op-node/rollup: Implement Holocene invalid payload attributes handling

[sebastianst]

Description

Implements the remaining Holocene derivation feature: invalid payload attribute replacement with a deposits-only (DO) version.

The current approach is to request a DO version of the invalid payload attributes from the engine deriver, by having the BuildInvalidEvent handler emit a new DepositsOnlyPayloadAttributesRequestEvent that is directly processed by the pipeline deriver. It doesn't reset the pending safe, as before, but gives this DO version a second chance. The DO request event is handled by the pipeline as following:

• The pipeline deriver requests the DO version of the last attributes from the attributes queue stage.
  • The attributes queue performs a few sanity checks,
  • flushes the current channel of the previous stages (this is a new Holocene derivation rule),
  • and then returns the DO-version of the last attributes.
• The pipeline deriver emits a regular DerivedAttributesEvent with the DO-version of the attributes, which is then processed by the AttributesHandler, as before, and so enters the regular attributes derivation flow.
• These new attributes land in the engine deriver via the usual PendingSafeRequestEvent->PendingSafeUpdateEvent->BuildStartEvent flow.
• If the DO-version is still invalid, as before, this is a critical pipeline error and the program stops.
• Because the new DepositsOnlyPayloadAttributesRequestEvent is directly processed by the pipeline deriver, the ProgramDeriver of the op-program just works™️.

This approach breaks with the current invariant to not have the pipeline and engine derivers talk to each other directly, only via the attributes deriver, or the program deriver in the case of the fault proof program. The reason this approach was taken is that this makes it work automatically with the op-program's program deriver. The program deriver otherwise has to reimplement the attributes handler deriver logic, which felt like a less scalable and brittle approach. Since the DO-attributes request is also directly addressed to the pipeline, this seems clean.

Changes to pending safe/safe promotion are done in follow-up work.

Tests

Added an action test TestHoloceneInvalidPayload that shows the correct derivation behavior upon finding an invalid payload.

Additional context

I started a flow diagram on how the different derivers interact with each other here.

Metadata

Fixes #11316

[semgrep-app]

Semgrep found 3 sol-style-malformed-revert findings:

• packages/contracts-bedrock/test/universal/Proxy.t.sol
  • L22 - Triage
• packages/contracts-bedrock/test/mocks/Callers.sol
  • L87 - Triage
• packages/contracts-bedrock/test/invariants/FaultDisputeGame.t.sol
  • L72 - Triage

Malformed revert statement style.

_{Ignore this finding from sol-style-malformed-revert.}

Semgrep found 9 sol-style-malformed-require findings:

• packages/contracts-bedrock/test/safe-tools/CompatibilityFallbackHandler_1_3_0.sol
  • L96 - Triage
• packages/contracts-bedrock/test/invariants/OptimismSuperchainERC20/helpers/MockL2ToL2CrossDomainMessenger.t.sol
  • L92 - Triage
• packages/contracts-bedrock/test/invariants/OptimismSuperchainERC20/handlers/Protocol.t.sol
  • L160 - Triage
• packages/contracts-bedrock/test/dispute/FaultDisputeGame.t.sol
  • L2644 - Triage
• packages/contracts-bedrock/test/dispute/AnchorStateRegistry.t.sol
  • L141 - Triage
• packages/contracts-bedrock/test/L2/GasPriceOracle.t.sol
  • L134 - Triage
  • L225 - Triage
• packages/contracts-bedrock/test/L1/SystemConfigInterop.t.sol
  • L83 - Triage
  • L105 - Triage

"Hash not approved" Malformed require statement style.

_{Ignore this finding from sol-style-malformed-require.}

[semgrep-app]

Semgrep found 1 sol-style-require-reason finding:

• packages/contracts-bedrock/scripts/ops/FeeVaultWithdrawal.s.sol
  • L23 - Triage

require() must include a reason string

_{Ignore this finding from sol-style-require-reason.}

Semgrep found 6 sol-style-input-arg-fmt findings:

• packages/contracts-bedrock/src/universal/interfaces/IWETH.sol
  • L44 - Triage
  • L50 - Triage
  • L57 - Triage
  • L67 - Triage
  • L73 - Triage
  • L80 - Triage

Inputs to functions must be prepended with an underscore (_)

_{Ignore this finding from sol-style-input-arg-fmt.}

Semgrep found 1 golang_fmt_errorf_no_params finding:

• packages/contracts-bedrock/scripts/checks/semver-natspec/main.go
  • L191 - Triage

No fmt.Errorf invocations without fmt arguments allowed

_{Ignore this finding from golang_fmt_errorf_no_params.}

[protolambda]

LGTM. Just a few minor things to resolve