build(devnet): pin lean-quickstart to the lambdaclass keygen branch

[MegaRedHand]

Motivation

make run-devnet has been broken since the leanVM bump in #606. Upstream lean-quickstart still generates validator keys with hash-sig-cli, and those keys use an older XMSS format, so every node refuses the genesis at parse time:

GENESIS_VALIDATORS[0]: pubkey has length 52 (expected 32)

Changes

• Clone lean-quickstart from lambdaclass/lean-quickstart@devnet5-ethlambda-keygen instead of upstream main. That branch:

  • generates genesis keys with ethlambda keygen (image chosen by KEYGEN_IMAGE)
  • runs the devnet-5 images for ethlambda, lantern, gean, grandine and ream
  • defaults the local roster to three ethlambda nodes

• Pass KEYGEN_IMAGE=ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG), so the keys come from the image under test and match its leanVM revision.

• Warn when an existing lean-quickstart/ is out of date. The target never re-clones, so a stale clone used to keep failing without any hint. Two checks, in order:

  • the clone is on the pinned branch (works offline)
  • if so, its HEAD matches the branch tip on the remote, read with git ls-remote so the clone is left untouched. This catches a clone left behind after the pinned branch moves upstream. If the remote can't be reached, the check is skipped with a notice.

  Both only warn: the recipe rewrites ethlambda-cmd.sh in place, so the clone is always dirty and an automatic pull would conflict.

• The image-tag sed now stops at }. Matching through it deleted the closing brace of a ${VAR:-image} default, which broke ethlambda-cmd.sh with unexpected EOF.

Repo and branch can be overridden with LEAN_QUICKSTART_REPO / LEAN_QUICKSTART_BRANCH.

How to test

rm -rf lean-quickstart   # only if you have an old clone; save anything local first
make run-devnet

Tested with make -o docker-build run-devnet on a fresh clone of the pinned branch:

• keygen produced BLAKE2s keys with leanvm_rev 48a90420
• all three nodes loaded their keys and imported each other's blocks
• justification advanced to slot 12

The freshness check was tested on its own against the four cases: up to date (silent), wrong branch, right branch but not at the remote tip, and remote unreachable.

Finality was not reached in that run because a parallel cargo build had the host at load 65 on 11 cores, so the nodes' ticks fell behind wall clock. A rerun on an idle machine should confirm it.

A separate 5-client run (one validator per devnet-5 client) loaded keys on every client and justified slot 3. It then stalled: grandine hit its "parent not found" wedge and ream fell behind on CPU. That is why the default roster is ethlambda-only.

[github-actions]

🤖 Kimi Code Review

I'll review this PR diff focusing on the Makefile changes for the devnet tooling. This appears to be infrastructure/tooling rather than consensus-critical code, but I'll check for correctness and maintainability issues.

Review: Makefile changes (PR #624)

1. Branch check logic is fragile (Lines 108-109)

@[ "$$(git -C lean-quickstart rev-parse --abbrev-ref HEAD)" = "$(LEAN_QUICKSTART_BRANCH)" ] \
    || echo "⚠️  lean-quickstart/ is not on the pinned $(LEAN_QUICKSTART_BRANCH) branch; delete it to re-clone"

Problem: This warning is non-blocking. The || echo pattern continues execution even when the branch mismatch is detected. If the repo exists but is on the wrong branch, the devnet runs with potentially incompatible tooling.

Suggestion: Make this a hard error or add a force-clone option. At minimum, use && to chain properly or exit:

@if [ "$$(git -C lean-quickstart rev-parse --abbrev-ref HEAD)" != "$(LEAN_QUICKSTART_BRANCH)" ]; then \
    echo "⚠️  lean-quickstart/ is not on the pinned $(LEAN_QUICKSTART_BRANCH) branch; delete it to re-clone" >&2; \
    exit 1; \
fi

---

2. sed pattern change introduces subtle bug (Line 115)

@sed 's|ghcr.io/lambdaclass/ethlambda:[^ }]*|ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG)|'

Problem: The [^ }]* character class excludes space and }, but this is an ad-hoc fix for a specific shell syntax pattern (${VAR:-default}). It fails on other valid shell constructs:

• Tab characters (not covered by space)
• Newlines in the parameter expansion
• Other parameter expansion syntax like ${VAR:+alt} or ${VAR//pattern/repl}

More robust approach: Use a proper word boundary or anchor to the end of the image reference. Consider using sed -E with a more precise pattern, or better yet, use $(DOCKER_TAG) as a variable in the template rather than post-processing.

---

3. Missing .PHONY declaration

The lean-quickstart target was already not .PHONY; this PR doesn't fix it. If a file/directory named lean-quickstart exists, Make will skip the clone. Since the comment notes "An existing lean-quickstart/ is never re-cloned," this may be intentional, but it's worth verifying this is the desired behavior vs. adding:

.PHONY: lean-quickstart run-devnet docs-deps

---

4. rm -rf on line 111 is dangerous

Pre-existing, but amplified by this change: rm -rf lean-quickstart/local-devnet/data/ runs without validating the path. A malformed LEAN_QUICKSTART_BRANCH or symlink attack could cause issues. Consider:

@[ -d lean-quickstart/local-devnet/data/ ] && rm -rf lean-quickstart/local-devnet/data/

---

5. Environment variable override inconsistency

LEAN_QUICKSTART_REPO and LEAN_QUICKSTART_BRANCH use ?= (conditional assignment), but DOCKER_TAG isn't shown in the diff—verify it uses consistent assignment to avoid unexpected overrides.

---

Summary

Severity	Item	Location
Medium	Non-blocking branch mismatch warning	Lines 108-109
Low	sed pattern brittleness	Line 115
Low	Missing .PHONY	lean-quickstart target
Low	Unconditional rm -rf	Line 111

The consensus-critical code paths (state transition, fork choice, XMSS) are untouched in this PR. The changes are devnet infrastructure only.

---

Automated review by Kimi (Moonshot AI) · kimi-k2.6 · custom prompt

[github-actions]

🤖 Codex Code Review

I found one correctness issue; otherwise this looks fine.

• Makefile:108 — the branch-pin check only warns and still exits successfully, so make run-devnet proceeds with a stale or wrong lean-quickstart/ checkout. Given the PR’s stated goal (“delete it to pick up a new pin”), this can silently run the wrong devnet topology or scripts. Make this a hard failure instead of || echo ..., e.g. print the message to stderr and exit 1. This is the only concrete bug I see in the diff.

A few quick notes:

• Makefile:119 — the sed pattern change to stop at } looks correct and avoids corrupting shell parameter-default syntax.
• Makefile:123 — pinning KEYGEN_IMAGE to the image under test is a good consistency safeguard; that reduces cross-version genesis/keygen mismatches.
• No consensus-critical Rust paths are touched here, so there’s nothing to flag on fork choice, attestation validation, STF, XMSS, or SSZ correctness in this PR.

---

Automated review by OpenAI Codex · gpt-5.4 · custom prompt

[github-actions]

🤖 Claude Code Review

Review of PR 624 (Makefile only, run-devnet and lean-quickstart targets)

The change is small and sensible. It points lean-quickstart at the lambdaclass fork on a pinned branch, generates genesis keys with the image under test, and fixes the sed so it stops at }. I only read the diff. I didn't run any of it or check the fork branch.

Findings

1. Branch check is weak.

   • The new check in run-devnet compares rev-parse --abbrev-ref HEAD to the branch name. It only warns, and it doesn't compare against a specific commit.
   • The clone is --depth 1 --branch <branch>, so it tracks the branch tip. The commit message says "pin", but the branch can move and change devnet behaviour silently.
   • If reproducibility matters, pin a commit SHA or tag. This is optional, and it fits the existing "delete to re-clone" workflow.
   • git clone --branch also accepts tags. A tag would make rev-parse --abbrev-ref HEAD return HEAD (detached), and the warning would then fire every time.

2. A stale clone only warns. The mismatch message also prints when the directory isn't a git repo, because git -C errors go to stderr. Since it's only a warning, this is minor.

3. sed change. [^ }]* correctly handles ${IMAGE:-ghcr.io/lambdaclass/ethlambda:tag}. A tag containing } isn't valid, so that's fine. One behaviour to know about: it now also stops at } in any other context, which should be harmless here.

4. KEYGEN_IMAGE is passed only as an env var to spin-node.sh. It depends on the fork's scripts reading that name, and the diff doesn't show that. Please confirm the fork branch uses exactly KEYGEN_IMAGE.

5. Docs. CLAUDE.md and .claude/skills/devnet-runner/SKILL.md refer to blockblaz/lean-quickstart (CLAUDE.md links github.com/blockblaz/lean-quickstart). Consider updating them to mention the fork and the LEAN_QUICKSTART_REPO/LEAN_QUICKSTART_BRANCH overrides.

Verdict: Looks good overall. Nothing here affects consensus code. Points 1 and 4 are the ones worth checking before merge.

---

Automated review by Claude (Anthropic) · sonnet · custom prompt