Add Autobahn fullnode (CON-309)

[wen-coding]

Summary

Adds a non-validator fullnode role to Autobahn. A fullnode loads the committee from autobahn.json as a routing table, dials a single committee member at a time over giga to pull finalized blocks (StreamFullCommitQCs + GetBlock), and runs the local runExecute loop.

Role is decided by committee membership, not by mode: the node provides its local validator key, and the giga setup picks NewGigaValidatorRouter iff that key is in autobahn.json. Otherwise it starts as a fullnode (logger.Info "Autobahn: ... starting as fullnode"). cfg.Mode is intentionally not consulted for the autobahn role — operators don't need a separate flag that could desync from the on-chain committee. The remote-signer-not-supported check moved alongside the dispatch so a fullnode-by-virtue-of-not-being-in-committee isn't penalised for having priv-validator.laddr set.

Type split. GigaRouter is now built by two separate constructors:

• NewGigaValidatorRouter(*GigaValidatorConfig, ...) — committee members. Embeds the common config and adds ValidatorKey, ViewTimeout, Producer, TxMempool, MaxInboundFullnodePeers. Runs consensus + producer + the full giga service, accepts inbound peers.
• NewGigaFullnodeRouter(*GigaFullnodeConfig, ...) — non-validators. Embeds the common config only. No consensus, no producer, no mempool. Pulls blocks via a single-active-subscriber dial loop (shuffled committee, exponential backoff capped at 5 min, time-since-healthy gate).

Validator-only operations (RunInboundConn) live on *gigaValidatorRouter and are reached via in-package type assertion at the router-inbound handshake site — the GigaRouter interface intentionally exposes only the read path (Run, LastCommittedBlockNumber, MaxGasPerBlock, BlockByNumber, BlockByHash, EvmProxy), so calling a validator-only method on a fullnode is a compile error rather than a runtime error-return.

EVM tx writes. eth_sendRawTransaction is sender-shard-mapped via Committee.EvmShard and forwarded over HTTP to the shard owner. Every committee member must expose an evmrpc URL on both validator and fullnode paths — NewGigaXxxRouter rejects configs where any URL is missing so the silent-drop branch of EvmProxy is unreachable in production. Validators short-circuit on their own shard to local mempool; fullnodes always forward.

Inbound rpc-peer admission. Validators serve the full giga RPC to committee peers and the block-sync subset (StreamFullCommitQCs + GetBlock only) to non-committee peers, capped per-validator by autobahn-max-inbound-fullnode-peers (default 10; set 0 to reject all inbound fullnode block-sync; *int pointer in TOML so absent and explicit-zero are distinguishable). The cap is an atomic.Int32 counter on the hot path.

LastCommittedBlockNumber reports executed height. Both validator and fullnode read a single lastExecutedBlock atomic.Int64 updated after every executeBlock commit, matching CometBFT /status semantics — clients querying receipts at the reported height never see a height the app hasn't reached.

Config. autobahn-config-file and autobahn-max-inbound-fullnode-peers are top-level TOML keys (placed above any [section] header so viper sees them at root scope where mapstructure expects). PersistentStateDir is rootified against the node's --home dir, matching how cometbft handles relative paths elsewhere.

Note: fullnode-to-fullnode mesh (bidirectional block sync between non-validators) is deferred to a follow-up PR — fullnodes here are pull-only against committee members.

Test plan

• gofmt -s + go vet clean
• go test ./sei-tendermint/internal/p2p/... ./sei-tendermint/config/... ./sei-tendermint/node/... pass
• make autobahn-integration-test: the whole client-facing EVM flow (balance / chainId / nonce / send / receipt) runs through a fullnode sidecar that catches up via giga and forwards writes; halt/liveness/permanent-fault scenarios verified by polling helpers against the fullnode's CometBFT RPC.
• CI green

🤖 Generated with Claude Code

[cursor]

PR Summary

High Risk
Large consensus/P2P/RPC surface (router split, block execution, EVM proxy, status height semantics) with new integration paths; mistakes affect liveness, forwarding, and client-visible chain height.

Overview
Introduces an Autobahn fullnode path so non-committee nodes can sync finalized blocks from validators, execute them locally, and forward EVM writes to the correct shard owner—without running consensus or block production.

GigaRouter split: NewGigaValidatorRouter vs NewGigaFullnodeRouter, with role chosen by committee membership (local key in autobahn.json), not mode. Fullnodes use a single-active giga block-sync subscriber; validators cap inbound fullnode block-sync peers (autobahn-max-inbound-fullnode-peers, default 10) and serve block-sync-only RPC to non-committee peers. LastCommittedBlockNumber now tracks app-executed height on both paths.

Config & ops: autobahn-config-file moved to top-level TOML (with tests); RPC init waits for genesis and can gen Autobahn config when AUTOBAHN=true. Docker/Makefile use DOCKER_PLATFORM and pass AUTOBAHN / CLUSTER_SIZE to the rpc node.

CI & tests: New autobahn-integration-tests workflow job (make autobahn-integration-test); integration suite boots an rpc fullnode sidecar, polls height via CometBFT RPC (26669), and exercises halt/liveness/recovery and EVM forwarding.

^{Reviewed by Cursor Bugbot for commit b8e9d21. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 3, 2026, 12:52 PM

[codecov]

Codecov Report

❌ Patch coverage is 51.71103% with 127 lines in your changes missing coverage. Please review.
✅ Project coverage is 58.23%. Comparing base (2151ba0) to head (b8e9d21).

Files with missing lines	Patch %	Lines
sei-tendermint/node/setup.go	40.54%	44 Missing ⚠️
sei-tendermint/internal/p2p/giga_router.go	70.68%	21 Missing and 13 partials ⚠️
...ei-tendermint/internal/p2p/giga_router_fullnode.go	9.09%	30 Missing ⚠️
sei-tendermint/internal/p2p/giga/service.go	40.00%	12 Missing ⚠️
sei-tendermint/internal/p2p/giga/data.go	62.50%	0 Missing and 3 partials ⚠️
sei-tendermint/internal/p2p/router.go	66.66%	1 Missing and 1 partial ⚠️
sei-tendermint/node/node.go	50.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3525      +/-   ##
==========================================
- Coverage   59.12%   58.23%   -0.90%     
==========================================
  Files        2213     2141      -72     
  Lines      182814   174592    -8222     
==========================================
- Hits       108096   101673    -6423     
+ Misses      64993    63860    -1133     
+ Partials     9725     9059     -666     

Flag	Coverage Δ
sei-chain-pr	61.82% <51.71%> (?)
sei-db	70.41% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
sei-tendermint/config/config.go	73.17% <ø> (ø)
sei-tendermint/config/toml.go	55.00% <ø> (ø)
sei-tendermint/internal/p2p/routeroptions.go	81.25% <ø> (ø)
sei-tendermint/internal/rpc/core/env.go	76.15% <100.00%> (ø)
sei-tendermint/internal/p2p/router.go	90.03% <66.66%> (-0.04%)	⬇️
sei-tendermint/node/node.go	65.46% <50.00%> (+0.08%)	⬆️
sei-tendermint/internal/p2p/giga/data.go	68.53% <62.50%> (ø)
sei-tendermint/internal/p2p/giga/service.go	74.46% <40.00%> (-25.54%)	⬇️
...ei-tendermint/internal/p2p/giga_router_fullnode.go	9.09% <9.09%> (ø)
sei-tendermint/internal/p2p/giga_router.go	67.30% <70.68%> (-2.46%)	⬇️
... and 1 more

... and 101 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pompon0]

I wonder if these really are intended to be independent, or we can have just serverStartSignal channel that is closed via evmRPCReadyOnce. Optionally, note that you can wrap evmRPCReadyOnce and serverStartSignal into one sei-tendermint/libs/utils.Once object.

[wen-coding]

We don't need to touch app.go now we are doing read side.

[pompon0]

nit: shouldn't this be conditioned on the presence of the validator key instead?

[wen-coding]

done

[pompon0]

if GigaRouter is supposed to support both modes, all the validator-only fields should be put into an utils.Option section of the GigaRouter struct.

[wen-coding]

done

[pompon0]

the pattern of returning dummy values depending on the mode is not type-safe. Neither is returning errors in case the mode is incompatible. For example, instead, you can create a wrapper type sth like GigaValidatorRouter{}, and a cast method: GigaRouter.AsValidator() Option[GigaValidatorRouter], and move all validator-only methods there. This is just an example, there are probably other safe patters available as well. The general idea is to conditionally provide a wider role-specific interface, instead of custom mismatch handling in each method.

[pompon0]

"return nil" would be totally fine. There is no obligation for Run to block if it has nothing to do.

[pompon0]

I might be misunderstanding the goal here, but if the point is to support just RPC forwarding endpoint, then it should not create GigaRouter (and App?) at all. If this is a stop gap measure until we support full-nodes - nodes actually processing blocks, then I'd like to understand why we cannot implement it rn (i.e. skip the stop gap).

[pompon0]

Option

[pompon0]

can we stick to fullnode name instead of RPConly? This is the naming in tendermint and afaik also the industry standard (I might be wrong)

[pompon0]

fullnodes are not supposed to have mempool

[pompon0]

fullnodes should not need consensus config (they need committee, but that's currently derived from ValidatorAddrs anyway).

[pompon0]

I think we should require all urls in both validator and fullnode modes by now. I have added a fallback to local mempool just for the sake of easier tests, but with fullnode in the picture it won't help with anything anymore.

[pompon0]

return error?

[pompon0]

non-validator connections are supposed to create a mesh therefore:

• non-validator nodes should also have both inbound and outbound connections
• blocksyncing should be allowed in both directions by default (that's why I didn't want to restrict sending blocks from non-validators -> validators for now, we can add this as a separate feature).

[wen-coding]

That's right, it would be more like a tree, but I agree that they do need both inbound and outbound connections, I just didn't want to do that in this one PR, because this PR would be too big. But maybe we should keep poolIn and poolOut.

[pompon0]

fyi, the giga.Pool concept was supposed to support attaching custom tasks within the lifetime of each connection, but it does complicate stuff and the fancy features are unused by now, so soon I think I'll simplify it, unless a use case arises somewhere.

[pompon0]

https://pkg.go.dev/golang.org/x/sync/semaphore ?

[pompon0]

nit: let's push this default outside of p2p to config/config.go and require a concrete number in giga_router.go

[pompon0]

how about we have separate constructors and separate config types? I suspect it may make the code less cluttered.

[pompon0]

gigaFullNodeConfig may be embedded in gigaValidatorConfig, for example.

[pompon0]

nit: scope by design is not supposed to be passed to subroutines if avoidable, because ctx is strictly bound to scope, while it is not possible to enforce this relation in the function signature. In this case it should be perfectly fine to implement runReadPath() which uses scope internally.

[pompon0]

make Key optional in handshake.

[pompon0]

nit: here you don't even need a blocking semaphore, just atomic update on pool size would be good enough.

[pompon0]

shouldn't this be common?

[pompon0]

if the only purpose of IsRPCOnly is to guard type cast, then it is not useful.

[pompon0]

do we really need those non-nil checks?

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bf1f20f. Configure here.}

[cursor]

Genesis wait never fails script

Medium Severity

After the five-minute poll, if build/generated/genesis.json is still missing, the script continues and cp fails, but without set -e initialization may proceed with no valid genesis instead of exiting clearly.

 

^{Reviewed by Cursor Bugbot for commit bf1f20f. Configure here.}

[cursor]

Hardcoded cluster size four

Low Severity

setupFullnodeNode always passes CLUSTER_SIZE=4 to gen-autobahn-config, while setupCluster discovers the real validator count dynamically. A non-four-node cluster gets a committee JSON that does not match running validators.

 

^{Reviewed by Cursor Bugbot for commit bf1f20f. Configure here.}