7f2b26BB6071E86b972e",
+  "teeVerifier": "0x92F6dD3501E51B8b20C77b959becaaebeB210e17",
+  "delayedWETHImpl": "0xbbFDB04121B74D8ae7F53fD5238DDEf133AB977a",
+  "delayedWETHProxy": "0xD6e2d9D4f1f8865AC983eE848983fb1979429914",
+  "aggregateVerifier": "0x498313fB340CD5055c5568546364008299A47517",
+  "optimismPortal2Impl": "0x45fA7cFfa725e238a46a35fdE9F339b63fDEDBdD",
+  "disputeGameFactoryImpl": "0xE7f2E3C6286375C102e482c0Aa2385D8bAAcac26",
+  "anchorStateRegistryImpl": "0xb1CC9F8422042eDA9EB36A408002517d7c772Ac7"
+}