feat(cryo): collect the 16 canonical_execution datasets in-process

[Savid]

Replaces the bash-in-a-ConfigMap cryo pipeline with tracker.BlockProcessor implementations. cryo runs as a subprocess — one invocation per block per group, emitting every dataset at once — and the parquet is decoded in Go and inserted columnar via ch-go.

Why one invocation per block

A single cryo call can serve many datasets from the same RPC responses: 101ms for all 16, against 628ms for sixteen separate invocations. A group is therefore also the unit of progress — it succeeds or fails as a whole, so one admin.execution_block row represents one thing that actually happened.

Four granularities stay decoupled: fetch is one block per group, decode is one parquet per dataset, tracking is one ledger row per block, insert is a per-dataset rowbuffer flushed on rows or interval.

Data-integrity fixes over the pipeline this replaces

Block-reward traces	internal_index is a positional counter over parquet file order keyed on the raw transaction hash, with a null hash counted under the key it is stored under rather than dropped. The pandas groupby it replaces dropped null keys, collapsing every reward trace in a block onto one sort key and losing one of the two on pre-merge blocks with uncles.
four_byte_counts	Gains internal_index, so rows differing only by calldata size stop colliding.
Absent vs zero	Genuinely-absent values land as NULL rather than a type default, so "absent" and "zero" stay distinguishable for gas and fee columns.
Silently-empty blocks	cryo answers a block it cannot serve with an empty parquet and exit 0 — indistinguishable from an empty block. Every group now collects blocks as a canary it does not write when it is not a member; it is the one dataset whose row count is knowable in advance, so silence becomes a retryable error.
gas_limit	--include-columns gas_limit is derived from the datasets rather than configured, so it cannot be omitted and silently zeroed.

Correctness details worth a reviewer's attention

• apache/arrow-go for parquet, not parquet-go. v0.30.1 mis-decodes cryo's LZ4_RAW pages and returns empty byte arrays with no error on 3 of 16 datasets. Only parquet/file is imported, never pqarrow, which would link gRPC.
• Parquet stores unsigned integers in signed physical types. The decoder reinterprets the bits and rejects genuinely signed columns at schema time. Treating a set sign bit as corruption would have failed every block from 2038-01-19.
• --hex renders a zero-length byte string as the literal "0x", so the empty-to-NULL guard tests for both.
• The startup schema check runs in both directions — a column the mapping never writes is silently server-defaulted, which is how staging came to hold gas_limit = 0 for every row.

Pre-existing defects fixed on the way

• Manager.checkGaps obtained the limiter through a type switch, so gap detection silently did nothing for any processor it did not enumerate. BlockProcessor gains GetLimiter and the switch is gone.
• MarkBlockComplete hard-coded task_count back to 0, destroying the count written at enqueue.
• QueueBlockManually wrote its own ledger row on top of the processor's, with no complete flag and no task count, leaving manually-queued blocks looking permanently incomplete. It now delegates to ProcessBlock, deleting a second type switch, enqueueSimpleBlockTask and MarkBlockProcessed.

Breaking changes

• StateProvider.MarkBlockComplete takes a task count.
• BlockProcessor gains GetLimiter.
• execution.Node gains RPCEndpoint (returns empty for EmbeddedNode).
• QueueResult loses tasks_created; the queue-block API responses lose the tasks_created field, since the manager no longer enqueues and has nothing to measure. transaction_count remains.

Security

The RPC URL reaches cryo through ETH_RPC_URL rather than argv, which anything sharing the PID namespace can read from /proc, and is redacted from captured stderr.

Packaging

The image gains a static musl cryo built from a pinned commit with a pinned Rust version — both load-bearing, as an unpinned rustc fails to compile a dependency. The release build caches that stage per architecture, since it is emulated for arm64.

Verification

• 142 tests, including golden parquet fixtures for all 16 datasets at three mainnet blocks chosen for coverage: the general case, one with erc721 transfers and anonymous LOG0 logs, and a pre-merge block with an uncle.
• Integration tests insert every dataset into a real ClickHouse and read back exact counts; UInt256 limb order is round-tripped through the server rather than asserted against the code that produced it.
• Run end to end against mainnet: forwards, backwards, and gap detection (hole punched in the ledger, detected and refilled).

Notes for deployment

The debug_traceBlockByNumber-derived datasets differ slightly between execution clients — measured at block 23000000, reth and erigon disagree on balance_reads (641 vs 619), four_byte_counts (278 vs 273) and nonce_diffs (139 vs 163). Keep a deployment on one client family, and note that any verification against existing data only holds against the client that produced it.

🤖 Generated with Claude Code