feat(node): wire the finalized signed-block source into the API server

The API exposes /lean/v0/blocks/finalized so checkpoint-syncing peers can
fetch the (state, signed block) anchor pair, but the live node never
supplied a signed-block source, so the endpoint always returned 503.

The store and database retain only unsigned blocks, and the receiving peer
pairs the block with the finalized state without verifying its proof. Wrap
the looked-up block in an empty proof, matching the genesis anchor that no
proposer ever signed.

Author: MegaRedHand

src/lean_spec/node/node.py

@@ -44,7 +44,8 @@
     Validators,
 )
 from lean_spec.spec.forks.lstar.config import ATTESTATION_COMMITTEE_COUNT
-from lean_spec.spec.ssz import Bytes32, Uint64
+from lean_spec.spec.forks.lstar.containers import MultiMessageAggregate
+from lean_spec.spec.ssz import ByteList512KiB, Bytes32, Uint64
 
 logger = logging.getLogger(__name__)
 
@@ -310,13 +311,29 @@ def from_genesis(cls, config: NodeConfig) -> Node:
         # Create API server if configured
         api_server: ApiServer | None = None
         if config.api_config is not None:
+
+            def signed_block_for_root(block_root: Bytes32) -> SignedBlock | None:
+                # The store and database retain only unsigned blocks.
+                # Wrap the looked-up block in an empty proof to serve the
+                # checkpoint-sync anchor pair.
+                # The receiving peer pairs the block with the finalized state
+                # and never verifies this proof, so an empty one suffices.
+                block = sync_service.store.blocks.get(block_root)
+                if block is None:
+                    return None
+                return SignedBlock(
+                    block=block,
+                    proof=MultiMessageAggregate(proof=ByteList512KiB(data=b"")),
+                )
+
             # The admin API reads and mutates the sync service aggregator flag,
             # letting operators rotate the role at runtime without a restart.
             # Store getter captures sync_service to get the live store.
             api_server = ApiServer(
                 config=config.api_config,
                 spec=fork,
                 store_getter=lambda: sync_service.store,
+                signed_block_getter=signed_block_for_root,
                 aggregator_role_control=sync_service,
             )
 

tests/node/test_node.py

@@ -40,10 +40,12 @@
     JustificationRoots,
     JustificationValidators,
     JustifiedSlots,
+    MultiMessageAggregate,
+    SignedBlock,
     Validators,
 )
 from lean_spec.spec.forks.lstar.spec import LstarSpec
-from lean_spec.spec.ssz import Bytes32, Uint64
+from lean_spec.spec.ssz import ByteList512KiB, Bytes32, Uint64
 
 GENESIS_TIME = Uint64(1704067200)
 
@@ -295,6 +297,37 @@ def test_api_server_none_when_no_config(self, node_config: NodeConfig) -> None:
         node = Node.from_genesis(node_config)
         assert node.api_server is None
 
+    def test_api_server_serves_finalized_signed_block(self, node_config: NodeConfig) -> None:
+        """The wired signed-block source returns the finalized block in an empty proof."""
+        config = dataclasses.replace(
+            node_config, api_config=ApiServerConfig(host="127.0.0.1", port=5052)
+        )
+        node = Node.from_genesis(config)
+        assert node.api_server is not None
+        assert node.api_server.signed_block_getter is not None
+
+        store = node.api_server.store
+        assert store is not None
+        finalized_root = store.latest_finalized.root
+
+        assert node.api_server.signed_block_getter(finalized_root) == SignedBlock(
+            block=store.blocks[finalized_root],
+            proof=MultiMessageAggregate(proof=ByteList512KiB(data=b"")),
+        )
+
+    def test_api_server_signed_block_source_returns_none_for_unknown_root(
+        self, node_config: NodeConfig
+    ) -> None:
+        """The wired signed-block source returns None for a root the store does not hold."""
+        config = dataclasses.replace(
+            node_config, api_config=ApiServerConfig(host="127.0.0.1", port=5052)
+        )
+        node = Node.from_genesis(config)
+        assert node.api_server is not None
+        assert node.api_server.signed_block_getter is not None
+
+        assert node.api_server.signed_block_getter(Bytes32.zero()) is None
+
     def test_validator_service_created_when_registry_provided(
         self, node_with_validator: Node
     ) -> None: