feat(eip8130): phased call execution + policy gate + full fee settlement

[chunter-cb]

Summary

Drives an EIP-8130 transaction's calls (Vec<Vec<Call>>) as real EVM call frames after the pre-call pipeline, adds the actor policy gate, and reworks gas/fee settlement to route the full fee.

• Phased call execution — phases share a single gas pool (gas_limit - sender_intrinsic) and commit independently in sequence. Calls within a phase are atomic; if any call reverts (or is policy-gated), that phase's state is discarded and every later phase is skipped, but the tx is still included (nonce consumed, fee paid). Each call dispatches from sender to call.to with msg.value == 0 and tx.origin == sender.
• Transaction context — publishes sender / payer / sender_actor_id to TxContextStorage before dispatching calls.
• Policy gate — resolves the sender actor's policy manager once; gates every call.to, reverting the phase with ActorPolicyViolation(bytes32,address) on mismatch.
• Full fee settlement — pre-charges the worst case (gas + L1 + operator), caps the refund per EIP-3529, then routes base fee, priority tip, L1 cost, and operator fee to their vaults and refunds the surplus to the payer.
• Status — overall transaction outcome reported via ExecutionResult::Success / Revert.

EIP-8037 (Amsterdam) maps to ForkCondition::Never on Base, so the state-gas reservoir is always zero and is not threaded through call frames.

Test plan

• eoa_self_pay_transaction_executes_and_charges_sender
• underfunded_payer_is_rejected
• single_phase_call_executes_against_contract_code
• reverting_call_includes_tx_with_revert_status
• later_phase_skipped_after_earlier_phase_reverts
• policy_gate_blocks_call_to_unauthorized_target
• policy_gate_allows_call_to_authorized_target
• actor_policy_violation_data_is_abi_encoded
• cargo clippy --features std --all-targets clean
• cargo check --no-default-features (no_std) compiles

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[github-actions]

Review Summary — EIP-8130 Phased Call Execution

Overall: Well-structured implementation. The pre-charge / settle / refund architecture is sound, the checkpoint nesting is correct, and the test coverage (including the cross-call refund cancellation test) is thorough. Several issues from the prior review round have been addressed in the current code (checked arithmetic on payer refund, clear_tx_l1_cost() on error paths, local_mut().clear() / frame_stack().clear() on the success path). The remaining inline comments are mostly spec-confirmation requests rather than bugs.

Already addressed (no action needed)

• Payer refund overflow — now uses checked_add with error propagation (line 754), matching the checked-arithmetic discipline elsewhere.
• Selector precomputation — SELECTOR is a const [u8; 4] (line 789), pinned by the actor_policy_violation_data_is_abi_encoded test.
• L1 cost cache clearing — all post-prepay error paths call clear_tx_l1_cost().
• Post-commit cleanup — local_mut().clear() and frame_stack().clear() are called on the success path (lines 268–269).
• Gas pool checked_sub — pool decrement uses checked_sub with an explicit error (line 555), not saturating_sub.

Open items from inline comments worth confirming

#	Area	Nature
1	Error-path cleanup (lines 237–242, 249–253)	execute_calls and settle_fees error paths clear the L1 cost and revert the checkpoint, but do not call local_mut().clear() / frame_stack().clear(). In practice these errors are only database failures (fatal to block execution), but for defensive parity with the mainnet catch_error handler, consider adding both calls.
2	Journal checkpoint_commit semantics (line 590)	The correctness of the outer-checkpoint revert undoing inner-committed phases depends on checkpoint_commit being "merge into parent" — verify this is the journal's contract.
3	Operator fee linearity assumption (lines 488, 734)	settle_fees recomputes operator cost from scratch with billable_gas rather than using the mainnet charge(gas_limit) - charge(gas_used) delta pattern. Equivalent today (linear), but would diverge under a non-linear fee schedule.
4	Single-hop EIP-7702 delegation (line 628)	run_call resolves one delegation level; a multi-hop chain (delegated target itself delegates) would not be followed. EIP-7702 targets are expected to be concrete contracts, so this is likely fine — confirm against spec.

Tests

The 10 test cases cover the key execution paths well: self-pay, underfunded payer, single-phase call, revert inclusion, phase skipping, policy gate (allow/block), ABI encoding, and cross-call refund cancellation. The cross_call_offsetting_refunds_cancel test is a particularly good regression guard for the signed-refund accounting.

[github-actions]

✅ base-std fork tests: all 616 passed

base/base is fully in sync with the base-std spec.

Dependency	Ref	Commit
base-std	main	4658f1b7
base-anvil	0092692587d8d064dd2c6923ce26a682c58f3694	00926925