chore(release): v5.0.1 (#24737)

Merges the current `v5-next` tree (`c11bc68`) back into `v5` and bumps
the release-please manifest to `5.0.1` to cut the v5.0.1 patch release.

- `.release-please-manifest.json`: `5.0.0` → `5.0.1`
- Brings all commits on `v5-next` since `v5.0.0` onto `v5` (companion
change: `v5-next` manifest bumped to `5.1.0` in `ee3716277a`).

**Merge strategy:** this is a release-branch sync — merge so `v5`
remains a true superset of the history (merge commit or fast-forward). A
squash merge would collapse the whole tree into a single commit and
rewrite the SHAs, so avoid it here.

Tagging `v5.0.1` on the resulting release commit is a follow-up step.

Author: PhilWindle

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "5.0.0"
+  ".": "5.0.1"
 }

docs/docs-developers/docs/aztec-nr/framework-description/advanced/how_to_prove_history.md

@@ -56,16 +56,18 @@ Prove a note exists in the note hash tree:
 To prove a note was valid (existed AND wasn't nullified) at a historical block:
 
 ```rust
-use aztec::history::note::assert_note_was_valid_by;
+use aztec::history::note::assert_local_note_was_valid_by;
 
 let header = self.context.get_anchor_block_header();
-assert_note_was_valid_by(header, hinted_note, &mut self.context);
+assert_local_note_was_valid_by(header, hinted_note, &mut self.context);
 ```
 
 This verifies both:
 1. The note was included in the note hash tree
 2. The note's nullifier was not in the nullifier tree
 
+The `assert_local_note_was_*` helpers only work for the executing contract's own notes: this is because it is not possible for a contract to retrieve the app-siloed nullifier hiding secret key that corresponds to another contract. To prove facts about another contract's notes, use `assert_note_existed_by`, which supports notes of any contract (see [Prove note inclusion](#prove-note-inclusion)).
+
 ## Prove at a specific historical block
 
 To prove against state at a specific past block (not just the anchor block):
@@ -83,13 +85,13 @@ Using `get_block_header_at` adds ~3k constraints to prove Archive tree membershi
 
 ## Prove a note was nullified
 
-To prove a note has been spent/nullified:
+To prove a note has been nullified:
 
 ```rust
-use aztec::history::note::assert_note_was_nullified_by;
+use aztec::history::note::assert_local_note_was_nullified_by;
 
 let header = self.context.get_anchor_block_header();
-assert_note_was_nullified_by(header, confirmed_note, &mut self.context);
+assert_local_note_was_nullified_by(header, confirmed_note, &mut self.context);
 ```
 
 ## Prove contract bytecode was published
@@ -137,10 +139,10 @@ The `aztec::history` module provides these functions:
 
 | Function | Module | Purpose |
 |----------|--------|---------|
-| `assert_note_existed_by` | `history::note` | Prove note exists in note hash tree |
-| `assert_note_was_valid_by` | `history::note` | Prove note exists and is not nullified |
-| `assert_note_was_nullified_by` | `history::note` | Prove note's nullifier is in nullifier tree |
-| `assert_note_was_not_nullified_by` | `history::note` | Prove note's nullifier is not in nullifier tree |
+| `assert_note_existed_by` | `history::note` | Prove note exists in note hash tree (any contract) |
+| `assert_local_note_was_valid_by` | `history::note` | Prove own note exists and is not nullified |
+| `assert_local_note_was_nullified_by` | `history::note` | Prove own note's nullifier is in nullifier tree |
+| `assert_local_note_was_not_nullified_by` | `history::note` | Prove own note's nullifier is not in nullifier tree |
 | `assert_nullifier_existed_by` | `history::nullifier` | Prove a siloed nullifier exists |
 | `assert_nullifier_did_not_exist_by` | `history::nullifier` | Prove a siloed nullifier does not exist |
 | `assert_contract_bytecode_was_published_by` | `history::deployment` | Prove a contract's bytecode was published |

docs/docs-developers/docs/resources/migration_notes.md

@@ -9,11 +9,40 @@ Aztec is in active development. Each version may introduce breaking changes that
 
 ## TBD
 
-### [PXE] Local PXE database is reset on upgrade
+### [Aztec.nr] History note nullification helpers renamed and restricted to own-contract notes
 
-The persisted tagging stores now key every entry by the self-describing `<kind>:<secret>:<app>` form of `AppTaggingSecret`; unconstrained secrets previously used a two-part `<secret>:<app>` key. This bumps the PXE data schema version, and there is no forward migration for the old keys: on first open the PXE clears any database whose stored schema version differs from the current one. The wipe resets the entire PXE store, not just the tagging data, because all of it shares one backing database.
+The `history::note` helpers that recompute a note's nullifier have been renamed with a `local_` prefix and now assert that the note belongs to the executing contract:
 
-**Impact**: On upgrade your local PXE state is reset. You must re-register accounts and re-sync from genesis. Wallets should surface a "your local state was reset, please re-register accounts and re-sync" path.
+| Old | New |
+| --- | --- |
+| `assert_note_was_valid_by` | `assert_local_note_was_valid_by` |
+| `assert_note_was_nullified_by` | `assert_local_note_was_nullified_by` |
+| `assert_note_was_not_nullified_by` | `assert_local_note_was_not_nullified_by` |
+
+These helpers derive the note's nullifier from the executing contract's app-siloed nullifier key, and it is not possible for a contract to retrieve the app-siloed nullifier for a different contract, as this would constitute leakage of key material. These helpers incorrectly used the local contract's key siloing, which for a note of a different contract resulted in the non-inclusion check passing unconditionally and wrongly reporting a nullified note as not nullified. The helpers now assert `contract_address == context.this_address()` and fail with "Note nullification history is only supported for the executing contract's own notes" otherwise.
+
+**Impact**: Update call sites to the new names. Own-contract usage (the common case) is unaffected beyond the rename. `assert_note_existed_by` is unchanged and still supports notes of any contract, since note-hash inclusion involves no keys.
+
+### [Aztec.nr] `set_as_fee_payer` now asserts it is called during the setup phase
+
+`PrivateContext::set_as_fee_payer` now asserts that execution is still in the setup (non-revertible) phase, i.e. that `end_setup` has not yet been called by any function in the transaction. Electing a fee payer in the revertible phase was never safe: compensation collected by the fee payer after `end_setup` can be discarded if a public call later reverts, while the protocol still debits the fee payer's fee-juice balance.
+
+**Impact**: A transaction in which `set_as_fee_payer` runs after the setup phase has ended now fails with `fee payer must be elected during the setup phase`. Standard fee payment flows, which call `set_as_fee_payer` before or together with `end_setup`, are unaffected.
+
+### [PXE] Stores are now selected by `(l1ChainId, rollupAddress, schemaVersion)` instead of being wiped on mismatch
+
+Previously, connecting a PXE or embedded wallet to a different or redeployed rollup, or bumping the store schema version, wiped the existing on-disk store in place. That meant master account keys could be destroyed simply by pointing a wallet at a different network. PXE data stores now exist per `(l1ChainId, rollupAddress, schemaVersion)` triple, and switching networks (or upgrading) selects or creates the matching store instead of overwriting previous ones. The embedded wallet's `wallet_data` store is partitioned the same way, so accounts and aliases are per network: switching networks starts with an empty account list until accounts are re-imported, and switching back finds the originals intact.
+
+**Impact**: The first start after upgrading to this version begins with a fresh, empty store; the pre-upgrade data is not deleted. On Node.js environments (lmdb-v2) pre-upgrade data stays at `<dataDirectory>/<name>` while new per-identity `pxe_data` stores live under `<dataDirectory>/<name>-stores/`. The embedded Node.js wallet previously stored data in cwd-relative, rollup-address-suffixed directories instead (`pxe_data_<rollupAddress>/pxe_data` for the PXE store, `wallet_data_<rollupAddress>/wallet_data` for the wallet store): if you used it before this release, that is where the old data lives. The embedded wallet now defaults its data root to `aztec-wallet-data/`, with per-identity wallet stores under `<dataDirectory>/wallet_data-stores/` on Node.js and OPFS store names prefixed `wallet_data_` in the browser. Browser apps can enumerate and clean up `pxe_data` and `wallet_data` stores for networks no longer in use with the new `listStores()` / `deleteStore()` utilities:
+
+```ts
+import { deleteStore, listStores } from '@aztec/kv-store/sqlite-opfs';
+
+const names = await listStores();
+await deleteStore(names[0]);
+```
+
+This change also removes `createStore` from `@aztec/kv-store/sqlite-opfs` and `@aztec/kv-store/deprecated/indexeddb`: stores are now opened by name with `AztecSQLiteOPFSStore.open` / `AztecIndexedDBStore.open`.
 
 ### [Aztec.nr] `TestEnvironmentOptions::with_tagging_secret_strategy` replaced
 
@@ -131,8 +160,6 @@ Registering classes and instances are now separate, unvalidated operations. `reg
   The new class is used automatically once the upgrade takes effect on chain; no further PXE action is needed. Registering it beforehand is harmless: until the update activates, the node still resolves the contract's current class to the previous one, so it keeps running its old code.
 
 - `pxe.getContractInstance(address)` and `wallet.getContractMetadata(address).instance` now return the contract's **address preimage**, which no longer includes `currentContractClassId`.
-
-
 ### [Aztec.js] `AccountWithSecretKey` removed, read account keys from the `AccountManager` or PXE
 
 `AccountWithSecretKey` was a thin wrapper that bundled an account's transaction signer with its master secret key, used mainly to print or export the secret. It has been removed, and `AccountManager.getAccount()` now returns the plain `Account` signer. The wrapper's extra methods are no longer available on that value:

l1-contracts/scripts/forge_broadcast.js

@@ -59,11 +59,11 @@ const timeoutMs =
   (isAnvil ? 120_000 : 1_200_000);
 
 const proc = spawn(
-  "forge",
+  process.env.FORGE_BIN || "forge",
   ["script", ...args, "--broadcast", "--batch-size", batchSize],
   {
     stdio: ["ignore", "pipe", "inherit"],
-  },
+  }
 );
 
 const stdout = [];
@@ -85,14 +85,14 @@ const exitCode = await new Promise((resolve) => {
   });
   proc.on("close", (code) => {
     clearTimeout(timeout);
-    resolve(timedOut ? 1 : (code ?? 1));
+    resolve(timedOut ? 1 : code ?? 1);
   });
 });
 
 log(
   exitCode === 0
     ? "Broadcast succeeded."
-    : `Broadcast failed (exit ${exitCode}).`,
+    : `Broadcast failed (exit ${exitCode}).`
 );
 const data = Buffer.concat(stdout);
 if (data.length > 0) writeSync(1, data);

noir-projects/aztec-nr/CLAUDE.md

@@ -34,6 +34,36 @@ Follow the Rust stdlib style roughly. See `PublicImmutable` in `state_vars/publi
 - **Show practical patterns in examples.** Don't just show the API call — show it in context (e.g. inside a `#[external("public")]` function with realistic variable names).
 - **Document cost for methods.** When relevant, note which AVM opcodes are invoked and how many times (e.g. "`SLOAD` is invoked a number of times equal to `T`'s packed length").
 
+### Brevity and attitude
+
+Write for a caller using the API, not for an implementor or an auditor. State what the item does and any restriction a caller must respect, plus the alternative to reach for — then stop. Leave out the internal mechanism and the security rationale behind a restriction: those belong in code comments messages or design docs, not the rustdoc. A reader who hits a restriction needs to know it exists and where to go next, not the argument for why it holds.
+
+- **State the restriction, not the reason it's sound.** Say "this can only be used for X", not the multi-sentence explanation of what goes wrong otherwise.
+- **Don't narrate the mechanism.** Key siloing, tree layouts, hash preimages, and similar internals are implementation detail; mention them only when a caller cannot use the API correctly without knowing (and then put them under `## Implementation Details`).
+- **Point to the alternative instead of enumerating trade-offs.** A single "use `[other_fn]` for the other case" beats a paragraph weighing options.
+
+Example — documenting a helper that only works on the executing contract's own notes:
+
+```rust
+// Too much: explains the key-siloing mechanism and the failure the guard prevents.
+/// The note's nullifier is recomputed using the executing contract's app-siloed nullifier key
+/// and then siloed with `confirmed_note.contract_address`. These only agree for the executing
+/// contract's own notes; otherwise the non-inclusion proof passes unconditionally and wrongly
+/// reports a nullified note as not nullified, so this asserts that
+/// `confirmed_note.contract_address == context.this_address()`.
+
+// Right: states the restriction and the alternative, nothing more.
+/// ## Local notes only
+///
+/// This can only be used for notes of the executing contract. Use [`assert_note_existed_by`] to
+/// prove existence of another contract's notes.
+```
+
+## Testing
+
+- **No messages on assertions inside tests.** Write `assert_eq(actual, expected)` and `assert(cond)`, not `assert_eq(actual, expected, "values should match")`. The test's name and body already make clear what is being checked, so an assertion message is redundant noise. (Library code is the opposite: an `assert`/`panic` there must carry a message, since it explains a runtime failure to a contract developer.)
+- `#[test(should_fail_with = "...")]` is not an assertion message and is encouraged. The string matches a substring of the expected failure, pinning down *which* error the failing case must produce so the test can't pass for the wrong reason.
+
 ## Logging
 
 - **Always use the prefixed logging functions** from `crate::logging` (e.g. `logging::aztecnr_debug_log!`, `logging::aztecnr_debug_log_format!`). These automatically prepend `[aztec-nr] ` to all messages at compile time.

noir-projects/aztec-nr/aztec/src/context/private_context.nr

@@ -538,11 +538,22 @@ impl PrivateContext {
     /// Only one contract per transaction can declare itself as the fee payer, and it must have sufficient fee-juice
     /// balance (>= the gas limits specified in the TxContext) by the time we reach the public setup phase of the tx.
     ///
+    /// The fee payer must be elected during the setup (non-revertible) phase, i.e. before
+    /// [`end_setup`](PrivateContext::end_setup) is called - this function asserts so. This is because any compensation
+    /// collected by the fee payer during the revertible phase can be discarded if a public call later reverts, while
+    /// the protocol still debits the fee payer's fee-juice balance. Note that `end_setup` does not need to be called
+    /// by the electing function itself: it can be called later in the transaction (e.g. by the fee-juice contract when
+    /// claiming fee juice that pays for the very same transaction).
     pub fn set_as_fee_payer(&mut self) {
+        assert(!self.in_revertible_phase(), "fee payer must be elected during the setup phase");
         aztecnr_trace_log_format!("Setting {0} as fee payer")([self.this_address().to_field()]);
         self.is_fee_payer = true;
     }
 
+    /// Returns whether execution is currently in the revertible (app) phase of the transaction.
+    ///
+    /// A transaction is in the revertible phase if [`end_setup`](PrivateContext::end_setup) has already been called -
+    /// potentially by a different function of the same transaction.
     pub fn in_revertible_phase(&mut self) -> bool {
         let current_counter = self.side_effect_counter;
 

noir-projects/aztec-nr/aztec/src/history/note.nr

@@ -15,6 +15,19 @@ use crate::{
 
 mod test;
 
+/// Asserts that a note existed in the note hash tree by the time a block was mined.
+///
+/// Proves note inclusion at `block_header` by checking membership of the note's unique note hash, and returns a
+/// [`ConfirmedNote`] describing it.
+///
+/// ## Cross-contract notes
+///
+/// Unlike the nullification helpers, this works for notes of **any** contract, not just the executing one: note hashes
+/// are siloed with the note's own contract address (carried by the [`HintedNote`]) and no secret keys are involved.
+///
+/// To reason about whether such a note has been nullified, see [`assert_local_note_was_nullified_by`] and
+/// [`assert_local_note_was_not_nullified_by`], which — in contrast — can only be used for the executing contract's own
+/// notes.
 pub fn assert_note_existed_by<Note>(block_header: BlockHeader, hinted_note: HintedNote<Note>) -> ConfirmedNote<Note>
 where
     Note: NoteHash,
@@ -46,7 +59,17 @@ where
     ConfirmedNote::new(hinted_note, unique_note_hash)
 }
 
-pub fn assert_note_was_valid_by<Note>(
+/// Asserts a note existed and had not yet been nullified by a given block.
+///
+/// Combines [`assert_note_existed_by`] and [`assert_local_note_was_not_nullified_by`]: it proves both that the note
+/// existed at `block_header` and that it had not been nullified then. A contract typically uses this as a security gate
+/// before acting on a note whose validity at some past block matters.
+///
+/// ## Local notes only
+///
+/// Like [`assert_local_note_was_not_nullified_by`], this can only be used for notes of the executing contract. Use
+/// [`assert_note_existed_by`] on its own to prove existence of another contract's notes.
+pub fn assert_local_note_was_valid_by<Note>(
     block_header: BlockHeader,
     hinted_note: HintedNote<Note>,
     context: &mut PrivateContext,
@@ -55,17 +78,28 @@ where
     Note: NoteHash,
 {
     let confirmed_note = assert_note_existed_by(block_header, hinted_note);
-    assert_note_was_not_nullified_by(block_header, confirmed_note, context);
+    assert_local_note_was_not_nullified_by(block_header, confirmed_note, context);
 }
 
-pub fn assert_note_was_nullified_by<Note>(
+/// Asserts a note had been nullified by a given block.
+///
+/// ## Local notes only
+///
+/// This can only be used for notes of the executing contract. Use [`assert_note_existed_by`] on its own to prove
+/// existence of another contract's notes.
+pub fn assert_local_note_was_nullified_by<Note>(
     block_header: BlockHeader,
     confirmed_note: ConfirmedNote<Note>,
     context: &mut PrivateContext,
 )
 where
     Note: NoteHash,
 {
+    assert(
+        confirmed_note.contract_address == context.this_address(),
+        "Note nullification history is only supported for the executing contract's own notes",
+    );
+
     let note_hash_for_nullification = compute_confirmed_note_hash_for_nullification(confirmed_note);
     let inner_nullifier =
         confirmed_note.note.compute_nullifier(context, confirmed_note.owner, note_hash_for_nullification);
@@ -75,14 +109,25 @@ where
     assert_nullifier_existed_by(block_header, siloed_nullifier);
 }
 
-pub fn assert_note_was_not_nullified_by<Note>(
+/// Asserts a note had **not** been nullified by a given block.
+///
+/// ## Local notes only
+///
+/// This can only be used for notes of the executing contract. Use [`assert_note_existed_by`] on its own to prove
+/// existence of another contract's notes.
+pub fn assert_local_note_was_not_nullified_by<Note>(
     block_header: BlockHeader,
     confirmed_note: ConfirmedNote<Note>,
     context: &mut PrivateContext,
 )
 where
     Note: NoteHash,
 {
+    assert(
+        confirmed_note.contract_address == context.this_address(),
+        "Note nullification history is only supported for the executing contract's own notes",
+    );
+
     let note_hash_for_nullification = compute_confirmed_note_hash_for_nullification(confirmed_note);
 
     let inner_nullifier =