EIP-8369 Profile 2: deterministic Frame omission check for FOCIL

[chugarchugarr]

Problem

EIP-7805 currently has an executable Profile-1 omission check: an omitted inclusion-list transaction is tested for appendability at the end of the payload. That is not sufficient for EIP-8141 Frame transactions because validity can depend on programmable validation state.

EIP-8369 defines the nonbinding Profile-2 model and explicitly leaves consensus enforcement to a Standards Track extension. The missing executable boundary is therefore cross-EIP: given the same IL, payload, parent state, and builder claim, every EL must derive the same omission verdict for an eligible Frame transaction.

This is already a live integration gap rather than a theoretical one: client integration work has had to exclude Frame transactions from FOCIL omission enforcement until Profile 2 exists.

Related trackers: #1900 (EIP-7805), #2829 (EIP-8141).

Proposed executable contract

For each omitted IL occurrence admitted by the Profile-2 static budget fill:

resolve_frame_omission(
    tx,
    payload,
    parent_state,
    claimed_index,
    fork_context,
) -> ENFORCE | EXCUSE

with the conformance invariant:

same inputs => same verdict across EELS and independent clients

1. Candidate classification

A Frame transaction is a Profile-2 candidate only when it satisfies the EIP-8369 transaction-only rules:

• statically valid EIP-8141 transaction;
• empty blob-versioned-hash list;
• one of the admitted validation-prefix shapes;
• no atomic-batch flag in the validation prefix;
• no VERIFY frame after the validation prefix;
• static VERIFY cost within the per-tx cap.

Profile-1 behavior remains unchanged.

2. Claimed evaluation index

Evaluate an omitted Profile-2 transaction at the authenticated builder claim.

• 0 = before the first payload transaction;
• len(payload.transactions) = end of payload;
• missing or out-of-range claim defaults to end of payload.

Claim encoding/transport/commitment is intentionally a separate scope (execution-apis#882); EELS should consume the resolved claim as an input to the omission rule.

3. Authenticated state-at-index

Reconstruct the evaluation state from:

• parent state;
• pre-execution system updates;
• EIP-7928 block access-list changes for transactions before the claimed index.

The state-view interface must reproduce at least:

• sender/payer account fields;
• permitted sender/payer storage slots;
• code + codeHash for validation-reached accounts;
• EIP-8250 keyed nonce state;
• EIP-8272 recent-root state;
• cumulative gas consumed before the index.

A missing authenticated value is not an omission excuse.

4. Bounded isolated replay

Replay only the EIP-8141 validation prefix under a fully pinned block/fork environment. The replay must enforce the Profile-2 access matrix rather than public-mempool policy.

State outside the Profile-2 surface makes the transaction ineligible; it must not be silently read from ambient client state.

5. Verdict

Omission is unjustified (ENFORCE) iff all of the following hold:

• an occurrence survived the static per-IL budget fill;
• fee validity passes;
• stateful Profile-2 eligibility succeeds at the claimed index;
• the validation prefix succeeds and sets a payer according to EIP-8141 semantics;
• transaction gas fits the remaining block gas at that index.

Otherwise the omission is excused for the specific normative reason.

Test matrix

The first conformance corpus should include, at minimum:

• all four admitted Frame validation-prefix shapes;
• index 0, intermediate index, end-of-payload, missing claim, out-of-range claim;
• validity changed by an earlier payload transaction;
• fresh keyed nonce and consumed keyed nonce;
• valid and stale recent-root reference;
• sender payer and separate payer;
• payer balance mutation before/after the claimed index;
• codeHash/code-body dependency;
• permitted sender/payer slot and forbidden external storage read;
• reverted validation prefix;
• invalid protocol signature;
• VERIFY budget exhaustion / per-tx overflow;
• insufficient remaining block gas;
• identical state reconstructed by two state providers producing the same verdict.

Mutation controls should prove the corpus detects at least: replay-at-end instead of claimed index, external-storage admission, unauthenticated-state fallback, and undercharging the static VERIFY budget.

Scope boundary

This issue is the eligibility/replay algorithm, not:

• the CL/EL encoding and transport of claimed indices (execution-apis#882), or
• FOCIL's existing post-reveal inclusionListSatisfied fork-choice enforcement.

Keeping those decisions separate lets each consensus boundary be reviewed without reopening the others.

Proposed landing shape

I am preparing this as executable spec + conformance vectors, with the Frame-side logic based on the current devnets/frames/0 implementation and the FOCIL-side check based on the current EIP-7805 branch. I will link the implementation PR(s) here.