feat: merge-train/spartan (#23580)

BEGIN_COMMIT_OVERRIDE
fix(archiver): skip descendants of invalid-attestations checkpoints
(#23502)
chore: scale network validators (#23579)
fix(ci): nightly 10 TPS bench GCP auth and checkout (#23586)
chore: set eth node resource profile (#23583)
fix: wait for checkpoint before sentinel assertions (#23573)
fix: slash attestations for invalid checkpoint proposals (#23506)
test: fix web3signer pipelining
`e2e_multi_validator_node_key_store.test.ts` (#23568)
fix: cap CI devbox hostname (#23591)
test: stabilize invalid checkpoint descendant e2e (#23582)
test(e2e): stabilize invalidation slots in `proposer invalidates
multiple checkpoints` (#23590)
test(e2e): stabilize invalid proposal slashing target slot in
`attested_invalid_proposal` (#23589)
chore(foundation): faster toBufferBE via zero fast-path (#23592)
fix: honour BB_BINARY_PATH (#23570)
chore: bump reth and lighthouse (#23588)
chore: add web3signer and postgres node selectors (#23598)
fix: do not symlink .codex folders (#23593)
chore: fix claude and codex symlinking tests (#23599)
test(e2e): narrow down sentinel check in `multiple_validators_sentinel`
(#23604)
test(e2e): fix `proposer invalidates multiple checkpoints` timeout
(#23608)
fix: record zero-amount slashing offenses (#23556)
fix: log slashing offense names (#23565)
feat(p2p): tx validation cache (#23585)
chore: add KEDA deployment module (#23553)
chore: add KEDA prover agent autoscaling (#23554)
chore: update destroy_bootnode.sh (#23626)
chore: skip failing chonk_pinned_inputs.test in CI (#23643)
chore(ci): tolerate public authwit P2P receipt flake (#23648)
END_COMMIT_OVERRIDE

Author: spalladino

.claude/bootstrap.sh

@@ -4,7 +4,9 @@
 # `test`. Keeps hook scripts and their tests as a self-contained component.
 source $(git rev-parse --show-toplevel)/ci3/source_bootstrap
 
-hash=$(cache_content_hash ^.claude)
+# Hash everything agents_symlink_test inspects, not just .claude/: the .codex mirrors and the root
+# AGENTS.md/CLAUDE.md symlinks live outside .claude/, so a change there must still rerun the test.
+hash=$(cache_content_hash "^.*.claude" "^.*.codex" "^AGENTS.md" "^CLAUDE.md")
 
 function test_cmds {
   # source_base cd's us into .claude/, so glob relative-to-here, but emit paths

.claude/tests/agents_symlink_test

@@ -82,17 +82,43 @@ while IFS= read -r dir; do
     "$ROOT"/noir/noir-repo/*) continue;;
   esac
   codex="$(dirname "$dir")/.codex"
-  if [[ ! -L "$codex" ]]; then
-    fail "${codex#$ROOT/} is missing or is not a symlink to .claude"
+  rel=${codex#$ROOT/}
+  # A .codex may either be a symlink to its sibling .claude (the repo root keeps this form), or a
+  # real directory whose immediate children symlink into .claude (the per-package form, required
+  # because a sandbox cannot bind-mount a path that is itself a symlink). Either way Codex must see
+  # exactly the same contents as .claude.
+  if [[ -L "$codex" ]]; then
+    resolved=$(cd "$(dirname "$codex")" && cd "$(readlink "$codex")" 2>/dev/null && pwd -P) || resolved=""
+    claude_resolved=$(cd "$dir" && pwd -P)
+    if [[ "$resolved" != "$claude_resolved" ]]; then
+      fail "$rel is a symlink to ${resolved:-?}, expected its sibling .claude ($claude_resolved)"
+    else
+      pass "$rel -> .claude"
+    fi
     continue
   fi
-  resolved=$(cd "$(dirname "$codex")" && cd "$(readlink "$codex")" 2>/dev/null && pwd -P) || resolved=""
-  claude_resolved=$(cd "$dir" && pwd -P)
-  if [[ "$resolved" != "$claude_resolved" ]]; then
-    fail "${codex#$ROOT/} resolves to $resolved, expected $claude_resolved"
+  if [[ ! -d "$codex" ]]; then
+    fail "$rel is missing (expected a directory mirroring .claude via child symlinks)"
     continue
   fi
-  pass "${codex#$ROOT/}"
+  codex_ok=1
+  # Forward: every entry in .claude must have a matching symlink in .codex.
+  while IFS= read -r child; do
+    name=$(basename "$child")
+    if [[ ! -L "$codex/$name" || ! "$codex/$name" -ef "$child" ]]; then
+      fail "$rel/$name should be a symlink to ../.claude/$name"
+      codex_ok=0
+    fi
+  done < <(find "$dir" -mindepth 1 -maxdepth 1)
+  # Reverse: every entry in .codex must correspond to a .claude entry (no stale or dangling links).
+  while IFS= read -r entry; do
+    name=$(basename "$entry")
+    if [[ ! -e "$dir/$name" && ! -L "$dir/$name" ]]; then
+      fail "$rel/$name is stale; no matching .claude/$name"
+      codex_ok=0
+    fi
+  done < <(find "$codex" -mindepth 1 -maxdepth 1)
+  (( codex_ok )) && pass "$rel"
 done < <(find "$ROOT" -type d -name .claude -not -path "$ROOT/noir/*" -not -path "$ROOT/**/node_modules/*")
 
 echo

.github/workflows/deploy-network.yml

@@ -111,7 +111,9 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           ref: ${{ steps.checkout-ref.outputs.ref }}
-          fetch-depth: 1
+          # Full history so recursive submodules can checkout pinned commits (not only branch tips).
+          fetch-depth: 0
+          lfs: true
           persist-credentials: false
           submodules: recursive # Initialize git submodules for l1-contracts dependencies
 

.github/workflows/nightly-bench-10tps.yml

@@ -80,7 +80,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          ref: next
+          ref: ${{ github.sha }}
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f
@@ -108,7 +108,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          ref: next
+          ref: ${{ github.sha }}
 
       - name: Run 10 TPS benchmark
         timeout-minutes: 240

.github/workflows/weekly-proving-bench.yml

@@ -71,7 +71,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
-          ref: next
+          ref: ${{ github.sha }}
 
       - name: Authenticate to Google Cloud
         uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f

.test_patterns.yml

@@ -91,6 +91,13 @@ tests:
     owners:
       - *nico
 
+  # Fails in CI: "No execution steps in ivc-inputs.msgpack" — pinned Chonk IVC
+  # inputs missing/stale. http://ci.aztec-labs.com/d7647a841ee811a0
+  - regex: "bbapi/chonk_pinned_inputs.test"
+    skip: true
+    owners:
+      - *palla
+
   # e2e tests skipped
   - regex: "testbench/port_change.test.ts"
     skip: true
@@ -342,6 +349,15 @@ tests:
     owners:
       - *adam
 
+  # http://ci.aztec-labs.com/93754bdf832ef9bd
+  # P2P receipt race in the compose CLI-wallet flow: the account deployment tx
+  # can be reported as dropped after the 5s grace window before inclusion is
+  # visible to the queried node.
+  - regex: "yarn-project/end-to-end/scripts/run_test.sh compose ../cli-wallet/test/flows/public_authwit_transfer.sh"
+    error_regex: "Transaction .* was dropped\\. Reason: Tx dropped by P2P node"
+    owners:
+      - *palla
+
   - regex: "cd l1-contracts && forge test"
     error_regex: "Encountered 1 failing test in test/staking_asset_handler/claim.t.sol:ClaimTest"
     owners:
@@ -379,20 +395,6 @@ tests:
     owners:
       - *spyros
 
-  # Multi-validator web3signer suite is unstable under proposer pipelining:
-  # two distinct failure modes have been seen in the same "should build blocks
-  # & attest with multiple validator keys" case — Promise.all index-0
-  # waitForTx aborting with "Tx dropped by P2P node"
-  # (ci.aztec-labs.com/9a5fa90aa18f62e7), and the proposer missing the slot's
-  # 5-attestation deadline ("AttestationTimeoutError" / "Block .* not found .*
-  # reorg") on PR #23344 run 26370196367 (ci.aztec-labs.com/b91d3218b5e88ae4).
-  # Error-regex flake matches still let ci3 retry-and-fail both attempts. Skip
-  # outright on merge-train/spartan until proposer pipelining stabilises.
-  - regex: "yarn-project/end-to-end/scripts/run_test.sh web3signer src/composed/web3signer/e2e_multi_validator_node_key_store.test.ts"
-    skip: true
-    owners:
-      - *palla
-
   # http://ci.aztec-labs.com/98d59d04f85223f8
   # Build-cache flake: module not found during Jest startup
   - regex: "src/e2e_sequencer/gov_proposal.parallel.test.ts"

barretenberg/.codex

@@ -0,0 +1 @@
+../.claude/agents

barretenberg/.codex/agents

@@ -0,0 +1 @@
+../.claude/skills