chore(merge): Private next to public (#24686)

PR to merge private next to public

Author: ledwards2225

.claude/agents/aztec-wallet.md

@@ -48,7 +48,7 @@ fi
 
 # Query node version
 RESPONSE=$(curl -sf -X POST -H 'Content-type: application/json' \
-  --data '{"jsonrpc":"2.0","id":1,"method":"node_getNodeInfo"}' \
+  --data '{"jsonrpc":"2.0","id":1,"method":"aztec_getNodeInfo"}' \
   "$RPC_URL" 2>&1) || {
   echo "ERROR: Could not reach node at $RPC_URL" >&2
   echo "Response: $RESPONSE" >&2

.claude/skills/capture-app-flow/SKILL.md

@@ -14,6 +14,58 @@ Pinned Chonk IVC inputs live in an S3 tarball keyed by `barretenberg/cpp/scripts
 
 Use the scripts instead of open-coding URLs, hashes, temp paths, or bucket listings.
 
+## Pins to keep in sync
+
+A bb/proof-system change that rotates VKs touches THREE tracked pins, and all of them feed the captured Chonk flows:
+
+- The mock artifact pin `noir-projects/mock-protocol-circuits/pinned-build.tar.gz` freezes mock protocol circuit bytecode and VKs used by Chonk fixture capture.
+- The standard-contracts pin `noir-projects/noir-contracts/pinned-standard-contracts.tar.gz` freezes the `contracts/standard/` artifacts with their precomputed VKs and deterministic addresses. `noir-contracts/bootstrap.sh build` extracts it and excludes `standard/` from recompilation, so these VKs only refresh via `pin-standard-build` (step 5).
+- The Chonk flow pin `barretenberg/cpp/scripts/chonk-inputs.hash` points to the S3 tarball of captured `ivc-inputs.msgpack` flows. Those msgpacks embed bytecode, witnesses, circuit kinds, and precomputed VKs — including the standard-contract VKs above, so the standard-contracts pin must be correct *before* recapturing flows.
+
+`noir-projects/noir-protocol-circuits/pinned-build.tar.gz` is not a current tracked pin on the `next` line. `noir-projects/bootstrap.sh pin-build` may generate it as untracked local build output; do not commit it unless intentionally reintroducing that large artifact pin.
+
+If a bb/proof-system change can affect VKs, refresh in this order:
+
+1. Rebuild the AVM-enabled bb binary so the regenerated VKs reflect the change. `cmake --build build --target bb` is not enough: `noir-projects/noir-protocol-circuits/bootstrap.sh` resolves the bb binary via `barretenberg/cpp/scripts/find-bb`, which returns `bb-avm` (not `bb`) unless `AVM=0`. From `barretenberg/cpp/`:
+   ```bash
+   cmake --preset default -DAVM=ON
+   cmake --build build --target bb-avm
+   ```
+2. Repin Noir artifacts with the AVM-enabled binary: `./bootstrap.sh pin-build` from `noir-projects/`. Do not set `AVM=0` — the `*-tx-base-public` circuits verify an AVM proof, so non-AVM `bb` fails their VK generation with "AVM recursion is not supported in this build". Because pin-build runs under `set +e`, that failure does not abort the run; it silently archives an incomplete `pinned-build.tar.gz` with stale/missing VKs.
+3. Keep the tracked `noir-projects/mock-protocol-circuits/pinned-build.tar.gz` diff.
+4. Remove the generated untracked `noir-projects/noir-protocol-circuits/pinned-build.tar.gz` unless intentionally reintroducing that large pin.
+5. Repin the standard contracts **iteratively, and regenerate their address stamps**. A stale standard-contracts pin surfaces as a "Computed VK differs from precomputed VK" mismatch on a `standard/` contract function during chonk capture verification. Repinning is not a single command: `pin-standard-build` compiles the standard contracts against the *current* `standard_addresses.nr` and tarballs them — it does NOT regenerate the stamps, and standard contracts can reference each other's deterministic addresses. Because a contract's address depends on its bytecode, which depends on the addresses it embeds, you must repeat the re-pin + stamp-regeneration until a round changes nothing (the addresses stop moving):
+   ```bash
+   cd noir-projects/noir-contracts
+   # repeat this pair until `generate` makes no change (exits 0, no "Changed values"):
+   BB=$(realpath ../../barretenberg/cpp/build/bin/bb-avm) ./bootstrap.sh pin-standard-build
+   (cd ../../yarn-project && yarn workspace @aztec/standard-contracts generate)   # rewrites stamps; exits non-zero on drift
+   ```
+   `BB` defaults to non-AVM `bb`; set it to `bb-avm` explicitly. Once converged, run `noir-projects/bootstrap.sh` once to recompile dependents against the final addresses, then commit the pin **together with** the three regenerated stamp files:
+   - `yarn-project/standard-contracts/src/standard_contract_data.ts`
+   - `noir-projects/aztec-nr/aztec/src/standard_addresses.nr`
+   - `noir-projects/noir-contracts/contracts/protocol/aztec_sublib/src/standard_addresses.nr`
+
+   Two failure modes if you cut corners: skipping the stamp regen rotates the contract addresses out from under the committed stamps → a cascade of contract-class / "address not updated" failures; stopping before the addresses stabilize leaves a pinned contract calling another standard contract's *previous* address → e2e capture aborts with `Function artifact not found for contract 0x…` during flow execution.
+6. Recapture and upload Chonk flows with `barretenberg/cpp/scripts/chonk_inputs.sh update` (only after step 5 is committed, since the capture embeds the standard-contract VKs).
+
+After pin-build, sanity-check that the tracked tarball is a full pin, not the empty/incomplete shell a silent failure leaves behind: `tar tzf noir-projects/mock-protocol-circuits/pinned-build.tar.gz | grep -c '\.json$'` should list every circuit (a 400-byte tarball containing only `./` and `./keys/` means the build produced nothing).
+
+A refreshed Chonk flow pin alone can still contain stale VKs if the capture used stale Noir artifacts. `ChonkPinnedIvcInputsTest.AllPinnedFlows` uses the embedded VKs with the default policy, so stale VKs may surface later as generated-proof verification failure rather than the explicit `chonk_inputs.sh check` VK-mismatch message.
+
+## Diagnosing an `AllPinnedFlows` failure
+
+Decide whether you have a pin problem or something upstream **before** repinning or re-uploading:
+
+- **Download / hash failure** (`failed to download … may be stale`, `InvalidAccessKeyId`) → a pin/upload problem. Refresh the flow pin; for `InvalidAccessKeyId`, the build+capture is fine but your AWS creds are expired — the canonical fix is the `ci-refresh-chonk` label so CI uploads with its own creds.
+- **Prove / verify failure** (e.g. `ChonkVerifier: verification failed at PI pairing points check`, `Failed to verify the generated proof`) → does NOT by itself mean the flow pin is stale, and re-capturing the flow pin will not fix it. Factor out the pin by re-running the test against a freshly-captured local flow set (the test honors `CHONK_PINNED_IVC_INPUTS_DIR`, with no hash/marker check):
+  ```bash
+  CHONK_PINNED_IVC_INPUTS_DIR=$(pwd)/yarn-project/end-to-end/chonk-pinned-flows \
+  CHONK_PINNED_IVC_FLOW=<flow> AZTEC_REPO_ROOT=$(pwd) \
+    ./barretenberg/cpp/build/bin/bbapi_tests --gtest_filter='ChonkPinnedIvcInputsTest.AllPinnedFlows'
+  ```
+  (`CHONK_PINNED_IVC_FLOW` filters to one flow dir for a fast loop; omit it to run all.) If a freshly-captured flow fails identically, the flow pin is not the cause — an embedded *precomputed* VK is stale. Run `bb check --scheme chonk` over the flows to name the function (`VK mismatch detected for function <contract>:<fn>`); if it's a `standard/` contract, the cause is the standard-contracts pin (step 5), not the flow pin.
+
 ## Common Commands
 
 Download or repair the local fixture directory:

.claude/skills/chonk-inputs/SKILL.md

@@ -29,7 +29,7 @@ Fetch node info from the provided RPC URL:
 
 ```bash
 curl -s -X POST -H 'Content-Type: application/json' \
-  -d '{"method":"node_getNodeInfo"}' <RPC_URL> | jq .result
+  -d '{"method":"aztec_getNodeInfo"}' <RPC_URL> | jq .result
 ```
 
 Parse the response to extract:
@@ -220,7 +220,7 @@ These files are auto-generated — do not hand-edit them.
 
 Regenerate the Node JSON-RPC API reference documentation. This script parses the
 TypeScript interface definitions and Zod schemas in `yarn-project/stdlib/src/interfaces/`
-to produce a complete markdown reference for the `node_` and `nodeAdmin_` RPC methods.
+to produce a complete markdown reference for the `aztec_` and `aztecAdmin_` RPC methods.
 
 **Prerequisite:** `yarn-project` must be built (already done in Step 6 prerequisites).
 
@@ -267,7 +267,7 @@ docs (Step 11), the generated content is included in the snapshot automatically.
 ### Step 9: Resolve Missing Contract Addresses & Update Network Info
 
 The `networks.md` L1 table includes contracts that are **not** returned by
-`node_getNodeInfo`. Before updating the tables, resolve these in three tiers.
+`aztec_getNodeInfo`. Before updating the tables, resolve these in three tiers.
 
 Determine the L1 RPC URL from the `l1ChainId`: `1` → Ethereum mainnet,
 `11155111` → Sepolia. The Rollup and Registry addresses are already known from

.claude/skills/release-docs/SKILL.md

@@ -45,7 +45,7 @@ Fetch node info from the provided RPC URL:
 
 ```bash
 curl -s -X POST -H 'Content-Type: application/json' \
-  -d '{"method":"node_getNodeInfo"}' <RPC_URL> | jq .result
+  -d '{"method":"aztec_getNodeInfo"}' <RPC_URL> | jq .result
 ```
 
 Parse the response to extract:
@@ -87,7 +87,7 @@ git tag -l "v<nodeVersion>"
 ### Step 3: Identify and Resolve Missing Contract Addresses
 
 The `networks.md` L1 table includes contracts that are **not** returned by
-`node_getNodeInfo`. Resolve these addresses in three tiers:
+`aztec_getNodeInfo`. Resolve these addresses in three tiers:
 
 #### Tier 1: Query on-chain from known contracts
 

.claude/skills/release-network-docs/SKILL.md

@@ -127,6 +127,9 @@ function main {
     echo "WARNING: Skipping main CI because Chonk input refresh was requested; the update step will run after this step succeeds." >&2
     ci_mode="skip"
   elif has_label "ci-release-pr"; then
+    # Release-PR mode creates and pushes a release tag for this PR's head (ci3.sh::handle_release_pr).
+    # In the private repo that tag triggers a private release via the safety gate below — this is the
+    # manual way to cut a private release from a PR, alongside the nightly tag cron.
     ci_mode="release-pr"
   elif has_label "ci-full"; then
     ci_mode="full"
@@ -141,6 +144,9 @@ function main {
   elif has_label "ci-barretenberg" || [ "$target_branch" == "merge-train/barretenberg" ]; then
     ci_mode="barretenberg"
   elif [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+    # A pushed semver tag is a release; REF_NAME is the tag (see ci3/source_refname). In the private
+    # repo this is the nightly path (nightly-release-tag*.yml push v<ver>-nightly.<date> tags on next and
+    # v5-next); the private-repo safety gate below routes it to the internal Artifact Registry.
     ci_mode="release"
   else
     ci_mode="fast"
@@ -149,6 +155,17 @@ function main {
   echo "CI_MODE=$ci_mode" >> $GITHUB_ENV
   echo "CI mode: $ci_mode"
 
+  # Private-repo safety gate. The release flow can publish to DockerHub/npmjs/crates.io/github; that
+  # MUST NEVER run in the private fork. So whenever this repo would release — for ANY trigger (a pushed
+  # nightly tag, a ci-release-pr tag, anything future) — force the private path: publish only the docker
+  # image and npm packages to our internal Artifact Registry (bootstrap.sh::private_release). Keyed on
+  # the repo name (case-insensitive) so it can't be reached in the public repo.
+  if [ "$ci_mode" = "release" ] &&
+     [ "$(printf '%s' "${GITHUB_REPOSITORY:-}" | tr 'A-Z' 'a-z')" = "aztecprotocol/aztec-packages-private" ]; then
+    echo "PRIVATE_RELEASE=1" >> $GITHUB_ENV
+    echo "SKIP_COMPAT_E2E=1" >> $GITHUB_ENV
+  fi
+
   # Benching modes run their benches on a dedicated, fixed-hardware box (stable numbers)
   # and publish the result; ci-fast never benches. For grind runs (merge-queue-heavy fires
   # ~10 instances) only the first instance keeps BENCH_UPLOAD=1 — multi_job_run forces the

.github/ci3_labels_to_env.sh

@@ -25,18 +25,23 @@ function handle_squash_merge {
     return
   fi
   # If we have passed CI and labelled with ci-squash-and-merge, squash the PR.
-  # This will rerun CI on the squash commit - but is intended to be a no-op due to caching.
   echo "Processing squash and merge..."
   # Reauth the git repo with our GITHUB_TOKEN
   git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${github_repository}
   git config --unset-all http.https://github.com/.extraheader || true
-  # Get the base commit (merge-base) for the PR
+  # Drop the trigger label BEFORE squashing. squash-pr.sh force-pushes, which fires a fresh
+  # `synchronize` event; if the label were still set, that event would re-enter this path and loop.
+  # Use the REST endpoint (needs only the `repo` scope AZTEC_BOT_GITHUB_TOKEN has) rather than
+  # `gh pr edit --remove-label`, which runs an org/team GraphQL query requiring `read:org` — a scope
+  # the token lacks, so it errored here and the label was never cleared. `|| true` stops a transient
+  # failure from aborting the merge; squash-pr.sh's single-commit guard prevents looping regardless.
+  gh api -X DELETE "repos/${github_repository}/issues/${PR_NUMBER}/labels/ci-squash-and-merge" || true
+  # Squash the PR commits into one (no-op when the branch is already a single commit).
   ./scripts/merge-train/squash-pr.sh \
     "${PR_NUMBER}" \
     "${PR_HEAD_REF}" \
     "${PR_BASE_REF}" \
     "${PR_BASE_SHA}"
-  gh pr edit "${PR_NUMBER}" --remove-label "ci-squash-and-merge"
   gh pr merge "${PR_NUMBER}" --auto -m || true
   echo "Squash and merge completed"
 }

.github/ci3_success.sh

@@ -15,7 +15,7 @@ concurrency:
 
 jobs:
   collect-avm-circuit-inputs:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'AztecProtocol/aztec-packages' }}
+    if: ${{ github.repository != 'AztecProtocol/aztec-packages-private' && (github.event_name != 'schedule' || github.repository == 'AztecProtocol/aztec-packages') }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -67,7 +67,7 @@ jobs:
 
   avm-check-circuit:
     needs: collect-avm-circuit-inputs
-    if: ${{ github.event_name != 'schedule' || github.repository == 'AztecProtocol/aztec-packages' }}
+    if: ${{ github.repository != 'AztecProtocol/aztec-packages-private' && (github.event_name != 'schedule' || github.repository == 'AztecProtocol/aztec-packages') }}
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/avm-circuit-inputs.yml

@@ -23,11 +23,15 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
+    # The auto acceptance test validates published releases, which are only cut from the
+    # public aztec-packages repo. Don't let the workflow_run trigger fire in the private
+    # mirror, where it runs against non-release branches (e.g. v5-next) and always fails.
     if: >-
       github.event_name == 'workflow_dispatch' ||
       (github.event_name == 'workflow_run'
        && github.event.workflow_run.conclusion == 'success'
-       && !contains(github.event.workflow_run.head_branch, '-commit.'))
+       && !contains(github.event.workflow_run.head_branch, '-commit.')
+       && github.repository != 'AztecProtocol/aztec-packages-private')
     env:
       VERSION: ${{ github.event.inputs.version || github.event.workflow_run.head_branch }}
     steps:

.github/workflows/aztec-cli-acceptance-test.yml

@@ -0,0 +1,62 @@
+name: Bench Inclusion Point
+
+# Reusable: runs ONE inclusion-sweep TPS point against an ALREADY-DEPLOYED
+# network (SKIP_NETWORK_DEPLOY=1). The caller (nightly-bench-inclusion-sweep.yml)
+# deploys the network once and calls this for each point (1/5/10 TPS), chaining
+# the calls so the points run sequentially on the same network. Deploy / wait /
+# teardown are done once by the caller, not here.
+
+on:
+  workflow_call:
+    inputs:
+      tps:
+        description: "Target TPS for this point"
+        required: true
+        type: string
+      namespace:
+        description: "k8s namespace of the already-deployed network"
+        required: true
+        type: string
+      network:
+        description: "Network env name (environments/<network>.env)"
+        required: false
+        type: string
+        default: bench-inclusion-sweep
+      docker_image:
+        description: "Full aztec docker image (already deployed)"
+        required: true
+        type: string
+      source_ref:
+        description: "Git ref to checkout for the bench scripts"
+        required: true
+        type: string
+      sweep_id:
+        description: "Shared sweep id so the dashboard groups the points"
+        required: true
+        type: string
+
+jobs:
+  bench:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          ref: ${{ inputs.source_ref }}
+      - name: Run ${{ inputs.tps }} TPS inclusion point
+        timeout-minutes: 120
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          RUN_ID: ${{ github.run_id }}
+          AWS_SHUTDOWN_TIME: 180
+          NO_SPOT: 1
+          SKIP_NETWORK_DEPLOY: "1"
+          TARGET_TPS: ${{ inputs.tps }}
+          BENCH_SWEEP_ID: ${{ inputs.sweep_id }}
+          BENCH_SWEEP_LABEL: inclusion-sweep
+        run: ./.github/ci3.sh network-inclusion-sweep ${{ inputs.network }} ${{ inputs.namespace }} "${{ inputs.docker_image }}"