kona-node!: bound engine RPCs at the transport and add a SignerActor

[joshklop]

Stacked on #23125 as a proposed simplification of its engine RPC deadlines. Draft while we iterate.

#23125 bounds engine RPCs in three separate places:

• rpc_timeout around individual call sites
• a timeout inside record_call_time
• an outer timeout around the reset forkchoice update

A new call site without the wrapper has no deadline. This PR removes all three and puts one deadline on each of the engine client's two RPC clients, the JWT Engine API client and its L1 client. Both get the same alloy transport layer, a stock tower MapFutureLayer that wraps each request in a timeout. The call sites are back to their form on develop.

Every request from the engine client now has a deadline, including ones #23125 does not wrap:

• eth_getProof for optimism_outputAtBlock
• payload bodies and client version
• capability exchange, so a stalled Engine API endpoint now fails the startup JWT check instead of hanging it

The deadline is on alloy's transport future, not on the hyper client below it. hyper's future completes when the response headers arrive, and alloy reads the body after that. A timeout at the hyper level would let an endpoint that stalls mid-body hang the call. The new test covers both a request that is never answered and a response whose body stalls after its headers.

Behavior otherwise matches #23125:

• The deadline is still per request, so a long reset traversal is not cut off.
• A timeout is still a transport error, so the engine classifies it as temporary and retries it as before.
• new_payload_v1 keeps the record_call_time wrapper that kona-node: recover from RPC failures without cascading across chains #23125 added, which now only records its latency metric like the other Engine API methods.

The L1 watcher's timeouts are unchanged. They use the node's shared L1 provider, which derivation also uses, and a deadline there needs a separate decision.

It also proposes restructuring how the sequencer's blocks are signed:

• The L1 watcher is the source of the unsafe block signer. Each L1 watcher chain owns a watch channel for the signer, seeded with the value read at startup. Gossip validation and block signing subscribe to it. In kona-node: recover from RPC failures without cascading across chains #23125 the L1 watcher sends each signer to the network actor over a bounded channel, and the network actor relays it into the gossip crate's own watch channel. Publishing to a watch channel cannot block, so the refresh loop no longer reserves channel capacity before sending.
• Signing moves into a SignerActor between the sequencer and the network actor. kona-node: recover from RPC failures without cascading across chains #23125 signs in a task inside the network actor that gives each payload three 2s attempts and then skips it, so a transient signer outage leaves a gap in gossip. The SignerActor signs payloads in order and retries transient failures (remote signer transport errors and per-attempt timeouts) with backoff until they succeed, so nothing is skipped. Other signing errors are fatal, as before. If the signer rotates between signing and publishing, the payload is still published and peers reject it. The network actor goes back to only publishing.

Effect on operators:

• A remote signer outage longer than the sequencer's 256-payload queue pauses block production until the signer recovers, and the sequencer keeps answering admin RPC throughout, so op-conductor can still stop it. The backlog is then gossiped in order. With kona-node: recover from RPC failures without cascading across chains #23125 the sequencer keeps producing blocks and skips gossip for blocks it failed to sign. A long outage is meant to page someone.
• The block signer, including a remote signer's startup health check, starts only in sequencer mode. A validator with a signer configured logs that it is ignored.
• A kona-node in sequencer mode now fails at startup without a block signer (--p2p.sequencer.key, --p2p.sequencer.key.path, or --p2p.signer.endpoint with --p2p.signer.address). Before, it started and dropped every payload, so its blocks were never gossiped. op-node still allows this, but there it is only useful with p2p disabled, which kona does not support. The kona-node sequencer docs and CLI reference now list the signer flags.

BREAKING CHANGE: a kona-node started with --mode sequencer and no block signer now fails to start; configure one of the signer flags above. The rest affects code built on the kona-gossip and kona-node-service crates.

• GossipDriverBuilder::build returns only the driver, GossipDriverBuilder::with_unsafe_block_signer_receiver takes a watch::Receiver<Address>, and GossipDriverBuilder::new and GossipDriver::builder are no longer const.
• NetworkBuilder::new loses its signer parameter, and NetworkBuilder::with_signer is removed. NetworkDriver and NetworkHandler lose signer and unsafe_block_signer_sender.
• NetworkActor::new loses its signer-update receiver and takes a receiver of SignedPayload instead of unsigned payloads. L1WatcherChain::new takes a watch::Sender<Address>.
• NetworkDriverError::BlockSignerStartError and NetworkActorError::{FailedToSignPayload, SigningTask, MissingUnsafeBlockSigner} are removed.
• SignerActor::new takes a BlockSignerHandler; the actor always has a signer.
• UnsafePayloadGossipClient has a new required method, has_capacity, which the sequencer checks before sealing.

To migrate: give the L1 watcher chain the sender of a signer watch channel and pass its receiver to NetworkBuilder::with_unsafe_block_signer. To gossip a sequencer's blocks, start the BlockSigner and run a SignerActor between the sequencer's payload channel and the network actor's publish channel. Callers with a fixed signer keep passing an Address to NetworkBuilder::new.

Reviews: rust-code-reviewer was run on each commit. For the transport commit, its main finding, that a hyper-level timeout misses a stalled response body, is fixed. deletion-reviewer was run on the signer commits. It found no surviving references to the removed APIs outside code, and its findings are applied: the breaking changes are marked, a dead error variant is removed, and the kona-node design doc lists the signer actor.

🤖 Generated with Claude Code