[gjermundgaraba]

Description

Selecting a remote prover previously replaced the configured light-client type with remote, forcing deployment config merging to skip its client-type consistency check. This change keeps the declared client type and moves the prover endpoint into a separate remoteProver block, so the same manifest comparison applies to local and remote proving:

# before                            # after
type: "remote"                      type: "besu-qbft"   # or any type, e.g. "op-stack"
params:                             remoteProver:
  url: https://prover.example.com     url: https://prover.example.com
  tls:                                tls:
    caFile: /etc/ibc/tls/ca.crt         caFile: /etc/ibc/tls/ca.crt

Why this is useful

• Consistent deployment checks. When merging an existing connection, ibc deploy render-config compares each declared client type with the deployment manifest and rejects a mismatch. Remote proving no longer needs an exemption. This compares configuration records; it does not verify the type against the chain or the ProverService.
• Metrics keep the declared client type. Remotely proven ends carry their configured type instead of all being labelled type=remote.
• Less config machinery. Removing params, whose only settings were the remote URL and TLS options, also removes the empty per-type structs, interface methods and decoder.
• Shared endpoint handling. Provers reuse remote-attestor URL/TLS helpers: bare host:port uses HTTP, https:// enables TLS, and other URL schemes fail validation.

The prover interface, the ProverService proto and the relay pipeline are unchanged.

The docs generator now marks a key that is required inside a block the file can leave out as "required in <block>" (today only remoteProver.url), so the configuration reference no longer suggests every client end needs a remoteProver. Its unused OPAQUE_TYPES hook, which only served params, is removed.

Most important to review: cli/internal/config/relayer.go (fields and validation) and cli/internal/relay/prover/prover.go (newProver).

closes: FOU-1893

This came out of FOU-1699, which was closed without adopting its trusted-height parameter; this is the config cleanup from that work.

Breaking changes

• type: remote with params is replaced by the client's declared light-client type plus a remoteProver block with the same url and tls keys. Without a remoteProver, type must be attestation or besu-qbft; with one, any non-empty type is accepted.
• The params block is removed. An old params: key now fails to load as an unknown field.
• A remoteProver.url with a scheme other than http or https is rejected.
• The prover metrics type label for ProverService-backed ends is the declared client type instead of remote.

Validation

• go test ./... in cli passes on this commit. refgen --check reports the docs up to date.
• golangci-lint run (Go 1.26.9) reports no issues.
• e2e: TestRemoteProver_* (3) pass on the latest commit. The Besu QBFT tests (TestDeployBesuQBFTConnection, TestTransferBesuQBFT_AutoRelay, TestTransferBesuQBFT_TimeoutRefund) passed in complete mode before the rebase onto feat: Add TLS support #1503 (TLS) and the later config edits. The fast suite has not been rerun since.
• docs/6-ibc-cli/tools/test-refgen-e2e.py: 67 passed, including a new case for the "required in remoteProver" rendering.
• docs/6-ibc-cli/tools/test-refgen.py: 88 passed, 1 failed. The failure is on TLSClientConfig, as on main since feat: Add TLS support #1503; nothing in this PR adds to it.

---

• Linked to GitHub issue with discussion and accepted design, OR link to spec that describes this work. Linear FOU-1893.
• Include changelog entry when appropriate (e.g. chores should be omitted from changelog). n/a: CHANGELOG.md does not track CLI changes yet.
• Wrote unit and e2e tests if relevant. Config validation and prover setup unit tests; the e2e harness now writes a remoteProver block.
• Updated documentation (docs/) if anything is changed. Configuration reference regenerated, with a hand-written paragraph on remoteProver below the connections table; Besu light client page and otel README updated.
• Added godoc comments if relevant.
• Self-reviewed Files changed in the GitHub PR explorer.
• Provide a conventional commit message to follow the repository standards.

🤖 Generated with Claude Code

[github-actions]

Vulnerable dependencies

2 advisories across 2 libraries need attention, 2 accepted.

🚨 Needs attention

github.com/cosmos/evm

In use: v0.7.3 — reached from e2e

Advisory	CVE	Fixed in	Summary
GO-2025-3684	—	no fix yet	Cosmos EVM Allows Partial Precompile State Writes in github.com/cosmos/evm

Go standard library

In use: go1.26.9 — reached from cli, e2e, gen/go/solidity-abi

Advisory	CVE	Fixed in	Summary
GO-2026-6809	CVE-2026-111943	go1.26.10	Distrust compromised intermediate certificates in crypto/x509

Run make vulncheck for the call paths. Either upgrade the library, or add the
advisory to .govulncheck-ignore with a reason if no fix exists yet.

Accepted

Listed in .govulncheck-ignore with a reason.

github.com/pion/dtls/v2

In use: v2.2.12 — reached from cli

Advisory	CVE	Fixed in	Summary
GO-2026-4479	CVE-2026-26014	no fix yet	Usage of random nonce generation with AES GCM ciphers risks leaking the authentication key in github.com/pion/dtls

golang.org/x/crypto

In use: v0.57.0 — reached from cli, e2e

Advisory	CVE	Fixed in	Summary
GO-2026-5932	—	no fix yet	The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

_{From make vulncheck-json on this run: logs.}

[linear-code]

FOU-1893

[gjermundgaraba]

...

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge.

Summary

Moves remote proving from type: remote and params into remoteProver, while keeping the declared light-client type.

• A client keeps its on-chain type while remoteProver chooses who generates its proofs.
• Deployment config keeps and checks each client's declared type.
• Prover metrics label work with the client's declared type.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Client end] --> B{remoteProver present?}
  B -->|Yes| C[Resolve endpoint and TLS]
  C --> D[Remote ProverService]
  B -->|No| E[Select built-in prover by type]
  D --> F[Record metrics with declared client type]
  E --> F

Loading

_{Reviews (2) · Last reviewed commit: "refactor(cli)!: name the ProverService b..." · Reviewed by Greptile}

[dianab-cl]

DCO Sign-off not found

[gjermundgaraba]

@greptile review