fix(PRIV-2006): seed AnchorStateRegistry with real L3 genesis output root

[robriks]

Summary

Dev-multiproof L3 deploys settle to an anchor — the L2 genesis output root — that is only known after L2 genesis. The main deploy runs before genesis, so it seeded the AnchorStateRegistry with a placeholder root (0x00..01). The TEE prover then rejects every proof built from that anchor (Output root does not match L2 head), the proposer creates zero dispute games, and L3→L1 withdrawals never finalize.

This extends the existing AggregateVerifier deferral pattern (PRIV-1997, #345) to the AnchorStateRegistry, so the registry is initialized exactly once with the real genesis output root.

Linear: PRIV-2006

Changes (scripts/deploy/SystemDeploy.s.sol)

• _initializeOPChain: when MULTIPROOF_DEFER_REGISTRATION is set (dev-multiproof only), upgrade the ASR proxy implementation via _upgradeTo but skip initialize(). Nothing else in the deploy reads the registry's state. Non-deferred deploys are unchanged.
• registerAggregateVerifier(bytes32) (the post-genesis one-shot): initialize the ASR with cfg.multiproofGenesisOutputRoot() (regenerated post-genesis with the real root) before deploying the AggregateVerifier, whose constructor reads ANCHOR_STATE_REGISTRY.disputeGameFactory(). Idempotent — guarded on a zero starting anchor, so one-shot retries are safe — and guarded against the placeholder/zero root.
• _runConfigured: skip the guardian setRespectedGameType call when deferring (the one-shot's initialize sets it).
• _deferAggregateVerifierRegistration made virtual so tests can force-enable deferral without mutating the process-global env.

This reuses the existing config flow: _configuredOPChainInput already sources startingAnchorRoot from cfg.multiproofGenesisOutputRoot() / cfg.multiproofGenesisBlockNumber(), so the deferred init is identical to the inline one — just executed post-genesis with the real value. No changes to AnchorStateRegistry.sol or its interface.

Tests

• New test_deploy_devMultiproof_deferred_anchorInitializedPostGenesis: asserts the deferred main deploy leaves the registry uninitialized (zero anchor, game type unregistered), then a post-genesis initialize seeds the real anchor and respected game type. Uses a SystemDeployDeferredHarness subclass (overriding the deferral hook) instead of vm.setEnv, which is process-global and races forge's parallel test contracts.
• Drops the now-stale assertion that Base Sepolia (84532) reverts in test_deploy_devMultiproof_onProductionChain_reverts — PRIV-2004 (fix(PRIV-2004): allow dev multiproof on Base Sepolia (84532) #348) made 84532 a valid dev-multiproof target, leaving that assertion failing on l3-changes independent of this PR.
• forge test --match-path test/deploy/SystemDeploy.t.sol: 13 passed.

Companion PRs

The post-genesis root computation + deploy-config regeneration land in base (register-aggregate-verifier.sh, deploy-config.json.template, setup-l2.sh) and privacy-enclave (vendored setup-l2.sh, services.yml).

Made with Cursor

[linear]

PRIV-2006