From b2c407426c3480d4c3601e95fd902f758f8ccb4a Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Tue, 3 Mar 2026 18:22:34 +0000
Subject: [PATCH 01/11] Add updates

---
 .env.devnet                | 6 +++---
 deploy-surge-full.sh       | 2 +-
 docker-compose.yml         | 4 ++--
 script/start-nethermind.sh | 3 ++-
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 73a0458a..1875eddd 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -1,10 +1,10 @@
 ############################### IMAGES #####################################
 PACAYA_PROTOCOL_IMAGE=nethermind/catalyst-taiko-protocol:taiko-alethia-protocol-v2.3.1-new
 PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
-NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-d6befe8
+NETHERMIND_CLIENT_IMAGE=nethermind-local:latest
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:pr-260-3b8a522d
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-76f481b
+RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-2c8a647
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
@@ -243,7 +243,7 @@ BLOCK_CONFIRMATIONS=
 # without the original prover submitting a proof.).
 PROVE_UNASSIGNED_BLOCKS=false
 # Time interval to poll proofs from raiko host.
-PROOF_POLLING_INTERVAL=
+PROOF_POLLING_INTERVAL=3s
 
 # If you want to be a proposer who proposes L2 execution engine's transactions in mempool to Taiko L1 protocol
 # contract (be a "mining L2 node"), you need to change `ENABLE_PROPOSER` to true, then fill `L1_PROPOSER_PRIVATE_KEY`.
diff --git a/deploy-surge-full.sh b/deploy-surge-full.sh
index 8d366423..3f03d0cd 100755
--- a/deploy-surge-full.sh
+++ b/deploy-surge-full.sh
@@ -1533,7 +1533,7 @@ generate_l2_genesis() {
 
     update_env_var "$ENV_FILE" "SHASTA_TIMESTAMP" "$HEX_TIMESTAMP"
 
-    cat "$SURGE_GENESIS_FILE" | jq --arg hex_timestamp "$HEX_TIMESTAMP" '. * {difficulty: 0, config: {taiko: true, londonBlock: 0, ontakeBlock: 0, pacayaBlock: 1, shastaTimestamp: $hex_timestamp, feeCollector: "0x0000000000000000000000000000000000000000", shanghaiTime: 0}} | del(.config.clique)' | jq --from-file <(curl -s https://raw.githubusercontent.com/NethermindEth/core-scripts/refs/heads/main/gen2spec/gen2spec.jq) | jq --arg hex_timestamp "$HEX_TIMESTAMP" '.engine.Taiko.shastaTimestamp = $hex_timestamp' > "$DEPLOYMENT_DIR/surge_chainspec.json"
+    cat "$SURGE_GENESIS_FILE" | jq --arg hex_timestamp "$HEX_TIMESTAMP" '. * {difficulty: 0, config: {taiko: true, londonBlock: 0, ontakeBlock: 0, pacayaBlock: 1, shastaTimestamp: $hex_timestamp, feeCollector: "0x0000000000000000000000000000000000000000", shanghaiTime: 0}} | del(.config.clique)' | jq --from-file <(curl -s https://raw.githubusercontent.com/NethermindEth/core-scripts/refs/heads/main/gen2spec/gen2spec.jq) | jq --arg hex_timestamp "$HEX_TIMESTAMP" '.engine.Taiko.shastaTimestamp = $hex_timestamp' | jq '.params.rip7728TransitionTimestamp = "0x0"' > "$DEPLOYMENT_DIR/surge_chainspec.json"
     
     echo
     echo "╔══════════════════════════════════════════════════════════════╗"
diff --git a/docker-compose.yml b/docker-compose.yml
index 0518ceba..83e92896 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,7 +51,7 @@ services:
     image: ${NETHERMIND_CLIENT_IMAGE}
     container_name: l2-nethermind-execution-client
     restart: unless-stopped
-    pull_policy: always
+    pull_policy: never
     stop_grace_period: 3m
     tty: true
     volumes:
@@ -292,7 +292,7 @@ services:
       BASE_CONFIG_FILE: "config.json"
       BASE_CHAINSPEC_FILE: "chain_spec_list_default.json"
       REDIS_URL: "redis://redis-zk:6379"
-      RUST_LOG: "info"
+      RUST_LOG: "info,alethia_reth_evm=info,raiko_lib=info,raiko_core=info"
       MOCK_KEY: ${PRIVATE_KEY}
       ZK: "true"
     entrypoint:
diff --git a/script/start-nethermind.sh b/script/start-nethermind.sh
index b0eb7b16..98755a00 100755
--- a/script/start-nethermind.sh
+++ b/script/start-nethermind.sh
@@ -35,7 +35,8 @@ ARGS="${ARGS} \
     --HealthChecks.Enabled=true \
     --Pruning.PruningBoundary=1000 \
     --log=${EL_LOG_LEVEL} \
-    --logger-config=/nethermind/NLog.config"
+    --logger-config=/nethermind/NLog.config \
+    --Surge.L1EthApiEndpoint=${L1_ENDPOINT_HTTP}"
 
 echo "Starting Nethermind Execution Client with args: ${ARGS}"
 exec ./Nethermind.Runner ${ARGS}

From 3a33a717fd6be1a8fbb385889ca06a9037405e61 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Wed, 4 Mar 2026 12:12:37 +0000
Subject: [PATCH 02/11] Fix

---
 deploy-surge-full.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/deploy-surge-full.sh b/deploy-surge-full.sh
index 3f03d0cd..0f912500 100755
--- a/deploy-surge-full.sh
+++ b/deploy-surge-full.sh
@@ -1543,7 +1543,15 @@ generate_l2_genesis() {
 
     log_info "Fetching genesis hash..."
     # Get genesis hash first by running Nethermind with the chainspec
-    docker run -d --name nethermind-genesis-hash -v ./deployment/surge_chainspec.json:/chainspec.json "${NETHERMIND_CLIENT_IMAGE}" --config=none --Init.ChainSpecPath=/chainspec.json
+    # Pass L1 endpoint so NMC can initialize L1SLOAD (RIP-7728) when enabled in chainspec
+    local l1_rpc_docker="${L1_ENDPOINT_HTTP_DOCKER:-http://host.docker.internal:32003}"
+    docker run -d --name nethermind-genesis-hash \
+        --add-host=host.docker.internal:host-gateway \
+        -v ./deployment/surge_chainspec.json:/chainspec.json \
+        "${NETHERMIND_CLIENT_IMAGE}" \
+        --config=none \
+        --Init.ChainSpecPath=/chainspec.json \
+        --Surge.L1EthApiEndpoint="$l1_rpc_docker"
     
     sleep 30
 

From 54436f85cb2f34fd7ac68e543110f1e17307b1ae Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Thu, 5 Mar 2026 12:39:45 +0000
Subject: [PATCH 03/11] Add updates

---
 .env.devnet        | 2 +-
 docker-compose.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 1875eddd..21d64152 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -4,7 +4,7 @@ PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermind-local:latest
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:pr-260-3b8a522d
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-2c8a647
+RAIKO_IMAGE=raiko-local:latest
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
diff --git a/docker-compose.yml b/docker-compose.yml
index 83e92896..ede54c35 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -280,7 +280,7 @@ services:
     image: ${RAIKO_IMAGE}
     container_name: l2-raiko-zk-client
     restart: unless-stopped
-    pull_policy: always
+    pull_policy: never
     volumes:
       - ./configs:/raiko/config
     ports:

From 93401924ffc6e36367973f491bf9d4a1e14da5e2 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Tue, 10 Mar 2026 08:12:33 +0000
Subject: [PATCH 04/11] chore: revert docker-compose.yml merge changes and set
 raiko image to latest surge-raiko

---
 .env.devnet        | 2 +-
 docker-compose.yml | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.env.devnet b/.env.devnet
index 3f06055c..45aa3fb2 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -4,7 +4,7 @@ PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-334488b
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:pr-260-3b8a522d
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=raiko-local:latest
+RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-eec7472
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
diff --git a/docker-compose.yml b/docker-compose.yml
index daf1d830..ede54c35 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -221,6 +221,10 @@ services:
       TAIKO_WRAPPER_ADDRESS: ${PACAYA_TAIKO_WRAPPER}
       FORCED_INCLUSION_STORE_ADDRESS: ${PACAYA_FORCED_INCLUSION_STORE}
       TAIKO_BRIDGE_L2_ADDRESS: ${SHASTA_BRIDGE}
+      MAX_BLOCKS_PER_BATCH: 1
+      PRECONF_MIN_TXS: 1
+      MIN_BYTES_PER_TX_LIST: 128
+      RUST_LOG: "info"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     networks:

From 92d3cd526320d0be02333ce72db415c9a6fd7957 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Tue, 10 Mar 2026 08:15:49 +0000
Subject: [PATCH 05/11] Add fixes

---
 .env.devnet        |  2 +-
 docker-compose.yml | 10 +++-------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 45aa3fb2..938c4bf0 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -4,7 +4,7 @@ PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-334488b
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:pr-260-3b8a522d
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-eec7472
+RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-428c940
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
diff --git a/docker-compose.yml b/docker-compose.yml
index ede54c35..3a43956e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -51,7 +51,7 @@ services:
     image: ${NETHERMIND_CLIENT_IMAGE}
     container_name: l2-nethermind-execution-client
     restart: unless-stopped
-    pull_policy: never
+    pull_policy: always
     stop_grace_period: 3m
     tty: true
     volumes:
@@ -221,10 +221,6 @@ services:
       TAIKO_WRAPPER_ADDRESS: ${PACAYA_TAIKO_WRAPPER}
       FORCED_INCLUSION_STORE_ADDRESS: ${PACAYA_FORCED_INCLUSION_STORE}
       TAIKO_BRIDGE_L2_ADDRESS: ${SHASTA_BRIDGE}
-      MAX_BLOCKS_PER_BATCH: 1
-      PRECONF_MIN_TXS: 1
-      MIN_BYTES_PER_TX_LIST: 128
-      RUST_LOG: "info"
     extra_hosts:
       - "host.docker.internal:host-gateway"
     networks:
@@ -280,7 +276,7 @@ services:
     image: ${RAIKO_IMAGE}
     container_name: l2-raiko-zk-client
     restart: unless-stopped
-    pull_policy: never
+    pull_policy: always
     volumes:
       - ./configs:/raiko/config
     ports:
@@ -292,7 +288,7 @@ services:
       BASE_CONFIG_FILE: "config.json"
       BASE_CHAINSPEC_FILE: "chain_spec_list_default.json"
       REDIS_URL: "redis://redis-zk:6379"
-      RUST_LOG: "info,alethia_reth_evm=info,raiko_lib=info,raiko_core=info"
+      RUST_LOG: "info"
       MOCK_KEY: ${PRIVATE_KEY}
       ZK: "true"
     entrypoint:

From e536abf03817486504fee6a984be662eb3fb5e78 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Wed, 11 Mar 2026 09:44:18 +0000
Subject: [PATCH 06/11] Update version

---
 .env.devnet | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 938c4bf0..156855e8 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -2,7 +2,7 @@
 PACAYA_PROTOCOL_IMAGE=nethermind/catalyst-taiko-protocol:taiko-alethia-protocol-v2.3.1-new
 PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-334488b
-TAIKO_CLIENT_IMAGE=nethermind/taiko-client:pr-260-3b8a522d
+TAIKO_CLIENT_IMAGE=nethermind/taiko-client:surge-shasta-0933c0f9
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
 RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-428c940
 
@@ -243,7 +243,7 @@ BLOCK_CONFIRMATIONS=
 # without the original prover submitting a proof.).
 PROVE_UNASSIGNED_BLOCKS=false
 # Time interval to poll proofs from raiko host.
-PROOF_POLLING_INTERVAL=3s
+PROOF_POLLING_INTERVAL=
 
 # If you want to be a proposer who proposes L2 execution engine's transactions in mempool to Taiko L1 protocol
 # contract (be a "mining L2 node"), you need to change `ENABLE_PROPOSER` to true, then fill `L1_PROPOSER_PRIVATE_KEY`.

From 6ef4b9c991a2c591e17e1b942484a06fa62283a8 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Thu, 12 Mar 2026 09:12:06 +0000
Subject: [PATCH 07/11] Update raiko to the new image and other fixes

---
 .env.devnet          |   2 +-
 deploy-surge-full.sh |   7 ++
 remove-surge-full.sh | 223 +++++++++++++++++++++++++------------------
 3 files changed, 140 insertions(+), 92 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 156855e8..4fd75982 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -4,7 +4,7 @@ PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-334488b
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:surge-shasta-0933c0f9
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-428c940
+RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-70e531a
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
diff --git a/deploy-surge-full.sh b/deploy-surge-full.sh
index 2a18d6f7..19ccc423 100755
--- a/deploy-surge-full.sh
+++ b/deploy-surge-full.sh
@@ -1103,6 +1103,13 @@ trap cleanup EXIT
 generate_prover_chain_spec() {
     log_info "Generating prover chain spec list json..."
 
+    # Sanitize "null" values from jq extraction (mock mode may not deploy real verifiers)
+    local zero_addr="0x0000000000000000000000000000000000000000"
+    [[ "${SHASTA_SP1_VERIFIER:-}" == "null" || -z "${SHASTA_SP1_VERIFIER:-}" ]] && export SHASTA_SP1_VERIFIER="$zero_addr"
+    [[ "${SHASTA_RISC0_VERIFIER:-}" == "null" || -z "${SHASTA_RISC0_VERIFIER:-}" ]] && export SHASTA_RISC0_VERIFIER="$zero_addr"
+    [[ "${PACAYA_SP1_RETH_VERIFIER:-}" == "null" || -z "${PACAYA_SP1_RETH_VERIFIER:-}" ]] && export PACAYA_SP1_RETH_VERIFIER="$zero_addr"
+    [[ "${PACAYA_RISC0_RETH_VERIFIER:-}" == "null" || -z "${PACAYA_RISC0_RETH_VERIFIER:-}" ]] && export PACAYA_RISC0_RETH_VERIFIER="$zero_addr"
+
     local genesis_time
     local beacon_endpoint="${L1_BEACON_HTTP_EXTERNAL:-${L1_BEACON_HTTP:-http://localhost:33001}}"
     if ! genesis_time=$(curl -s "${beacon_endpoint}/eth/v1/beacon/genesis" | jq -r '.data.genesis_time' 2>/dev/null); then
diff --git a/remove-surge-full.sh b/remove-surge-full.sh
index ca9eedc2..e42dc466 100755
--- a/remove-surge-full.sh
+++ b/remove-surge-full.sh
@@ -272,126 +272,158 @@ cleanup_kurtosis_resources() {
     fi
 }
 
+# Force-remove containers by name (fallback when docker compose down fails)
+force_remove_containers() {
+    local containers=("$@")
+    local found=()
+
+    for name in "${containers[@]}"; do
+        if docker inspect "$name" >/dev/null 2>&1; then
+            found+=("$name")
+        fi
+    done
+
+    if [[ ${#found[@]} -gt 0 ]]; then
+        docker rm -f "${found[@]}" >/dev/null 2>&1 || true
+    fi
+}
+
+# Known L2 stack container names (from docker-compose.yml and docker-compose-protocol.yml)
+readonly L2_CONTAINERS=(
+    surge-l2-deployer
+    l2-nethermind-execution-client
+    l2-taiko-consensus-client
+    web3signer-l1
+    web3signer-l2
+    l2-catalyst-node
+    l2-taiko-prover-relayer-client
+    l2-raiko-zk-client
+    redis-zk
+    l2-tx-spammer
+    l2-blockscout-postgres
+    l2-blockscout-verif
+    l2-blockscout
+    l2-blockscout-frontend
+    surge-l1-deployer
+    pacaya-deployer
+    surge-genesis-generator
+    nethermind-genesis-hash
+    surge-switch-fork
+    surge-bond-deposit
+    surge-accept-ownership
+    surge-sp1-verifier-setup
+    surge-risc0-verifier-setup
+    surge-sgx-reth-verifier-setup
+    surge-sgx-geth-verifier-setup
+    surge-proposer-wrapper-deployer
+)
+
+# Known relayer container names (from docker-compose-relayer.yml)
+readonly RELAYER_CONTAINERS=(
+    relayer-l1-indexer
+    relayer-l1-processor
+    relayer-l1-api
+    relayer-l2-indexer
+    relayer-l2-processor
+    relayer-l2-api
+    relayer-migrations
+    relayer-db
+    relayer-rabbitmq
+    bridge-ui
+)
+
 # Remove L2 stack containers
 remove_l2_stack() {
     local mode_choice="$1"
-    
+
     log_info "Removing L2 stack containers..."
-    
-    local exit_status=0
-    local temp_output="/tmp/surge_remove_l2_output_$$"
-    
-    if [[ "$mode_choice" == "debug" ]]; then
-        # Debug mode: run in foreground with full output
-        {
-            docker compose --profile driver --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
-            docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile proposer-wrapper-deployer --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
-        } | tee "$temp_output"
-        exit_status=${PIPESTATUS[0]}
-    else
-        # Silent mode: run in background with progress indicator
-        {
-            docker compose --profile driver --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
-            docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile proposer-wrapper-deployer --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
-        } >"$temp_output" 2>&1 &
-        local remove_pid=$!
-        
-        show_progress $remove_pid "Removing L2 stack containers..."
-        
-        wait $remove_pid
-        exit_status=$?
-    fi
-    
-    if [[ $exit_status -eq 0 ]]; then
-        log_success "L2 stack containers removed successfully"
-        return 0
-    else
-        log_error "Failed to remove L2 stack containers (exit code: $exit_status)"
-        if [[ "$mode_choice" == "silence" ]]; then
-            log_error "Run with debug mode for more details: --mode debug"
-        fi
-        if [[ -f "$temp_output" ]]; then
-            log_error "Removal output saved in: $temp_output"
-        fi
-        return 1
-    fi
+
+    # Try docker compose down first (works when .env is present)
+    {
+        docker compose --profile driver --profile catalyst --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
+        docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile pacaya-deployer --profile genesis-generator --profile switch-fork --profile accept-ownership --profile proposer-wrapper-deployer --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
+    } >/dev/null 2>&1 || true
+
+    # Always follow up with force-remove to catch anything compose missed (e.g. .env was gone)
+    force_remove_containers "${L2_CONTAINERS[@]}"
+
+    log_success "L2 stack containers removed"
+    return 0
 }
 
 # Remove relayer containers
 remove_relayers() {
     local mode_choice="$1"
-    
+
     log_info "Removing relayer containers..."
-    
-    local exit_status=0
-    local temp_output="/tmp/surge_remove_relayers_output_$$"
-    
-    if [[ "$mode_choice" == "debug" ]]; then
-        # Debug mode: run in foreground with full output
-        {
-            docker compose -f docker-compose-relayer.yml --profile relayer-l1 --profile relayer-l2 --profile relayer-api --profile bridge-ui down --remove-orphans 2>&1
-            docker compose -f docker-compose-relayer.yml --profile relayer-init --profile relayer-migrations down --remove-orphans 2>&1
-        } | tee "$temp_output"
-        exit_status=${PIPESTATUS[0]}
-    else
-        # Silent mode: run in background with progress indicator
-        {
-            docker compose -f docker-compose-relayer.yml --profile relayer-l1 --profile relayer-l2 --profile relayer-api --profile bridge-ui down --remove-orphans 2>&1
-            docker compose -f docker-compose-relayer.yml --profile relayer-init --profile relayer-migrations down --remove-orphans 2>&1
-        } >"$temp_output" 2>&1 &
-        local remove_pid=$!
-        
-        show_progress $remove_pid "Removing relayer containers..."
-        
-        wait $remove_pid
-        exit_status=$?
-    fi
-    
-    if [[ $exit_status -eq 0 ]]; then
-        log_success "Relayer containers removed successfully"
+
+    # Try docker compose down first
+    {
+        docker compose -f docker-compose-relayer.yml --profile relayer-l1 --profile relayer-l2 --profile relayer-api --profile bridge-ui down --remove-orphans 2>&1
+        docker compose -f docker-compose-relayer.yml --profile relayer-init --profile relayer-migrations down --remove-orphans 2>&1
+    } >/dev/null 2>&1 || true
+
+    # Force-remove to catch anything compose missed
+    force_remove_containers "${RELAYER_CONTAINERS[@]}"
+
+    log_success "Relayer containers removed"
+    return 0
+}
+
+# Remove a directory, falling back to docker-based removal for root-owned files
+remove_dir_force() {
+    local dir="$1"
+    local abs_dir
+    abs_dir="$(cd "$(dirname "$dir")" && pwd)/$(basename "$dir")"
+    local parent_dir
+    parent_dir="$(dirname "$abs_dir")"
+    local base_name
+    base_name="$(basename "$abs_dir")"
+
+    # Try normal rm first
+    if rm -rf "$dir" 2>/dev/null && [[ ! -d "$dir" ]]; then
         return 0
-    else
-        log_error "Failed to remove relayer containers (exit code: $exit_status)"
-        if [[ "$mode_choice" == "silence" ]]; then
-            log_error "Run with debug mode for more details: --mode debug"
-        fi
-        if [[ -f "$temp_output" ]]; then
-            log_error "Removal output saved in: $temp_output"
-        fi
-        return 1
     fi
+
+    # Fallback: mount the parent dir so we can delete the target dir entirely
+    log_info "Using Docker to remove root-owned directory: $dir"
+    if docker run --rm -v "$parent_dir:/host_parent" alpine rm -rf "/host_parent/$base_name" 2>/dev/null; then
+        [[ ! -d "$dir" ]] && return 0
+    fi
+
+    return 1
 }
 
 # Remove persistent data directories
 remove_data() {
     log_info "Removing persistent data directories..."
-    
+
     local removed_dirs=()
     local failed_dirs=()
-    
+
     for dir in "${DATA_DIRS[@]}"; do
         if [[ -d "$dir" ]]; then
-            if rm -rf "$dir" 2>/dev/null; then
+            if remove_dir_force "$dir"; then
                 removed_dirs+=("$dir")
             else
                 failed_dirs+=("$dir")
             fi
         fi
     done
-    
+
     if [[ ${#removed_dirs[@]} -gt 0 ]]; then
         log_success "Removed data directories: ${removed_dirs[*]}"
     fi
-    
+
     if [[ ${#failed_dirs[@]} -gt 0 ]]; then
         log_error "Failed to remove data directories: ${failed_dirs[*]}"
         return 1
     fi
-    
+
     if [[ ${#removed_dirs[@]} -eq 0 ]]; then
         log_info "No data directories found to remove"
     fi
-    
+
     return 0
 }
 
@@ -668,14 +700,19 @@ main() {
         has_relayers=true
     fi
     
-    # Get component selection if not specified
-    local components_to_remove
-    if [[ -z "${remove_l1_devnet:-}${remove_l2_stack:-}${remove_relayers:-}${remove_data:-}${remove_configs:-}${remove_env:-}" ]]; then
+    # Get component selection
+    if [[ "$force" == "true" ]]; then
+        # With --force, default unset flags to "true" (remove everything)
+        [[ -z "$remove_l1_devnet" ]] && remove_l1_devnet="true"
+        [[ -z "$remove_l2_stack" ]]  && remove_l2_stack="true"
+        [[ -z "$remove_relayers" ]]  && remove_relayers="true"
+        [[ -z "$remove_data" ]]      && remove_data="true"
+        [[ -z "$remove_configs" ]]   && remove_configs="true"
+        # Note: remove_env is NOT defaulted — only removed when explicitly requested
+    elif [[ -z "${remove_l1_devnet:-}${remove_l2_stack:-}${remove_relayers:-}${remove_data:-}${remove_configs:-}${remove_env:-}" ]]; then
+        # Interactive mode: prompt for component selection
+        local components_to_remove
         components_to_remove=$(prompt_component_selection)
-    fi
-    
-    # Parse component selection
-    if [[ -n "${components_to_remove:-}" ]]; then
         local COMPONENTS=()
         IFS=',' read -ra COMPONENTS <<< "$components_to_remove"
         for component in "${COMPONENTS[@]}"; do
@@ -693,7 +730,11 @@ main() {
     # Get mode choice
     local mode_choice
     if [[ -z "${mode:-}" ]]; then
-        mode_choice=$(prompt_mode_selection)
+        if [[ "$force" == "true" ]]; then
+            mode_choice="silence"
+        else
+            mode_choice=$(prompt_mode_selection)
+        fi
     else
         mode_choice=$mode
     fi

From 5f13ae3be9f95ee0dcb0a27f21d03ffa007b7945 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Mon, 16 Mar 2026 19:54:09 +0000
Subject: [PATCH 08/11] Remove non-existent profile and switch to local raiko
 image

---
 .env.devnet          | 2 +-
 docker-compose.yml   | 2 +-
 remove-surge-full.sh | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 4fd75982..913398d7 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -4,7 +4,7 @@ PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-334488b
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:surge-shasta-0933c0f9
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-70e531a
+RAIKO_IMAGE=raiko-local:latest
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
diff --git a/docker-compose.yml b/docker-compose.yml
index 3a43956e..bde2a884 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -276,7 +276,7 @@ services:
     image: ${RAIKO_IMAGE}
     container_name: l2-raiko-zk-client
     restart: unless-stopped
-    pull_policy: always
+    pull_policy: never
     volumes:
       - ./configs:/raiko/config
     ports:
diff --git a/remove-surge-full.sh b/remove-surge-full.sh
index e42dc466..07f6ad57 100755
--- a/remove-surge-full.sh
+++ b/remove-surge-full.sh
@@ -341,7 +341,7 @@ remove_l2_stack() {
     # Try docker compose down first (works when .env is present)
     {
         docker compose --profile driver --profile catalyst --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
-        docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile pacaya-deployer --profile genesis-generator --profile switch-fork --profile accept-ownership --profile proposer-wrapper-deployer --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
+        docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile pacaya-deployer --profile genesis-generator --profile switch-fork --profile accept-ownership --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
     } >/dev/null 2>&1 || true
 
     # Always follow up with force-remove to catch anything compose missed (e.g. .env was gone)

From c7d7c64a6830a7ad0fcec1b5c63ac1b088b038d6 Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Mon, 16 Mar 2026 20:57:51 +0000
Subject: [PATCH 09/11] Switch to remote raiko image sha-2c34626

---
 .env.devnet        | 2 +-
 docker-compose.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.env.devnet b/.env.devnet
index 913398d7..cf41be8d 100644
--- a/.env.devnet
+++ b/.env.devnet
@@ -4,7 +4,7 @@ PROTOCOL_IMAGE=nethermind/surge-protocol:sha-b85d39a
 NETHERMIND_CLIENT_IMAGE=nethermindeth/nethermind:master-334488b
 TAIKO_CLIENT_IMAGE=nethermind/taiko-client:surge-shasta-0933c0f9
 CATALYST_IMAGE=nethermind/catalyst-node:v1.30.0
-RAIKO_IMAGE=raiko-local:latest
+RAIKO_IMAGE=nethermind/surge-raiko-zk:sha-2c34626
 
 ############################### DEFAULT #####################################
 CHAINSPEC_PATH_ON_HOST=./deployment/surge_chainspec.json
diff --git a/docker-compose.yml b/docker-compose.yml
index bde2a884..3a43956e 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -276,7 +276,7 @@ services:
     image: ${RAIKO_IMAGE}
     container_name: l2-raiko-zk-client
     restart: unless-stopped
-    pull_policy: never
+    pull_policy: always
     volumes:
       - ./configs:/raiko/config
     ports:

From d63a28ab65af8c59d2de2f89898e8a0165cc10ab Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Wed, 18 Mar 2026 11:40:40 +0000
Subject: [PATCH 10/11] Add claude

---
 .github/workflows/claude.yml | 37 ++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 .github/workflows/claude.yml

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
new file mode 100644
index 00000000..3a1f2343
--- /dev/null
+++ b/.github/workflows/claude.yml
@@ -0,0 +1,37 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

From 3643c292298bcd2293347dc8cbd850a6e69daade Mon Sep 17 00:00:00 2001
From: Nurbakhyt Madibekov <jmadibekov@gmail.com>
Date: Thu, 19 Mar 2026 10:07:34 +0000
Subject: [PATCH 11/11] fix: restore debug/silence mode in remove_l2_stack and
 remove_relayers

The refactor accidentally dropped the mode_choice conditional, causing
docker compose output to always be suppressed even in debug mode.
---
 remove-surge-full.sh | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/remove-surge-full.sh b/remove-surge-full.sh
index 07f6ad57..2497ca4e 100755
--- a/remove-surge-full.sh
+++ b/remove-surge-full.sh
@@ -339,10 +339,17 @@ remove_l2_stack() {
     log_info "Removing L2 stack containers..."
 
     # Try docker compose down first (works when .env is present)
-    {
-        docker compose --profile driver --profile catalyst --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
-        docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile pacaya-deployer --profile genesis-generator --profile switch-fork --profile accept-ownership --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
-    } >/dev/null 2>&1 || true
+    if [[ "$mode_choice" == "debug" ]]; then
+        {
+            docker compose --profile driver --profile catalyst --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
+            docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile pacaya-deployer --profile genesis-generator --profile switch-fork --profile accept-ownership --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
+        } || true
+    else
+        {
+            docker compose --profile driver --profile catalyst --profile proposer --profile spammer --profile prover --profile blockscout down --remove-orphans 2>&1
+            docker compose -f docker-compose-protocol.yml --profile l1-deployer --profile pacaya-deployer --profile genesis-generator --profile switch-fork --profile accept-ownership --profile sgx-reth-verifier-setup --profile sgx-geth-verifier-setup --profile sp1-verifier-setup --profile risc0-verifier-setup --profile bond-deposit --profile l2-deployer down --remove-orphans 2>&1
+        } >/dev/null 2>&1 || true
+    fi
 
     # Always follow up with force-remove to catch anything compose missed (e.g. .env was gone)
     force_remove_containers "${L2_CONTAINERS[@]}"
@@ -358,10 +365,17 @@ remove_relayers() {
     log_info "Removing relayer containers..."
 
     # Try docker compose down first
-    {
-        docker compose -f docker-compose-relayer.yml --profile relayer-l1 --profile relayer-l2 --profile relayer-api --profile bridge-ui down --remove-orphans 2>&1
-        docker compose -f docker-compose-relayer.yml --profile relayer-init --profile relayer-migrations down --remove-orphans 2>&1
-    } >/dev/null 2>&1 || true
+    if [[ "$mode_choice" == "debug" ]]; then
+        {
+            docker compose -f docker-compose-relayer.yml --profile relayer-l1 --profile relayer-l2 --profile relayer-api --profile bridge-ui down --remove-orphans 2>&1
+            docker compose -f docker-compose-relayer.yml --profile relayer-init --profile relayer-migrations down --remove-orphans 2>&1
+        } || true
+    else
+        {
+            docker compose -f docker-compose-relayer.yml --profile relayer-l1 --profile relayer-l2 --profile relayer-api --profile bridge-ui down --remove-orphans 2>&1
+            docker compose -f docker-compose-relayer.yml --profile relayer-init --profile relayer-migrations down --remove-orphans 2>&1
+        } >/dev/null 2>&1 || true
+    fi
 
     # Force-remove to catch anything compose missed
     force_remove_containers "${RELAYER_CONTAINERS[@]}"