Bump leanSpec commit to 8b7636b

[pablodeymo]

Motivation

The leanSpec project updated its XMSS Signature class serialization in commit 0340cc1 (part of leanSpec#403). The model_serializer now emits signatures as hex-encoded SSZ bytes ("0x...") instead of the previous structured JSON format with path, rho, and hashes sub-objects.

When bumping LEAN_SPEC_COMMIT_HASH to 8b7636b and regenerating fixtures, all 8 verify_signatures spec tests broke with deserialization errors because our test types (ProposerSignature, SignaturePath, HashElement, RhoData, HashesData) expected the old structured format.

Changes

Bump leanSpec commit (ce8572e):

• Update LEAN_SPEC_COMMIT_HASH in Makefile to 8b7636b

Fix signature fixture deserialization (1f69319):

• Add deser_xmss_hex helper (follows the existing deser_pubkey_hex pattern): strips 0x prefix, hex-decodes to 3112 bytes, constructs XmssSignature
• Change TestSignatureBundle.proposer_signature from ProposerSignature to XmssSignature with the new deserializer
• Remove ~130 lines of dead code: ProposerSignature struct and its SSZ reconstruction logic, SignaturePath, HashElement, RhoData, HashesData, SszXmssSignature, SszHashTreeOpening, HashDigest, Rho type aliases, and their now-unused imports (SszDecode, SszEncode, FixedVector, U28, U32)

Note: attestationSignatures format is unchanged.

Test plan

• make test — all workspace tests pass
• 8/8 signature spec tests pass
• 14 STF spec tests pass
• 26 fork choice spec tests pass

[github-actions]

🤖 Kimi Code Review

Makefile Review

Line 28: The commit hash update appears to be a simple version bump for the leanSpec dependency. This change itself is not problematic, but consider:

1. Security: Ensure the new commit hash (8b7636bb8a95fe4bec414cc4c24e74079e6256b6) is from the legitimate leanEthereum/leanSpec repository and has been reviewed for consensus-critical changes.

2. Reproducibility: Add a comment next to the commit hash indicating what version/tag this corresponds to, making it easier to track what consensus spec version ethlambda is implementing.

3. Dependency pinning: Consider using a tagged release instead of a commit hash if leanSpec follows semantic versioning, as tags are more human-readable and less prone to typos.

The change itself is minimal and follows the existing pattern. No blocking issues found.

---

Automated review by Kimi (Moonshot AI) · custom prompt

[github-actions]

🤖 Codex Code Review

I reviewed the diff in /tmp/pr_diff.txt. The only change is a Makefile constant update.

Findings

• No code changes; just updates LEAN_SPEC_COMMIT_HASH in Makefile (line 28). This is low risk for correctness, security, performance, or consensus logic.

Notes

• If this commit hash is required for reproducible builds, consider adding a brief comment or release note elsewhere, but it’s not required for correctness.

Overall, the PR looks good.

---

Automated review by OpenAI Codex · custom prompt

[greptile-apps]

Greptile Summary

Bumps the pinned LEAN_SPEC_COMMIT_HASH in the Makefile from b39472e to 8b7636b to pick up the latest leanSpec spec changes. The Makefile serves as the single source of truth for this pin — the CI workflow in ci.yml extracts the hash from it, so no other files need updating.

• Updated LEAN_SPEC_COMMIT_HASH variable in Makefile (line 28)
• No issues found during review

Confidence Score: 5/5

• This PR is safe to merge — it's a single-line dependency pin update with no code logic changes.
• The change is a one-line update to a commit hash variable. The hash format is valid (40-char SHA-1), the Makefile is the single source of truth consumed by both local builds and CI, and no other files require changes.
• No files require special attention.

Important Files Changed

Filename	Overview
Makefile	Single-line update to LEAN_SPEC_COMMIT_HASH from b39472e... to 8b7636b... to pin a newer leanSpec commit. No functional or structural changes.

Flowchart

flowchart TD
    A["Makefile: LEAN_SPEC_COMMIT_HASH\n(updated to 8b7636b)"] --> B["make leanSpec\n(local clone + checkout)"]
    A --> C["CI: ci.yml\n(sed extracts hash)"]
    C --> D["actions/checkout\n(ref = extracted hash)"]
    D --> E["uv run fill\n(generate fixtures)"]
    B --> F["cd leanSpec && git checkout\n(uses hash)"]
    F --> G["make leanSpec/fixtures\n(generate test fixtures)"]
    E --> H["cargo test\n(run spec tests)"]
    G --> H

Loading

_{Last reviewed commit: ce8572e}

[github-actions]

🤖 Claude Code Review

Based on my review of PR #134, here's my assessment:

---

PR #134 Review: Bump leanSpec commit to 8b7636b

Summary

This PR updates the pinned leanSpec commit hash from b39472e to 8b7636b, picking up the latest spec changes.

Review

✅ Code Quality & Correctness

The change is minimal and well-scoped:

• Single source of truth: The commit hash is defined once in Makefile:28 and used consistently
• CI integration: The CI workflow (.github/workflows/ci.yml:53) correctly extracts this value via sed and uses it as a cache key for test fixtures
• Cache invalidation: Changing this hash will automatically invalidate the fixture cache, ensuring tests run against the new spec version

⚠️ Testing & Validation Considerations

Critical checks needed before merging:

1. Fixture compatibility: The new leanSpec commit may contain changes to:

   • Test fixture generation (leanSpec/fixtures/consensus/)
   • SSZ encoding/decoding behavior
   • Fork choice test cases
   • State transition test cases
   • Signature scheme parameters

2. Test coverage: Ensure all spec tests pass with the new fixtures:

   • forkchoice_spectests.rs (Makefile:15)
   • stf_spectests.rs (state transition)
   • signature_spectests.rs

3. Breaking changes: Without visibility into the leanSpec changes between b39472e and 8b7636b, there's risk of:

   • Modified consensus rules that ethlambda hasn't implemented yet
   • Changed fixture formats
   • New validation requirements

📋 Recommendations

Before approval:

1. ✅ Verify CI passes: Check that all tests pass with the new fixtures
2. ✅ Review leanSpec changes: Compare the commits to identify any consensus-breaking changes:

   cd leanSpec
   git log --oneline b39472e..8b7636b
   git diff b39472e..8b7636b -- src/lean_spec/

3. ✅ Cross-client compatibility: If running multi-client devnets, verify other clients (ream, zeam, qlean, grandine) are compatible with this spec version

Optional but recommended:

• Add a comment in the PR body listing the specific leanSpec changes being incorporated
• If the spec changes are significant, consider testing with a local devnet first using .claude/skills/test-pr-devnet

Security Considerations

✅ No security concerns for this mechanical dependency update

Performance Impact

✅ No runtime performance impact (affects only test fixtures at build time)

---

Verdict

LGTM conditionally - The code change is correct, but approval depends on:

• CI tests passing with the new fixtures
• No breaking changes in the upstream leanSpec commits

The PR is well-structured and follows the project's conventions for spec version pinning.

---

Automated review by Claude (Anthropic) · custom prompt