op-conductor,op-node: SSZ-binary commit-unsafe-payload endpoint

[wlawt]

cherry-picked from #36 to only include the changes from that PR and not the targetted branch (ie., #35)

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[niran]

From Codex:

This only checks raft-level apply errors. The SSZ validation happens inside unsafeHeadTracker.Apply, but hashicorp/raft returns FSM Apply errors via ApplyFuture.Response(), not ApplyFuture.Error(). As written, malformed SSZ can be appended to the raft log, fail FSM decoding, and still return success from the binary endpoint. That is a behavior change from the JSON-RPC path, which decodes into an ExecutionPayloadEnvelope and successfully MarshalSSZs before raft.Apply.

We should either validate the SSZ before applying:

env := new(eth.ExecutionPayloadEnvelope)
if err := env.UnmarshalSSZ(eth.BlockV4, uint32(len(ssz)), bytes.NewReader(ssz)); err != nil {
    if err := env.UnmarshalSSZ(eth.BlockV3, uint32(len(ssz)), bytes.NewReader(ssz)); err != nil {
        return fmt.Errorf("invalid ssz payload: %w", err)
    }
}

Or check f.Response() for an error after f.Error() returns nil. For this FSM, success returns nil; decode/apply failures return the error object from unsafeHeadTracker.Apply.

f := rc.r.Apply(ssz, defaultTimeout)
if err := f.Error(); err != nil {
    return errors.Wrap(err, "failed to apply payload envelope")
}
if resp := f.Response(); resp != nil {
    if err, ok := resp.(error); ok {
        return errors.Wrap(err, "failed to apply payload envelope to FSM")
    }
    return errors.Errorf("unexpected raft apply response: %T: %v", resp, resp)
}