feat(sepolia): extend Nitro validator cutover task for Sepolia

active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/FACILITATOR.md

@@ -0,0 +1,90 @@
+# Facilitator Guide
+
+Guide for deploying the hinted Nitro validator stack and upgrading the TEE registry on a selected network.
+
+Before running anything, replace every literal `NETWORK_NAME` below with the selected config directory, for example `sepolia`. The Makefile has no default and rejects an inherited or exported `TASK_NETWORK`; every invocation must visibly use `make TASK_NETWORK=<network> <target>`.
+
+## 1. Install dependencies
+
+```bash
+cd active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator
+make TASK_NETWORK=NETWORK_NAME deps
+```
+
+## 2. Deploy contracts
+
+Use the normal funded personal Ledger account:
+
+```bash
+make TASK_NETWORK=NETWORK_NAME deploy-nitro-validator
+VERIFIER_API_KEY=<key> make TASK_NETWORK=NETWORK_NAME verify-nitro-validator
+make TASK_NETWORK=NETWORK_NAME deploy-tee-registry-impl
+VERIFIER_API_KEY=<key> make TASK_NETWORK=NETWORK_NAME verify-tee-registry-impl
+```
+
+This deploys and verifies `P384Verifier`, `CertManager`, `NitroValidator`, and a `TEEProverRegistry` implementation. It writes the addresses to `config/NETWORK_NAME/addresses.json` and chain-keyed deployment records under `records/`.
+
+Review and commit the selected network's addresses and timestamped deployment records before generating validations. Do not modify artifacts from completed network rollouts.
+
+## 3. Generate forward and rollback validations
+
+```bash
+make TASK_NETWORK=NETWORK_NAME gen-validation-cb
+make TASK_NETWORK=NETWORK_NAME gen-validation-sc
+make TASK_NETWORK=NETWORK_NAME gen-validation-cb-rollback
+make TASK_NETWORK=NETWORK_NAME gen-validation-sc-rollback
+```
+
+For a non-mainnet rollout, remove each generated `taskOriginConfig` and add this root field to all four validation files:
+
+```json
+"skipTaskOriginValidation": true
+```
+
+For a mainnet rollout through the proxy admin owner, retain task-origin validation and collect the required task-origin signatures.
+
+Commit the four validation files after reviewing their state diffs.
+
+Record the current nonces for `PROXY_ADMIN_OWNER`, `CB_MULTISIG`, and `BASE_SECURITY_COUNCIL`. Do not allow unrelated transactions from those Safes during the cutover. Regenerate all validations if any nonce changes unexpectedly.
+
+Expected forward state change: the TEE registry EIP-1967 implementation slot changes from `OLD_TEE_PROVER_REGISTRY_IMPL` in `config/NETWORK_NAME/.env` to the implementation in `config/NETWORK_NAME/addresses.json`.
+
+Expected rollback state change: the same slot changes from the new implementation back to `OLD_TEE_PROVER_REGISTRY_IMPL`.
+
+## 4. Collect signatures
+
+Ask signers to run `make sign-task` from the repository root and select the chosen network entry for this task. Collect signatures for all four validation files before cutover.
+
+## 5. Prepare the offchain cutover
+
+Confirm the migrated registrar uses the signer configured as `CERT_MANAGER_REVOKER` in `config/NETWORK_NAME/.env` and retains `BASE_REGISTRAR_CRL_NITRO_VERIFIER_ADDRESS` to enable AWS CRL checks.
+
+Keep the existing registrar and enclaves available for rollback. Stop the old registrar immediately before executing the onchain upgrade.
+
+## 6. Approve and execute the upgrade
+
+```bash
+SIGNATURES=<base-signatures> make TASK_NETWORK=NETWORK_NAME approve-cb
+SIGNATURES=<security-council-signatures> make TASK_NETWORK=NETWORK_NAME approve-sc
+make TASK_NETWORK=NETWORK_NAME execute
+```
+
+## 7. Start the migrated registrar
+
+Start the migrated registrar after the proxy upgrade. Rotate one enclave first so its new ephemeral signer exercises certificate caching and hinted registration. Confirm the new signer is valid before rotating the remaining enclaves.
+
+## 8. Roll back if required
+
+If the migrated registrar path fails, use the rollback signatures collected before cutover:
+
+```bash
+SIGNATURES=<base-rollback-signatures> make TASK_NETWORK=NETWORK_NAME approve-cb-rollback
+SIGNATURES=<security-council-rollback-signatures> make TASK_NETWORK=NETWORK_NAME approve-sc-rollback
+make TASK_NETWORK=NETWORK_NAME execute-rollback
+```
+
+Restart the legacy registrar after the rollback. Do not decommission the legacy Nitro verifier in this task.
+
+## 9. Verify and archive
+
+Verify the live proxy implementation, registry version, Nitro validator links, CertManager custody, registered signer state, and registrar health. Update `config/NETWORK_NAME/README.md` to `Status: [EXECUTED](<transaction-url>)` and commit execution records. Run `make archive-task` from the repository root only after every currently intended network rollout is complete.

archive/evm/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile → active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/Makefile

@@ -1,7 +1,12 @@
 include ../../../../Makefile
 include $(REPO_ROOT)/Multisig.mk
 
-TASK_NETWORK ?= zeronet
+ifneq ($(origin TASK_NETWORK),command line)
+$(error TASK_NETWORK must be set on the make command line; run make TASK_NETWORK=sepolia <target>)
+endif
+ifeq ($(strip $(TASK_NETWORK)),)
+$(error TASK_NETWORK cannot be empty; run make TASK_NETWORK=sepolia <target>)
+endif
 PROJECT_DIR := $(abspath ../..)
 
 include $(REPO_ROOT)/config/$(TASK_NETWORK).env
@@ -10,7 +15,7 @@ include config/$(TASK_NETWORK)/.env
 SIGNER_TOOL_PATH := $(REPO_ROOT)/signer-tool
 VALIDATIONS_DIR := $(CURDIR)/config/$(TASK_NETWORK)/validations
 RPC_URL := $(L1_RPC_URL)
-ADDRESSES_JSON := $(CURDIR)/addresses.json
+ADDRESSES_JSON := $(CURDIR)/config/$(TASK_NETWORK)/addresses.json
 DEPLOYER = $(shell $(MISE_EXEC) cast wallet address --ledger --mnemonic-derivation-path $(LEDGER_HD_PATH))
 
 DEPLOY_NITRO_SCRIPT := tasks/2026-08-19-upgrade-tee-registry-nitro-validator/script/DeployNitroValidatorStack.s.sol:DeployNitroValidatorStack

active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/.env

@@ -0,0 +1,11 @@
+# https://github.com/base/contracts/commit/8897196c2a77b04fe69e47e158c6c112a936d65c
+BASE_CONTRACTS_COMMIT=8897196c2a77b04fe69e47e158c6c112a936d65c
+RECORD_STATE_DIFF=true
+
+# New CertManager custody.
+CERT_MANAGER_OWNER=0x646132A1667ca7aD00d36616AFBA1A28116C770A
+CERT_MANAGER_REVOKER=0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3
+
+# Rollback anchors verified against Sepolia before task creation.
+OLD_TEE_PROVER_REGISTRY_IMPL=0xF9Ab55c35cE7Fb183A50E611B63558499130D849
+OLD_NITRO_VERIFIER=0x7D8EA07DB94128DBEe66bAfa3eBAa9668B413d72

active/evm/tasks/2026-08-19-upgrade-tee-registry-nitro-validator/config/sepolia/README.md

@@ -0,0 +1,28 @@
+# Upgrade TEE Registry to Hinted Nitro Validation
+
+Status: READY TO SIGN
+
+## Description
+
+Deploy the hinted Nitro validator stack and upgrade the existing `TEEProverRegistry` proxy to an implementation that validates registrations through it.
+
+The registry proxy and all existing signer, proposer, owner, manager, game type, and image-hash storage remain unchanged.
+
+## Custody
+
+| Role | Address |
+| -- | -- |
+| `CertManager` owner | `0x646132A1667ca7aD00d36616AFBA1A28116C770A` |
+| `CertManager` revoker | `0x8074b32bD7d06C8f27596F3D6fbf867A36eA22a3` |
+| ProxyAdmin owner | `0x0fe884546476dDd290eC46318785046ef68a0BA9` |
+| TEE registry proxy | `0xf0d7E15673fBA052e83d7f2b26BB6071E86b972e` |
+
+## Sign
+
+From the repository root:
+
+```bash
+make sign-task
+```
+
+Select this Sepolia task and sign both the forward and rollback transactions. Send the signatures to the facilitator.