Allow capability DONs to include OCR attestation of the responses

[dhaidashenko]

https://smartcontract-it.atlassian.net/browse/PLEX-2611
Supports:

• CRE Don2Don accept OCR attestation of a response chainlink#21607

[github-actions]

✅ API Diff Results - github.com/smartcontractkit/chainlink-common

✅ Compatible Changes (9)

pkg/capabilities (4)

• AttributedSignature — ➕ Added

• ErrResponsePayloadNotAvailable — ➕ Added

• ResponseOCRAttestation — ➕ Added

• ResponseToReportData — ➕ Added

pkg/capabilities.ResponseMetadata (1)

• OCRAttestation — ➕ Added

pkg/capabilities/pb (2)

• AttributedSignature — ➕ Added

• ResponseOCRAttestation — ➕ Added

pkg/capabilities/pb.(*ResponseMetadata) (1)

• GetOcrAttestation — ➕ Added

pkg/capabilities/pb.ResponseMetadata (1)

• OcrAttestation — ➕ Added

---

📄 View full apidiff report

[github-actions]

✅ API Diff Results - github.com/smartcontractkit/chainlink-common/keystore

✅ Compatible Changes (1)

corekeys/ocr2key (1)

• EvmVerifyBlob — ➕ Added

---

📄 View full apidiff report

[Copilot]

Pull request overview

This PR extends the capabilities response metadata to optionally carry an OCR attestation (config digest, sequence number, and attributed signatures), enabling Capability DONs to include OCR-style attestations alongside responses.

Changes:

• Added ocr_attestation (with ResponseOCRAttestation + AttributedSignature) to ResponseMetadata in the capabilities protobuf schema.
• Updated Go capability types and pb helper conversions to serialize/deserialize OCR attestation data.
• Added test coverage for attestation round-tripping and invalid config digest length handling; refactored EVM keyring blob verification into a reusable function.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/capabilities/pb/capabilities_helpers_test.go	Adds subtests for invalid digest length and round-trip conversion including OCR attestation metadata.
pkg/capabilities/pb/capabilities_helpers.go	Adds OCR attestation marshaling/unmarshaling logic to capability response proto helpers.
pkg/capabilities/pb/capabilities.proto	Introduces ocr_attestation on ResponseMetadata and new messages for attestation + signatures.
pkg/capabilities/pb/capabilities.pb.go	Regenerated protobuf Go output for the updated schema.
pkg/capabilities/capabilities.go	Adds OCR attestation types to response metadata and introduces ResponseToReportData hashing helper.
keystore/corekeys/ocr2key/evm_keyring.go	Extracts EVM blob verification into EvmVerifyBlob and reuses it from the keyring method.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Adds OCR attestation metadata support to capability responses so Capability DONs can include verifiable OCR context (config digest, sequence number, signatures) alongside the response.

Changes:

• Extend ResponseMetadata protobuf schema with an optional ocr_attestation message (including attributed signatures).
• Update Go conversion helpers to marshal/unmarshal OCR attestation between internal types and protobuf types, plus add round-trip/validation tests.
• Introduce response-to-report hashing helper and extract EVM blob verification into a reusable function.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pkg/capabilities/pb/capabilities.proto	Adds ResponseOCRAttestation + AttributedSignature and wires it into ResponseMetadata.
pkg/capabilities/pb/capabilities.pb.go	Regenerated protobuf Go types to include the new messages/field.
pkg/capabilities/pb/capabilities_helpers.go	Adds proto ↔ internal mapping for OCR attestation on capability responses.
pkg/capabilities/pb/capabilities_helpers_test.go	Adds validation + round-trip coverage for response OCR attestation conversions.
pkg/capabilities/capabilities.go	Adds internal OCR attestation types and ResponseToReportData hashing helper.
keystore/corekeys/ocr2key/evm_keyring.go	Extracts EVM blob verification into EvmVerifyBlob and reuses it from the keyring method.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bolekk]

Repeating my comment from core PR:

This feels awkward. We are putting two metering fields explicitly. ClientRequest shouldn't handle those details. Could we proto-marshal the whole metadata struct and sign that together with payload? That would mean you have to put signatures outside of metadata - maybe as a third field at the same level as payload and metadata?