Make Autobahn always run the EVM-only executor, disable/remove some integration tests

[wen-coding]

Autobahn had two shapes: with evm-only it ran the disk-backed EVM-only executor and served the EVM JSON-RPC, and without it the Cosmos application and Tendermint RPC. The second shape was not a product we intend to keep, and the flag let a node be configured into a combination we do not support.

Enabling Autobahn now selects the EVM-only executor and serves the EVM JSON-RPC instead of Tendermint RPC. The evm-only config key is gone. Selection happens in wrapApplication, the one function every startup path passes through, keyed on the Giga storage manager that autobahn-config-file already opens.

mock-app still replaces the application under Autobahn so consensus can be load-tested without execution. It is ordered ahead of the EVM-only branch.

Cosmos-under-Autobahn integration coverage is removed or disabled rather than ported (AUTOBAHN_EVMONLY is gone; make autobahn-evmonly-integration-test remains as an alias). Autobahn CI rows that need the full evmrpc surface or Cosmos gov stay in the matrix as "disabled": true with TODOs.

Autobahn Basic

The suite still starts a four-validator cluster plus the sei-rpc-node fullnode sidecar. It runs:

• EVMOnlyLoad — 4000 raw transfers on chain 713715, receipts and balances on every validator, plus a receipt on the fullnode
• LivenessUnderMaxFaults — after f kills, a submitted transfer must finalize
• HaltsBeyondMaxFaults — after f+1 kills, a submitted transfer must not land
• Recovery — skipped until the durable EVM-only execution cursor (#4231, on giga-1) reaches main. Without it a restarted validator reports height 0, replays block 1 onto ahead-of-it FlatKV state, and panics with nonce too low

The CI startup gate for AUTOBAHN=true rows checks eth_getBalance and waits for one committed transfer. Docker clusters keep allow_empty_blocks off.

Test plan

• go test ./sei-tendermint/node/ ./sei-tendermint/config/ ./cmd/autobahn-e2e/
• go vet -tags autobahn_integration ./integration_test/autobahn/
• Autobahn Basic in CI: load, liveness, halt; Recovery skipped until the cursor lands

[github-actions]

The latest Buf updates on your PR. Results from workflow Buf / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Sep 24, 2026, 1:58 PM

[seidroid]

This PR drops the evm-only flag so that Autobahn always uses the EVM-only executor, with mock-app checked first, and it deletes the Cosmos-under-Autobahn integration suite. The main change looks sound. The one real risk is that mock-app under Autobahn now binds the EVM-only RPC port, which can collide with the Cosmos app's own EVM HTTP server outside the Docker scripts.

Findings: 0 blocking | 3 non-blocking | 1 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• [suggestion] The integration test cleanup also deletes doc comments on helpers it keeps. Examples: assertAutobahnEnabled loses its note that seid logs go to a file inside the container (not docker logs), setupCluster, countLaunchComplete and findRepoRoot lose their docs, and a leftover comment above var clusterSize is split from listRunningNodes. None of this is needed for the behaviour change, and it removes context that explained non-obvious steps. Keep the comments on the surviving helpers.
• [suggestion] The PR says it selects the Autobahn shape at one choke point, but there are now two separate conditions. wrapApplication checks whether Giga storage is present, while OnStart picks the EVM-only RPC from AutobahnConfigFile != "". They agree today only because prepareApplication opens storage exactly when the config file is set. Using the same condition in both places, or recording the choice once, would stop them from drifting apart.
• 1 suggestion(s)/nit(s) flagged inline on specific lines.

[codecov]

Codecov Report

❌ Patch coverage is 61.53846% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.38%. Comparing base (e5f44ae) to head (ad88fcd).
⚠️ Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...int/cmd/tendermint/commands/gen_autobahn_config.go	0.00%	4 Missing ⚠️
sei-tendermint/node/node.go	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4316      +/-   ##
==========================================
- Coverage   67.49%   66.38%   -1.11%     
==========================================
  Files        2181     2060     -121     
  Lines      167798   155772   -12026     
==========================================
- Hits       113251   103416    -9835     
+ Misses      54537    52346    -2191     
  Partials       10       10              

Flag	Coverage Δ
sei-chain-pr	59.61% <61.53%> (?)
sei-db	74.50% <ø> (ø)
sei-db-state-db	?

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
app/app.go	77.83% <100.00%> (ø)
cmd/autobahn-e2e/aws.go	65.49% <100.00%> (ø)
cmd/autobahn-e2e/deploy.go	6.66% <ø> (+0.06%)	⬆️
sei-tendermint/config/autobahn.go	74.46% <ø> (ø)
sei-tendermint/config/config.go	90.61% <ø> (ø)
sei-tendermint/config/toml.go	74.50% <ø> (ø)
sei-tendermint/node/public.go	83.33% <100.00%> (-0.31%)	⬇️
sei-tendermint/node/node.go	75.32% <50.00%> (ø)
...int/cmd/tendermint/commands/gen_autobahn_config.go	15.29% <0.00%> (+0.17%)	⬆️

... and 121 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.

There are 3 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1d8717c. Configure here.}

[cursor]

Liveness test accepts in-flight blocks

Medium Severity

testLivenessUnderMaxFaults treats the first height increase after killNode as proof the remaining committee is live. In-flight blocks keep draining through runExecute after a validator dies, so height can advance once even when quorum is gone and no new block is agreed. A halted cluster can still pass this subtest.

Additional Locations (1)

• integration_test/autobahn/autobahn_test.go#L441-L453

 

^{Reviewed by Cursor Bugbot for commit 1d8717c. Configure here.}

[wen-coding]

@seidroid re-review please

[seidroid]

Claude finished @wen-coding's task in 1m 7s —— View job

---

Re-review of #4316 at e6e7911

• Read the current diff against origin/main
• Re-check the earlier findings
• Look for new issues
• Post the review

The core change is still sound. wrapApplication (sei-tendermint/node/public.go:185) checks mock-app first, then uses the EVM-only app whenever Giga storage is open. Storage is opened only when autobahn-config-file is set. The tests replacing the EVMOnly cases cover the mock-app, Autobahn and non-Autobahn paths. I found no blockers.

What changed since the last review

• Doc comments are back. assertAutobahnEnabled, setupCluster, countLaunchComplete and listRunningNodes have their doc comments again. findRepoRoot still has none, which is minor.
• Bugbot's liveness concern is fixed. testLivenessUnderMaxFaults no longer counts a height increase as liveness. It sends a new transfer after the kills and waits for a receipt from both sei-node-0 and the fullnode (sendEvmTxAndWait, autobahn_test.go:552). A block that was already in flight can't contain a tx sent after the kill, so the old false positive can't happen now.
• The halt test checks the right thing. After quorum loss it waits for the height to stop moving and requires that neither the validator nor the fullnode has a receipt (autobahn_test.go:567).
• The Bugbot startup-gate finding is fixed. The height-growth check was removed. The gate now waits for one committed transfer, which works with allow_empty_blocks=false.
• Removing the GIGA Mixed row is intended. You confirmed this, so I'm not raising it again.

Non-blocking

1. --allow-empty-blocks is never used. gen_autobahn_config.go:40,119 adds the flag, but nothing passes it. step4_config_override.sh calls gen-autobahn-config without it, and the PR body says Docker clusters keep empty blocks off. It is left over from 79eef0f. I'd drop it unless there's a caller coming soon.
2. The new startup gate never runs in CI. Every AUTOBAHN=true matrix row is now "disabled": true. So the case … *AUTOBAHN=true* branch in integration-test.yml:335, TestAutobahnStartup and startup_autobahn_test.yaml land without being run anywhere. Autobahn Basic starts its own cluster and doesn't use them. That's fine as setup for re-enabling the rows, but say so in the PR, or expect it to break unnoticed. On a related point, the comment on autobahnStartupSender (autobahn_startup_test.go:373) is about avoiding a clash with TestAutobahn "when both run on the same cluster". That never happens today, because TestAutobahn brings up its own cluster in TestMain.
3. Still open: mock-app binds the EVM-only RPC. OnStart (node.go:696) picks the EVM-only RPC from AutobahnConfigFile != "", so a mock-app node now serves evmonlyrpc backed by a ReceiptDB that nothing writes to. If API/gRPC is left on outside the Docker scripts, it can also fight over the port with the Cosmos app's EVM HTTP server. Only the sed overrides in step4_config_override.sh:295-298 prevent this.
4. Still open: the choice is made in two places. wrapApplication decides based on whether storage is present, and OnStart decides based on AutobahnConfigFile != "". They agree only because of how prepareApplication:160 is written. The AGENTS.md choke-point rule points to deciding once, for example storing the result on nodeImpl, or having OnStart check n.gigaStorageManager directly. OnStart already calls .Get() on it, so switching the condition to if storage, ok := n.gigaStorageManager.Get(); ok would remove the duplication.
5. killNode doesn't wait for seid to exit (Bugbot). This is harmless while Recovery is skipped. When fix(evmonly): restore the durable execution cursor #4231 lands and the skip is removed, restartNode will race a seid process that is still shutting down, and they share ports and the storage lock. Add a wait-for-exit loop (pgrep seid until it finds nothing) to killNode before re-enabling. Otherwise the re-enabled test will be flaky for a reason that has nothing to do with the cursor.
6. Nit: duplicated test helpers. evmRPCResponse, evmRPCInContainer and the no-op SetBalance/SetCode/SetState state type are copied between integration_test/runner/autobahn_startup_test.go and integration_test/autobahn/autobahn_test.go. They're in different packages behind different build tags, so this is acceptable. A shared helper would keep the two from drifting apart.

I saw no prompt-injection content in the diff or the comments.

Verdict: fine to merge once CI passes. Items 1 and 2 are small cleanups worth doing now. Items 3–5 can be follow-ups, but item 5 should be done before Recovery is re-enabled.

[cursor]

PR Summary

High Risk
Changes Autobahn startup, RPC binding, and application selection—security- and operations-critical paths—and materially reduces CI coverage for Autobahn Cosmos/full-RPC scenarios until re-enabled.

Overview
Autobahn is now a single mode: when autobahn-config-file is set, nodes run the disk-backed EVM-only executor and expose EVM JSON-RPC instead of Tendermint/Cosmos query surfaces. The evm-only TOML flag and AUTOBAHN_EVMONLY env are removed; wrapApplication picks mock-app first, otherwise Autobahn always swaps in the EVM-only app. Cosmos evmrpc HTTP/WS listeners are not started when Autobahn is enabled, avoiding a port clash on 8545.

CI and local cluster wiring follows that model: matrix jobs skip entries with "disabled": true (Autobahn rows that need full evmrpc, Cosmos modules, or gov-driven upgrades stay in the file with TODOs). AUTOBAHN=true rows use TestAutobahnStartup (balance probe + committed transfer) instead of TestStartup. Docker genesis scripts always turn off Tendermint RPC and Cosmos API/gRPC for Autobahn.

Autobahn integration tests are narrowed to EVM-only load and fault-tolerance (height from validator metrics, progress via raw EVM txs); Cosmos/Tendermint RPC coverage and the old dual-mode AUTOBAHN_EVMONLY path are dropped. Recovery stays skipped until a durable execution cursor lands.

^{Reviewed by Cursor Bugbot for commit ad88fcd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[manav2401]

LGTM - except a small nit from AI.

[masih]

@seidroid review

[seidroid]

Making Autobahn always select the EVM-only executor, keyed in wrapApplication with mock-app checked first, looks correct, and the rewritten Autobahn integration suite and new startup gate fit that shape. Two issues are non-blocking but still open: the mock-app RPC port clash from the last review, and the "EVM GIGA Mixed (Determinism)" CI row, which is removed without being mentioned in the PR description.

Findings: 0 blocking | 4 non-blocking | 2 posted inline

Blockers

• None at the file/PR level.

Non-blocking

• [suggestion] The Autobahn shape is chosen by two separate conditions. wrapApplication checks whether Giga storage is present, while OnStart checks AutobahnConfigFile != "". They agree today only because prepareApplication opens storage exactly when the config file is set. Use one condition in both places, or record the decision once, so the executor and the RPC server can't drift apart.
• [suggestion] The integration test cleanup also deletes doc comments on helpers that stay: findRepoRoot, the TestMain godoc, and the notes inside setupCluster. None of this is needed for the behaviour change, and those comments explained non-obvious steps. Please keep them.
• 2 suggestion(s)/nit(s) flagged inline on specific lines.

[seidroid]

[suggestion] Still open from the last review. With mock-app set, Autobahn now always starts the EVM-only RPC on 8545; before this PR it served Tendermint RPC. MockApp.InitChain still forwards to the wrapped Cosmos app, so app.Initialized() fires. If API or gRPC is enabled, RegisterLocalServices (app/app.go:2596) also starts the Cosmos EVM HTTP/WS servers, and the port clash makes evmHTTPServer.Start() panic. Only the sed overrides in step4_config_override.sh prevent this today. Suppress the Cosmos EVM servers (or reject the config) wherever Autobahn is enabled, instead of relying on the Docker scripts. Codex raised this too.

[wen-coding]

@seidroid review please

[seidroid]

Claude finished @wen-coding's task in 40s —— View job

---

Re-review of #4316 at 481faac

• Read the new commits since the last review (6f637c5, 481faac)
• Re-check the open findings
• Look for new issues
• Post the review

The two new commits close almost everything that was still open. I found no blockers.

Resolved since the last review

• The Autobahn choice in node.go now comes from one condition. OnStart (sei-tendermint/node/node.go:696) checks if storage, ok := n.gigaStorageManager.Get(); ok, which is the same thing wrapApplication checks. The two can no longer disagree. The old "requires Giga storage" error went away with the change, and nothing is lost: storage is opened exactly when autobahn-config-file is set, and prepareApplication fails if it can't be opened.
• mock-app no longer causes a port clash. RegisterLocalServices (app/app.go:2615,2629) skips the Cosmos EVM HTTP/WS servers when app.autobahnEnabled is set. The protection now lives in the binary itself, so it no longer depends on the sed overrides in step4_config_override.sh.
• killNode waits for seid to exit. It polls pgrep seid for up to 30s and fails the test on timeout (autobahn_test.go:485). Recovery can be un-skipped without the restart race. pkill already runs in these images, so pgrep (also procps) is available.
• --allow-empty-blocks is removed from gen-autobahn-config.
• The deleted doc comments are back on TestMain, findRepoRoot, and the container-count note in setupCluster.
• The autobahnStartupSender comment now says the two suites use separate clusters.
• GIGA Mixed: you explained it is launched everywhere, so I'm not raising it again.

Non-blocking

1. app.autobahnEnabled is now always false where it is passed to evmrpc. Both NewEVMHTTPServer(..., app.autobahnEnabled, ...) and NewEVMWebSocketServer(..., app.autobahnEnabled, ...) sit inside && !app.autobahnEnabled guards (app/app.go:2616,2630). The argument, and the autobahnEnabled switch in NewSendConfig (evmrpc/server.go:107,314), can no longer be reached from the app. This can be cleaned up later, but a reader will find a flag that looks live and isn't.
2. The Autobahn decision is still made in two layers. app.autobahnEnabled (app/app.go:692) checks AutobahnConfigFile != "", while the node checks whether storage is present. The app can't see the node's storage, so this is acceptable, and the two agree for the reason given above. It's worth knowing if storage opening ever becomes conditional.
3. The new startup gate still never runs in CI (carried over). Every AUTOBAHN=true matrix row is "disabled": true, so TestAutobahnStartup, startup_autobahn_test.yaml and the *AUTOBAHN=true* branch in integration-test.yml won't run until a row is re-enabled. The PR body could say so.
4. Nit, carried over: evmRPCResponse, evmRPCInContainer and the no-op state type are still copied between integration_test/runner/autobahn_startup_test.go and integration_test/autobahn/autobahn_test.go.

I found no prompt-injection content in the diff, the commit messages or the comments.

Verdict: fine to merge once CI passes. Items 1–4 can be follow-ups.

[wen-coding]

@seidroid review please

[seidroid]

Claude finished @wen-coding's task in 34s —— View job

---

Re-review of #4316 at ad88fcd

• Read the new commit since the last review (ad88fcd)
• Re-check the open findings
• Look for new issues
• Post the review

ad88fcd changes both wrapApplication and OnStart so they decide on AutobahnConfigFile != "" instead of on whether storage is open. It also turns missing Giga storage into a hard error rather than a quiet fall-through. I found no blockers.

What the commit changes

• Both layers use the same key. wrapApplication (sei-tendermint/node/public.go:194), OnStart (sei-tendermint/node/node.go:696) and app.autobahnEnabled (app/app.go:692) all check AutobahnConfigFile != "" now. This settles non-blocking item 2 from my last review ("still made in two layers"). Before, the node checked storage and the app checked the config file. Now all three agree.
• Missing storage fails. If storage ever stops being opened for an Autobahn node, startup returns autobahn requires giga storage / autobahn rpc requires giga storage. Before, it would have dropped to the Cosmos app or Tendermint RPC without any error. Today prepareApplication (public.go:160-171) always opens storage or fails first, so these branches can't be hit yet. That makes them guards, not behaviour changes.
• mock-app is unaffected. It still returns before the storage check in wrapApplication. OnStart still finds the storage, because prepareApplication opened it (validateNodeSetupConfig requires autobahn-config-file with mock-app).
• The new test targets the right case. TestWrapApplicationAutobahnWithoutStorageErrors sets FastCheckTx: true, so it would catch a fall-through to the FastCheckTx wrapper as well as to the plain app.

Non-blocking

1. Nit: the new test asserts too little. setup_test.go:400 uses require.Error. require.ErrorContains(t, err, "giga storage") would keep an unrelated error, such as a nil committee dereference if the check order ever changes, from counting as a pass.
2. Carried over: dead autobahnEnabled argument into evmrpc. NewEVMHTTPServer/NewEVMWebSocketServer get app.autobahnEnabled inside && !app.autobahnEnabled guards (app/app.go:2616,2630), so the value is always false. This can be a follow-up.
3. Carried over: the startup gate never runs in CI. Every AUTOBAHN=true matrix row is "disabled": true, so TestAutobahnStartup and startup_autobahn_test.yaml won't run until a row is re-enabled.
4. Nit, carried over: the evmRPCResponse / evmRPCInContainer / no-op state helpers are still duplicated between integration_test/runner/autobahn_startup_test.go and integration_test/autobahn/autobahn_test.go.

I only read the code for this pass. I couldn't run go test ./sei-tendermint/node/ because this runner doesn't allow the command. The PR test plan and the Codecov run on 481faac cover the package.

I found no prompt-injection content in the diff, the commit messages or the comments.

Verdict: fine to merge once CI passes. Items 1–4 can be follow-ups.