feat: autoclaim L1 -> L2

[arnaubennassar]

🔄 Changes Summary

• Adds an opt-in autoclaim Aggkit component for L1 -> L2 bridge claims. It discovers eligible exits from l1bridgesync, persists request/cursor/attempt state, prepares claim proofs with l1infotreesync plus a per-claimer l2gersync, submits claimAsset / claimMessage transactions through EthTxManager, and tracks requests through confirmation or failure.
• Adds per-destination claimers with named policies: allow-all, api-approve, no-message, and basic-filter.
• Adds optional Auto Claim REST endpoints under /autoclaim/v1 for request listing, inspection, manual approval, and manual rejection, with generated Swagger docs.
• Wires Auto Claim into startup through the new autoclaim component, config loading/validation/defaults, docs, mocks, and the OP e2e environment.
• Hardens the bridge-service L2 deposit L1 info tree lookup used by /l1-info-tree-index: if a verified batch LER is missing from the local L2 exit tree, the lookup now avoids mixing L2 bridge-sync block numbers with L1 verified-batch block numbers and falls back to a bounded linear scan.

⚠️ Breaking Changes

• 🛠️ Config: No breaking migration. Auto Claim adds a new optional [AutoClaim] config section and remains disabled by default.
• 🔌 API/CLI: Adds a new optional autoclaim component selector and optional /autoclaim/v1 API. Existing bridge service API paths are unchanged.
• 🗑️ Deprecated Features: None.

📋 Config Updates

• 🧾 Diff/Config snippet: Adds defaults for the new disabled-by-default Auto Claim section:

[AutoClaim]
Enabled = false
StoragePath = "{{PathRWData}}/autoclaim.sqlite"
Claimers = []

[AutoClaim.API]
Enabled = false
Host = "0.0.0.0"
Port = 5579

[AutoClaim.L1ToL2Watchdog]
Enabled = true
StartBlock = 0
PollInterval = "3s"
RetryAfterErrorPeriod = "1s"
MaxRetryAttemptsAfterError = -1
EtrogL1UpgradeBlock = 0

[AutoClaim.L2ToLxWatchdog]
Enabled = false

• Enabling Auto Claim requires both selecting the autoclaim component and setting [AutoClaim].Enabled = true.
• Each enabled [[AutoClaim.Claimers]] entry configures one EVM destination network with its own RPC URL, bridge address, policy, gas settings, retry settings, and EthTxManager storage/signing config.
• Auto Claim owns AutoClaim.StoragePath; each claimer also has an independent EthTxManager.StoragePath and isolated per-claimer l2gersync / L2 reorg detector databases under the Auto Claim storage directory.
• L2 -> Lx Auto Claim remains unsupported and must stay disabled.

✅ Testing

• 🤖 Automatic: Added unit coverage across autoclaim/api, claimer, claimtx, config, policy, proof, runtime, sender, simulator, storage, types, and watchdog.
• 🤖 Automatic: Added Go e2e coverage for TestAutoClaimL1ToL2AllowAll, TestAutoClaimL1ToL2APIApprove, and TestAutoClaimL1ToL2BasicFilter.
• 🤖 Automatic: Current PR checks show lint, test-unit, Go e2e, Docker image build, CodeQL, SonarCloud, and the configured multi/single-chain e2e workflows passing. Run govulncheck is currently failing.
• 🖱️ Manual: No separate manual testing was run while refreshing this PR description.

🐞 Issues

• Close L1 -> L2 Autoclaim #1652

🔗 Related PRs

• None listed.

📝 Notes

• Auto Claim currently supports L1 -> L2 only. L2 -> Lx discovery is reserved for future work.
• Request IDs are derived from origin_network:destination_network:deposit_count; origin_network is the bridged token's origin network, not necessarily the chain where the bridge was initiated.
• GER readiness is checked during proof preparation by each claimer's own l2gersync, which supports both legacy and sovereign L2 GER manager behavior.
• The optional api-approve policy requires the Auto Claim API so operators can approve or reject requests in manual-approval-required status.
• This branch currently skips five known flaky remove-GER e2e entrypoint tests: TestRemoveGER_NoProblematicClaims, TestRemoveGER_CategoryA, TestRemoveGER_CategoryB1, TestRemoveGER_CategoryB2, and TestGenerateInvalidGER. This is being worked on feat: migrate e2e tests from bats to go #1643
• Bridge-service changes are a scoped regression fix for L2-origin bridge proof lookup. The previous fallback could call GetFirstVerifiedBatchesAfterBlock with GetLastRoot().BlockNum, which is an L2 bridge-sync block number even though the L1 info tree query expects an L1 block number. The new path only falls back on db.ErrNotFound, keeps the original L1 verified-batch bounds, and skips missing LERs with a linear scan when binary search cannot safely continue.

[joanestebanr]

@claude

[joanestebanr]

Another point is that the API for bridgeservice and for autoclaim is very similar. But there are a different that can be a bit misleading: the first page_number: bridgeservice use 1 and autoclaim use 0

[arnaubennassar]

Review comments addressed

Pushed 2883c4f addressing the open threads.

API redesign (the main one). Split endpoints by audience so operators can expose request status without exposing admin controls:

• Public, read-only inspection moved into the bridge service: GET /bridge/v1/autoclaim/bridges[/{id}] on the shared [REST] host/port, registered only when the autoclaim component runs (the bridge service gets an optional read-only AutoClaimQuerier, wired in run.go by opening the autoclaim storage once and sharing the handle).
• Admin approve/reject stay on the standalone [AutoClaim.API] (own host/port, can be firewalled). Shared DTOs + query parsing extracted to autoclaim/apitypes. This also answers the "share host/port with Bridge" comment.

Enabled → DryRun. Removed the redundant top-level [AutoClaim] Enabled (running is gated by the --components list); added DryRun, which runs the full pipeline but skips submitting the claim tx, ending requests in a new terminal dry-run status.

Per-claimer GER config. [[AutoClaim.Claimers]] now accepts optional BlockFinality / InitialBlockNum overrides, applied over the shared [L2GERSync] defaults in newGERSyncer.

Dedup. The pre-Etrog/global-index computation is now a single helper bridgesync.GlobalIndexForBridge, used by both bridgeservice and autoclaim.

Admin API hardening (flagged by the bot): max-length validation on decider/decider_id/reason and an io.LimitReader body cap.

Docs, swagger, and tests updated; the resolved CodeQL/bot threads were already outdated. Bot "suggested/optional" items (errgroup startup, metrics, etc.) left for follow-ups.

[sonarqubecloud]

Quality Gate passed

Issues
28 New issues
0 Accepted issues

Measures
0 Security Hotspots
80.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud