jackchuma · Sep 22, 2026 · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026 · Sep 17, 2026
diff --git a/active/evm/tasks/2026-09-14-cobalt-upgrade/FACILITATOR.md b/active/evm/tasks/2026-09-14-cobalt-upgrade/FACILITATOR.md
@@ -1,12 +1,14 @@
 # Cobalt Upgrade — Facilitator Guide
 
-This task delivers the three Cobalt L1 changes in a single ProxyAdmin-owner transaction:
+This task delivers the three Cobalt L1 changes in a single ProxyAdmin-owner transaction.
+On Sepolia it also folds in the hinted Nitro TEE registry cutover as a sixth call:
 
-| Cobalt change | Contracts touched |
+| Change | Contracts touched |
 | --- | --- |
 | Dynamic upgrades | `ProtocolVersions` (new proxy + implementation), `AggregateVerifier` (redeployed to bind it) |
 | EthLockbox removal | `OptimismPortal2`, `SystemConfig` |
 | CREATE2 for dispute games | `DisputeGameFactory` |
+| Hinted Nitro TEE cutover (Sepolia) | `TEEProverRegistry` proxy, plus EOA-deployed `P384Verifier` / `CertManager` / `NitroValidator` |
 
 Replace `<network>` with the network you are rolling out, for example `zeronet`. Every command
 requires `TASK_NETWORK` explicitly — there is no default. Run everything from this directory
@@ -18,8 +20,9 @@ requires `TASK_NETWORK` explicitly — there is no default. Run everything from
 make TASK_NETWORK=<network> deps
 ```
 
-This pins `base/contracts` at `BASE_CONTRACTS_COMMIT`, installs the extra OpenZeppelin and solmate
-dependencies that building those sources requires, and applies `patch/max-gas-limit.patch`.
+This pins `base/contracts` at `BASE_CONTRACTS_COMMIT`, installs the extra OpenZeppelin, solmate,
+and `nitro-validator` dependencies that building those sources requires, and applies
+`patch/max-gas-limit.patch`.
 
 The patch matters. Zeronet runs a `SystemConfig` that raises `MAX_GAS_LIMIT` to 2,000,000,000, and
 Cobalt modifies `SystemConfig`. Deploying a stock build would quietly drop the chain back to
@@ -48,15 +51,16 @@ Open `config/<network>/.env` and confirm every value, in particular:
   live proxies before building any calls, so a stale value stops the task rather than upgrading
   from an unexpected base.
 - `AGGREGATE_VERIFIER_TEE_IMAGE_HASH`, `AGGREGATE_VERIFIER_ZK_RANGE_HASH` and
-  `AGGREGATE_VERIFIER_ZK_AGGREGATE_HASH` — the proof program hashes, built from the Base node
-  release these games prove against, which for Zeronet is
-  [`releases/v1.4.0`](https://github.com/base/base/tree/releases/v1.4.0). The TEE value is PCR0 of
-  the Nitro enclave image; the two ZK values are the SP1 range and aggregation verification keys
-  from `just succinct vkeys --build`. The `.env` comment records how each is produced, so they can
-  be regenerated from that ref rather than taken on trust. They ship blank and the deploy script
-  refuses to run until they are filled in. Every other `AggregateVerifier` constructor argument,
-  including the config hash and the block intervals, is read back from the live implementation at
-  deploy time, so the redeploy cannot change them.
+  `AGGREGATE_VERIFIER_ZK_AGGREGATE_HASH` — all three rotate for Cobalt. The TEE value is PCR0 of
+  the Nitro enclave; the ZK values are the SP1 keys from `just succinct vkeys --build`. Zeronet and
+  Sepolia use the same values from
+  [`releases/v1.4.0`](https://github.com/base/base/tree/releases/v1.4.0). The deploy script refuses a
+  zero hash or a hash that still matches the live verifier. Every other `AggregateVerifier`
+  constructor argument is read back from the live implementation at deploy time.
+- Sepolia TEE anchors — `OLD_TEE_PROVER_REGISTRY_IMPL`, `OLD_NITRO_VERIFIER`,
+  `CERT_MANAGER_OWNER`, and `CERT_MANAGER_REVOKER`. Re-check the live registry implementation
+  and `NITRO_VERIFIER()` before deploying. `ExecuteCobaltUpgrade` only emits the sixth call
+  when `NEW_TEE_PROVER_REGISTRY_IMPL` is present in `addresses.json`.
 
 ## 3. Deploy
 
@@ -83,8 +87,31 @@ VERIFIER_API_KEY=<key> make TASK_NETWORK=<network> verify-core
 VERIFIER_API_KEY=<key> make TASK_NETWORK=<network> verify-proofs
 ```
 
+On Sepolia, also deploy the hinted Nitro stack. These targets are not part of `make deploy`,
+so a Zeronet re-run cannot accidentally redeploy them:
+
+```bash
+make TASK_NETWORK=sepolia deploy-nitro-validator
+VERIFIER_API_KEY=<key> make TASK_NETWORK=sepolia verify-nitro-validator
+make TASK_NETWORK=sepolia deploy-tee-registry-impl
+VERIFIER_API_KEY=<key> make TASK_NETWORK=sepolia verify-tee-registry-impl
+```
+
+This writes `p384Verifier`, `certManager`, `nitroValidator`, and `teeProverRegistryImpl` into
+`config/sepolia/addresses.json` without overwriting the Cobalt addresses.
+
 Commit `config/<network>/addresses.json` and the `records/` broadcast artifacts.
 
+Before generating Sepolia validations, register the new-PCR0 Cobalt enclaves on the live `0.5.0`
+registry. Call 5 rotates `TEE_IMAGE_HASH`, so only those signers stay valid after execute.
+`signerImageHash` is storage and survives the implementation swap.
+
+Then migrate the offchain registrar to signer `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` and keep
+`BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` so AWS CRL checks still work. Stop the old registrar
+immediately before `execute`. There is no standalone TEE rollback in this task: a failed cutover
+means rolling the whole Cobalt bundle back. After execute, start the migrated registrar and rotate
+one enclave first.
+
 ## 4. Generate validation files
 
 ```bash
@@ -93,6 +120,13 @@ make TASK_NETWORK=<network> gen-validation-sc
 ```
 
 These write `config/<network>/validations/base-signer.json` and `security-council-signer.json`.
+For Sepolia (and any non-mainnet rollout) remove each generated `taskOriginConfig` and add this
+root field:
+
+```json
+"skipTaskOriginValidation": true
+```
+
 Commit them, then set the `config/<network>/README.md` status to `READY TO SIGN` and share it with
 signers.
 
@@ -112,7 +146,7 @@ than land a partial upgrade.
 
 ## What the upgrade transaction does
 
-Five calls, all from the ProxyAdmin owner Safe:
+Five calls on Zeronet, six on Sepolia, all from the ProxyAdmin owner Safe:
 
 1. `ProxyAdmin.upgradeAndCall(protocolVersionsProxy, protocolVersionsImpl, initialize(...))` —
    `initialize` is `reinitializer(1)` on a never-initialized proxy, so it must be bundled with the
@@ -121,16 +155,22 @@ Five calls, all from the ProxyAdmin owner Safe:
 3. `ProxyAdmin.upgrade(systemConfig, newImpl)`
 4. `ProxyAdmin.upgrade(disputeGameFactory, newImpl)`
 5. `DisputeGameFactory.setImplementation(621, newAggregateVerifier)`
+6. `ProxyAdmin.upgrade(teeProverRegistryProxy, newTeeProverRegistryImpl)` — Sepolia only, when
+   `NEW_TEE_PROVER_REGISTRY_IMPL` is set. Storage (owners, signers, per-signer image hashes,
+   proposers, game type) is unchanged; only the implementation and nitro wiring change. Call 5
+   does rotate the expected TEE image hash, because the registry reads it from the new
+   AggregateVerifier.
 
-Calls 2–4 are bare upgrades: none of those implementations adds state or bumps its init version, so
-there is nothing to reinitialize.
+Calls 2–4 and 6 are bare upgrades: none of those implementations adds state or bumps its init
+version, so there is nothing to reinitialize.
 
 ## Worth re-checking before signing
 
 - **Every changed contract bumps its version.** `OptimismPortal2` goes `5.2.0` -> `6.0.0`,
   `DisputeGameFactory` `1.4.0` -> `1.5.0`, `AggregateVerifier` `0.1.0` -> `0.2.0`, and `SystemConfig`
   `3.13.2+max-gas-limit-2000M` -> `3.14.0+max-gas-limit-2000M`, so `version()` read through each
-  proxy is a sound check that the upgrade landed.
+  proxy is a sound check that the upgrade landed. On Sepolia, `TEEProverRegistry` goes
+  `0.5.0` -> `0.6.1` and `NITRO_VERIFIER` is replaced by `NITRO_VALIDATOR`.
 - **The Cobalt activation is scheduled, so the transaction is time-sensitive.**
   `ProtocolVersions.initialize` enforces one hour of notice on future timestamps, so it reverts if
   the upgrade lands within the hour before the configured Cobalt activation. Execute well before

diff --git a/active/evm/tasks/2026-09-14-cobalt-upgrade/Makefile b/active/evm/tasks/2026-09-14-cobalt-upgrade/Makefile
@@ -21,8 +21,11 @@ ADDRESSES_JSON := $(CURDIR)/config/$(TASK_NETWORK)/addresses.json
 TASK_DIR := tasks/2026-09-14-cobalt-upgrade
 DEPLOY_CORE_SCRIPT := $(TASK_DIR)/script/DeployCobaltCoreImpls.s.sol:DeployCobaltCoreImpls
 DEPLOY_PROOFS_SCRIPT := $(TASK_DIR)/script/DeployCobaltProofImpls.s.sol:DeployCobaltProofImpls
+DEPLOY_NITRO_SCRIPT := $(TASK_DIR)/script/DeployNitroValidatorStack.s.sol:DeployNitroValidatorStack
+DEPLOY_TEE_REGISTRY_SCRIPT := $(TASK_DIR)/script/DeployTEEProverRegistryImpl.s.sol:DeployTEEProverRegistryImpl
 UPGRADE_SCRIPT := $(TASK_DIR)/script/ExecuteCobaltUpgrade.s.sol:ExecuteCobaltUpgrade
 SCRIPT_NAME := $(UPGRADE_SCRIPT)
+DEPLOYER = $(shell $(MISE_EXEC) cast wallet address --ledger --mnemonic-derivation-path $(LEDGER_HD_PATH))
 
 CB_SENDER = $(shell $(MISE_EXEC) cast call $(CB_MULTISIG) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
 SC_SENDER = $(shell $(MISE_EXEC) cast call $(BASE_SECURITY_COUNCIL) "getOwners()(address[])" --rpc-url $(L1_RPC_URL) | tr -d '[]' | cut -d',' -f1)
@@ -36,6 +39,12 @@ PROTOCOL_VERSIONS_IMPL = $(shell jq -er '.protocolVersionsImpl' $(ADDRESSES_JSON
 OPTIMISM_PORTAL_IMPL_CTOR_ARGS = $(shell jq -er '.optimismPortalImplConstructorArgs' $(ADDRESSES_JSON) 2>/dev/null)
 PROTOCOL_VERSIONS_PROXY_CTOR_ARGS = $(shell jq -er '.protocolVersionsProxyConstructorArgs' $(ADDRESSES_JSON) 2>/dev/null)
 AGGREGATE_VERIFIER_CTOR_ARGS = $(shell jq -er '.aggregateVerifierConstructorArgs' $(ADDRESSES_JSON) 2>/dev/null)
+# `// empty` matters here: a bare `jq -er .missing` prints the literal "null" on stdout, which
+# would make the cutover gate below read as populated before anything is deployed.
+NEW_TEE_PROVER_REGISTRY_IMPL = $(shell jq -r '.teeProverRegistryImpl // empty' $(ADDRESSES_JSON) 2>/dev/null)
+NEW_P384_VERIFIER = $(shell jq -r '.p384Verifier // empty' $(ADDRESSES_JSON) 2>/dev/null)
+NEW_CERT_MANAGER = $(shell jq -r '.certManager // empty' $(ADDRESSES_JSON) 2>/dev/null)
+NEW_NITRO_VALIDATOR = $(shell jq -r '.nitroValidator // empty' $(ADDRESSES_JSON) 2>/dev/null)
 
 DEPLOY_ENV = ADDRESSES_JSON=$(ADDRESSES_JSON) \
 	L1_PROXY_ADMIN=$(L1_PROXY_ADMIN) \
@@ -65,7 +74,27 @@ UPGRADE_ENV = PROXY_ADMIN_OWNER=$(PROXY_ADMIN_OWNER) \
 	PROTOCOL_VERSIONS_IMPL=$(PROTOCOL_VERSIONS_IMPL) \
 	PROTOCOL_VERSIONS_INCIDENT_RESPONDER=$(PROTOCOL_VERSIONS_INCIDENT_RESPONDER) \
 	PROTOCOL_VERSIONS_MINIMUM_PROTOCOL_VERSION=$(PROTOCOL_VERSIONS_MINIMUM_PROTOCOL_VERSION) \
-	PROTOCOL_VERSIONS_INITIAL_SCHEDULE=$(PROTOCOL_VERSIONS_INITIAL_SCHEDULE)
+	PROTOCOL_VERSIONS_INITIAL_SCHEDULE=$(PROTOCOL_VERSIONS_INITIAL_SCHEDULE) \
+	$(TEE_UPGRADE_ENV)
+
+# Sepolia (and later networks that still need the hinted Nitro cutover) pass these
+# so ExecuteCobaltUpgrade emits a sixth ProxyAdmin.upgrade. Zeronet leaves them
+# unset and stays on the original five-call transaction.
+ifneq ($(NEW_TEE_PROVER_REGISTRY_IMPL),)
+TEE_UPGRADE_ENV = \
+	TEE_PROVER_REGISTRY_PROXY=$(TEE_PROVER_REGISTRY_PROXY) \
+	TEE_VERIFIER=$(TEE_VERIFIER) \
+	PROPOSER=$(PROPOSER) \
+	CHALLENGER=$(CHALLENGER) \
+	CERT_MANAGER_OWNER=$(CERT_MANAGER_OWNER) \
+	CERT_MANAGER_REVOKER=$(CERT_MANAGER_REVOKER) \
+	OLD_TEE_PROVER_REGISTRY_IMPL=$(OLD_TEE_PROVER_REGISTRY_IMPL) \
+	NEW_TEE_PROVER_REGISTRY_IMPL=$(NEW_TEE_PROVER_REGISTRY_IMPL) \
+	OLD_NITRO_VERIFIER=$(OLD_NITRO_VERIFIER) \
+	NEW_P384_VERIFIER=$(NEW_P384_VERIFIER) \
+	NEW_CERT_MANAGER=$(NEW_CERT_MANAGER) \
+	NEW_NITRO_VALIDATOR=$(NEW_NITRO_VALIDATOR)
+endif
 
 ##
 # Dependencies
@@ -83,7 +112,8 @@ task-extra-deps:
 	cd $(PROJECT_DIR) && $(MISE_EXEC) forge install --no-git \
 		github.com/OpenZeppelin/openzeppelin-contracts@ecd2ca2cd7cac116f7a37d0e474bbb3d7d5e1c4d \
 		github.com/OpenZeppelin/openzeppelin-contracts-upgradeable@0a2cb9a445c365870ed7a8ab461b12acf3e27d63 \
-		github.com/transmissions11/solmate@8f9b23f8838670afda0fd8983f2c41e8037ae6bc
+		github.com/transmissions11/solmate@8f9b23f8838670afda0fd8983f2c41e8037ae6bc \
+		github.com/base/nitro-validator@0ea0d12366b4fa44f9e07e4755f2ad36561cb674
 
 # Zeronet runs a SystemConfig patched to raise MAX_GAS_LIMIT to 2e9. Cobalt changes
 # SystemConfig, so the patch is re-applied on top of the pinned commit rather than
@@ -119,6 +149,21 @@ deploy-proofs:
 		$(MISE_EXEC) forge script --rpc-url $(L1_RPC_URL) $(DEPLOY_PROOFS_SCRIPT) \
 		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv
 
+.PHONY: deploy-nitro-validator
+deploy-nitro-validator:
+	@test -f "$(ADDRESSES_JSON)" || echo '{}' > "$(ADDRESSES_JSON)"
+	cd $(PROJECT_DIR) && CERT_MANAGER_OWNER=$(CERT_MANAGER_OWNER) CERT_MANAGER_REVOKER=$(CERT_MANAGER_REVOKER) \
+		ADDRESSES_JSON=$(ADDRESSES_JSON) FOUNDRY_PROFILE=nitro-deploy \
+		$(MISE_EXEC) forge script --rpc-url $(L1_RPC_URL) $(DEPLOY_NITRO_SCRIPT) \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv --sender $(DEPLOYER)
+
+.PHONY: deploy-tee-registry-impl
+deploy-tee-registry-impl:
+	cd $(PROJECT_DIR) && DISPUTE_GAME_FACTORY_PROXY=$(DISPUTE_GAME_FACTORY_PROXY) ADDRESSES_JSON=$(ADDRESSES_JSON) \
+		FOUNDRY_PROFILE=tee-registry-deploy \
+		$(MISE_EXEC) forge script --rpc-url $(L1_RPC_URL) $(DEPLOY_TEE_REGISTRY_SCRIPT) \
+		--ledger --hd-paths $(LEDGER_HD_PATH) --broadcast -vvvv --sender $(DEPLOYER)
+
 ##
 # Source verification
 ##
@@ -178,6 +223,44 @@ endif
 			--constructor-args $(AGGREGATE_VERIFIER_CTOR_ARGS) \
 			--num-of-optimizations 999999 $(VERIFY_COMMON)
 
+.PHONY: verify-nitro-validator
+verify-nitro-validator:
+ifndef VERIFIER_API_KEY
+	$(error VERIFIER_API_KEY is not set)
+endif
+	cd $(PROJECT_DIR)/lib/nitro-validator && FOUNDRY_BYTECODE_HASH=none FOUNDRY_EVM_VERSION=cancun \
+		$(MISE_EXEC) forge verify-contract $(NEW_P384_VERIFIER) src/P384Verifier.sol:P384Verifier \
+		--chain $(L1_CHAIN_ID) --compiler-version v0.8.26+commit.8a97fa7a --num-of-optimizations 10000 \
+		--verifier custom --verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) --watch
+	cd $(PROJECT_DIR)/lib/nitro-validator && FOUNDRY_BYTECODE_HASH=none FOUNDRY_EVM_VERSION=cancun \
+		$(MISE_EXEC) forge verify-contract $(NEW_CERT_MANAGER) src/CertManager.sol:CertManager \
+		--constructor-args $(shell $(MISE_EXEC) cast abi-encode "constructor(address,address,address)" $(NEW_P384_VERIFIER) $(CERT_MANAGER_OWNER) $(CERT_MANAGER_REVOKER)) \
+		--chain $(L1_CHAIN_ID) --compiler-version v0.8.26+commit.8a97fa7a --num-of-optimizations 10000 \
+		--verifier custom --verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) --watch
+	cd $(PROJECT_DIR)/lib/nitro-validator && FOUNDRY_BYTECODE_HASH=none FOUNDRY_EVM_VERSION=cancun \
+		$(MISE_EXEC) forge verify-contract $(NEW_NITRO_VALIDATOR) src/NitroValidator.sol:NitroValidator \
+		--constructor-args $(shell $(MISE_EXEC) cast abi-encode "constructor(address,address)" $(NEW_CERT_MANAGER) $(NEW_P384_VERIFIER)) \
+		--chain $(L1_CHAIN_ID) --compiler-version v0.8.26+commit.8a97fa7a --num-of-optimizations 10000 \
+		--verifier custom --verifier-url "https://api.etherscan.io/v2/api?chainid=$(L1_CHAIN_ID)" \
+		--verifier-api-key $(VERIFIER_API_KEY) --watch
+
+.PHONY: verify-tee-registry-impl
+verify-tee-registry-impl:
+ifndef VERIFIER_API_KEY
+	$(error VERIFIER_API_KEY is not set)
+endif
+	@set -e; \
+		mkdir -p $(CONTRACTS_LIB); \
+		trap 'rm -f $(foreach d,$(VERIFY_DEPS) nitro-validator,$(CONTRACTS_LIB)/$(d)); rmdir $(CONTRACTS_LIB) 2>/dev/null || true' EXIT; \
+		for d in $(VERIFY_DEPS) nitro-validator; do ln -sfn ../../$$d $(CONTRACTS_LIB)/$$d; done; \
+		cd $(PROJECT_DIR); \
+		$(VERIFY_ENV) FOUNDRY_OPTIMIZER_RUNS=999999 \
+		$(MISE_EXEC) forge verify-contract $(NEW_TEE_PROVER_REGISTRY_IMPL) src/L1/proofs/tee/TEEProverRegistry.sol:TEEProverRegistry \
+		--constructor-args $(shell $(MISE_EXEC) cast abi-encode "constructor(address,address)" $(NEW_NITRO_VALIDATOR) $(DISPUTE_GAME_FACTORY_PROXY)) \
+		--num-of-optimizations 999999 $(VERIFY_COMMON)
+
 ##
 # Validation files
 ##

diff --git a/active/evm/tasks/2026-09-14-cobalt-upgrade/config/sepolia/.env b/active/evm/tasks/2026-09-14-cobalt-upgrade/config/sepolia/.env
@@ -0,0 +1,60 @@
+# https://github.com/base/contracts/commits/releases/v8.3.0/
+BASE_CONTRACTS_COMMIT=385f21a41f277d287db92fffe88dca41299162ea
+
+# Rollback anchors verified against Sepolia on 2026-09-17.
+OLD_OPTIMISM_PORTAL_IMPL=0x45fA7cFfa725e238a46a35fdE9F339b63fDEDBdD
+OLD_SYSTEM_CONFIG_IMPL=0x4ABA707Dc42c49586158037EC7F2e1E48254c735
+OLD_DISPUTE_GAME_FACTORY_IMPL=0xE7f2E3C6286375C102e482c0Aa2385D8bAAcac26
+OLD_AGGREGATE_VERIFIER=0x48cB1A96036B76Ed420d4b8eD6977aC3a939764C
+
+# Hinted Nitro TEE cutover. Verified against the live Sepolia registry before task creation.
+OLD_TEE_PROVER_REGISTRY_IMPL=0xF9Ab55c35cE7Fb183A50E611B63558499130D849
+OLD_NITRO_VERIFIER=0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72
+CERT_MANAGER_OWNER=0x646132A1667ca7aD00d36616AFBA1A28116C770A
+CERT_MANAGER_REVOKER=0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3
+
+# ProtocolVersions initial state.
+#
+# Ids are kept aligned with the Base mainnet registry so that an index means the
+# same fork on every chain. Timestamps must match the node's SEPOLIA chain config
+# in base/base crates/common/chains/src/config.rs:
+#   0 genesis/regolith -> 1695768288  2023-09-26 22:44:48 UTC
+#   1 canyon           -> 1699981200  2023-11-14 17:00:00 UTC
+#   2 delta            -> 1703203200  2023-12-22 00:00:00 UTC
+#   3 ecotone          -> 1708534800  2024-02-21 17:00:00 UTC
+#   4 fjord            -> 1716998400  2024-05-29 16:00:00 UTC
+#   5 granite          -> 1723478400  2024-08-12 16:00:00 UTC
+#   6 holocene         -> 1732633200  2024-11-26 15:00:00 UTC
+#   7 pectraBlobSchedule -> 1742486400  2025-03-20 16:00:00 UTC
+#   8 isthmus          -> 1744905600  2025-04-17 16:00:00 UTC
+#   9 jovian           -> 1763568001  2025-11-19 16:00:01 UTC
+#   10 azul            -> 1776708000  2026-04-20 18:00:00 UTC
+#   11 beryl           -> 1781805600  2026-06-18 18:00:00 UTC
+#   12 cobalt          -> 1790186400  2026-09-23 18:00:00 UTC
+#      date -u -r 1790186400
+PROTOCOL_VERSIONS_INITIAL_SCHEDULE=1695768288,1699981200,1703203200,1708534800,1716998400,1723478400,1732633200,1742486400,1744905600,1763568001,1776708000,1781805600,1790186400
+
+# Minimum protocol version, set to v1.4.0. The OP protocol version format packs the
+# low 16 bytes as major || minor || patch || pre-release, four bytes each, so v1.4.0
+# is 0x00000001_00000004_00000000_00000000. Re-derive with:
+#      cast to-dec 0x00000001000000040000000000000000
+# Must be non-zero and fit in 128 bits.
+PROTOCOL_VERSIONS_MINIMUM_PROTOCOL_VERSION=79228162588051313888382156800
+PROTOCOL_VERSIONS_INCIDENT_RESPONDER=0x646132A1667ca7aD00d36616AFBA1A28116C770A
+
+# AggregateVerifier proof program hashes. Every other constructor argument is read
+# from the live implementation at deploy time, so these are the only values that
+# change. All three rotate for Cobalt and match Zeronet because both networks use
+# the same Cobalt enclave image and ZK programs from releases/v1.4.0.
+#
+# The TEE value is PCR0 of the AWS Nitro enclave built from crates/proof/tee.
+# The ZK values are the SP1 keys from `just succinct vkeys --build`.
+AGGREGATE_VERIFIER_TEE_IMAGE_HASH=0xe8dc2300cf325b2527cbfa5e664a70acc40a9f2fc0617bd35cdfa61652a5fc30
+AGGREGATE_VERIFIER_ZK_RANGE_HASH=0x7713943c2c2412314b135c5606cdb3923a54f7555d91d9f31c2f64e34e16f2f4
+AGGREGATE_VERIFIER_ZK_AGGREGATE_HASH=0x002663a1072dc1e1938e13d3b269fff88e843eb4ef76d6c6953dde4f5152973b
+
+# L2 chain geometry, used to map activation timestamps onto block numbers. The live
+# implementation predates ScheduleConfig, so these cannot be copied from it.
+L2_GENESIS_BLOCK_NUMBER=0
+L2_GENESIS_TIMESTAMP=1695768288
+L2_BLOCK_TIME=2