feat: gate block-validation bypasses behind //go:build mock_block_validation

[bdchatham]

Why

A node running an alternate execution engine (e.g., Giga V2) needs to bypass certain header-hash checks to validate against canonical-chain blocks. The previous shape exposed --skip-app-hash-validation as a runtime CLI flag on every seid binary, which made the production validator one config edit away from accepting bad blocks.

Approach

The build tag mock_block_validation is the toggle — there is no runtime knob.

// types/consensus_policy_default.go (//go:build !mock_block_validation)
type ConsensusPolicy struct{}
func (ConsensusPolicy) SkipAppHashValidation() bool  { return false }
func (ConsensusPolicy) SkipDataHashValidation() bool { return false }

// types/consensus_policy_mock_block_validation.go (//go:build mock_block_validation)
type ConsensusPolicy struct{}
func (ConsensusPolicy) SkipAppHashValidation() bool  { return true }
func (ConsensusPolicy) SkipDataHashValidation() bool { return true }

ConsensusPolicy is an empty struct in both builds; methods return different constants per build and the compiler folds them. Bypass branches DCE in production. There is no Go API in either build to construct a policy with the opposite behavior.

Block.ValidateBasic(policy) wraps the gated hash checks in if !policy.Skip*() { ... } in-place — no structural changes to the function body. validateBlock(state, block, policy) carries the policy from BlockExecutor down. Production start.go passes DefaultConsensusPolicy() unconditionally — no cobra, no AppOptions, no viper.

Naming

mock_block_validation matches the repo's existing mock_balances precedent — both are mock build tags for engineering / debug binaries. Underscore form is required for valid Go build tags. Image tag uses hyphen for readability: sei-chain:mock-block-validation-<sha>.

Per-check flags, narrow scope

The original ftr-skip-apphash branch gated 6 hash checks under one umbrella flag; this PR ships 2:

Hash check	Gated	Reason
AppHash	Yes	State root from execution — guaranteed to diverge for an alternate execution engine.
DataHash	Yes	Defensive against tx-encoding format skew across versions.
LastCommitHash	No	Validator-authenticity territory (merkle root of validator signatures). Should match against a same-version canonical chain.
EvidenceHash	No	Validator-authenticity territory (merkle root of misbehavior evidence). Same reasoning.
ValidatorsHash, NextValidatorsHash	No	Validator-set updates flow through cosmos-sdk x/staking, not through the EVM execution engine. Should match.
ConsensusHash, LastBlockID, VerifyCommit, ProposerAddress	No (unconditional)	Network-config or canonical-chain-derived; identical regardless of local execution.
LastResultsHash	(separate)	Gated by the existing SkipLastResultsHashValidation global, set from gigaExecutorConfig.Enabled — a first-class production runtime feature with intentional gas-accounting divergence, different security model.

If a non-gated check fails on a candidate node, that's actionable signal — either a real bug in the setup or a wire-format incompatibility worth investigating, not silently bypassed.

CI

.github/workflows/ecr.yml adds a single new build step alongside the existing mock_balances and production builds, mirroring the same pattern. Every push produces:

• sei-chain:<sha> — production
• sei-chain:mock-<sha> — mock_balances (unchanged)
• sei-chain:mock-block-validation-<sha> — new

Verification

• strings seid-default | grep skip-app-hash → 0 hits (no flag, no string in either binary)
• go build ./... and go build -tags mock_block_validation ./... both clean

Out of scope

• The two Dockerfile commits from ftr-skip-apphash (libevmone runtime + ubuntu 24.04 base for GLIBCXX) are giga-runtime support and ship as a separate PR.
• A BlockValidator interface that hides per-step validation behind a strategy-pattern abstraction was discussed and deferred — defensible refactor when there's a second consumer.

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	May 7, 2026, 9:11 PM

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 59.11%. Comparing base (eb17459) to head (7182fd9).

Files with missing lines	Patch %	Lines
sei-tendermint/light/rpc/client.go	0.00%	2 Missing ⚠️
sei-cosmos/server/start.go	0.00%	1 Missing ⚠️
sei-tendermint/test/e2e/node/main.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3401      +/-   ##
==========================================
+ Coverage   59.10%   59.11%   +0.01%     
==========================================
  Files        2106     2108       +2     
  Lines      173525   173535      +10     
==========================================
+ Hits       102558   102589      +31     
+ Misses      62093    62073      -20     
+ Partials     8874     8873       -1     

Flag	Coverage Δ
sei-chain-pr	67.89% <90.00%> (?)
sei-db	70.41% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
sei-tendermint/internal/consensus/replay.go	69.26% <100.00%> (+0.13%)	⬆️
sei-tendermint/internal/state/execution.go	80.14% <100.00%> (+0.04%)	⬆️
sei-tendermint/internal/state/validation.go	100.00% <100.00%> (ø)
sei-tendermint/node/node.go	65.19% <100.00%> (+0.18%)	⬆️
sei-tendermint/node/public.go	64.10% <100.00%> (+0.94%)	⬆️
sei-tendermint/rpc/test/helpers.go	75.40% <ø> (ø)
sei-tendermint/types/block.go	86.25% <100.00%> (+0.02%)	⬆️
sei-tendermint/types/consensus_policy.go	100.00% <100.00%> (ø)
sei-tendermint/types/consensus_policy_default.go	100.00% <100.00%> (ø)
sei-cosmos/server/start.go	23.39% <0.00%> (-0.09%)	⬇️
... and 2 more

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[masih]

🙌