feat(exit-certificate-claimer): prepare exit_certificate_claimer for deployment

[joanestebanr]

🔄 Changes Summary

Packaging and deployment preparation for the exit_certificate_claimer service.

• 🐳 Dockerfile: ship the exit_certificate (generator) and
  exit_certificate_claimer (HTTP service) binaries in the aggkit image under
  /usr/local/bin, so the tools travel alongside aggkit and the same image can
  be used to deploy the exit_certificate_claimer.

• 📦 docker-compose: add tools/exit_certificate_claimer/docker/docker-compose.yml
  to run the exit_certificate_claimer as a read-only HTTP service. It builds from
  the repo-root Dockerfile, overrides the entrypoint with the
  exit_certificate_claimer binary, and derives its whole config from the
  exit_certificate parameters.toml via --exit-certificate-config. Mounts the
  exit_certificate working dir at /data (read-write, since L1 sync keeps its
  SQLite DBs updated) and wires host.docker.internal so a host-pointing
  l1RpcUrl is reachable on Linux. Defines a healthcheck: and documents the
  volume-permission expectations (the container runs as appuser, uid 1000).

• 🩺 healthcheck subcommand: exit_certificate_claimer healthcheck probes
  GET /claimer/v1/health of a running claimer and exits 0 (healthy) or 1.
  The production image ships without a shell or curl, so the binary itself
  performs the HTTP probe; the docker-compose healthcheck is backed by it.

• 📜 JSON logs: new --log-json flag switches the claimer logs to JSON
  format (aggkit's production log environment, zap JSON encoder); the default
  remains the human-readable console format. Fatal startup errors are emitted
  through the configured logger too (JSON or console), instead of urfave/cli's
  plain Error: ... line. Exposed in docker-compose via CLAIMER_LOG_JSON
  (default false).

• 🧪 e2e docker mode: 60-claim_exit_certificate_funds.sh gains
  CLAIMER_MODE=docker to run the claimer through the docker-compose deployment
  instead of a host binary (a sibling config copy rewrites 127.0.0.1/localhost
  to host.docker.internal so the container reaches the Kurtosis-published L1
  RPC). The CI workflow sets it, so the e2e exercises the same artifact users
  deploy — image build from the repo-root Dockerfile included — and now also
  triggers on tools/exit_certificate_claimer/** and Dockerfile changes. The
  compose service user is parameterizable (CLAIMER_USER, default appuser) so
  L1 sync can write its SQLite DBs whatever the host uid.

• ⚙️ .env.example: documented env vars (EXIT_TOOL_DIR, EXIT_CERT_CONFIG,
  CLAIMER_ADDRESS, CLAIMER_PORT, CLAIMER_LOG_JSON, AGGKIT_IMAGE) consumed
  by compose.

• 🩹 e2e fix: agglayer_status (agglayer_certificate_status.sh --wait) now
  retries on the transient agglayer error raised right after the network starts,
  before the node has classified the network:

  ERROR: get network info: failed to get network info: Code: NotFound,
  Message: Network type could not be determined,
  Details: [Reason: GET_NETWORK_INFO_ERROR_KIND_UNKNOWN_NETWORK_TYPE,
  Domain: agglayer-node.grpc-api.v1.node-state-service.get_network_info. ]
  

  waitForSettled previously aborted on any GetNetworkInfo error, making the
  e2e prepare_network.sh step fail intermittently. This specific error is now
  treated as transient and polling continues (respecting the configured interval
  and timeout); other errors still abort.

⚠️ Breaking Changes

• None.

📋 Config Updates

• New env-var driven setup for the exit_certificate_claimer (see .env.example).
  No changes to the existing TOML config.
• New optional --log-json CLI flag (CLAIMER_LOG_JSON in compose) to emit
  JSON-formatted logs; defaults to the previous console format.

✅ Testing

• 🖱️ Manual:
  • make build-tools / go build ./tools/exit_certificate/... ./tools/exit_certificate_claimer/... build cleanly.
  • From tools/exit_certificate_claimer/docker/: cp .env.example .env then
    docker compose up --build starts the exit_certificate_claimer serving on CLAIMER_PORT.
  • exit_certificate_claimer healthcheck verified against a live health endpoint
    (exit 0) and a closed port (exit 1).
  • Ran the claimer with and without --log-json and verified the log output
    switches between the zap JSON encoder and the console format, including
    fatal startup errors (logged as an error line in the active format, exit code 1).
• 🧪 Unit: go test ./tools/exit_certificate/scripts/agglayer_status/ covers the
  new retry-on-undetermined-network-type path;
  go test ./tools/exit_certificate_claimer/... covers the healthcheck probe
  (URL building, 200/non-200/unreachable, end-to-end against the real router).
• 🚀 E2E: the exit-certificate tool E2E (CI) runs the claim step with
  CLAIMER_MODE=docker, validating the full docker deployment end to end:
  compose build of the aggkit image, container startup deriving the config,
  in-container L1 sync, /claimer/v1/health readiness and claiming every bridge
  exit against the containerized service.

📝 Notes

• The exit_certificate_claimer runs from the same working directory the
  exit_certificate tool used (config + output/), so no separate config file is needed.
• PR base: feature/exit-certificate-tool (packaging/deployment work only).

🤖 Generated with Claude Code

[joanestebanr]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: f944a5f07b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
84.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud