chore: merge v5-next into backport-to-v5-next-staging

Author: aminsammara

.claude/agents/aztec-wallet.md

@@ -48,7 +48,7 @@ fi
 
 # Query node version
 RESPONSE=$(curl -sf -X POST -H 'Content-type: application/json' \
-  --data '{"jsonrpc":"2.0","id":1,"method":"node_getNodeInfo"}' \
+  --data '{"jsonrpc":"2.0","id":1,"method":"aztec_getNodeInfo"}' \
   "$RPC_URL" 2>&1) || {
   echo "ERROR: Could not reach node at $RPC_URL" >&2
   echo "Response: $RESPONSE" >&2

.claude/skills/release-docs/SKILL.md

@@ -30,7 +30,7 @@ Fetch node info from the provided RPC URL:
 
 ```bash
 curl -s -X POST -H 'Content-Type: application/json' \
-  -d '{"method":"node_getNodeInfo"}' <RPC_URL> | jq .result
+  -d '{"method":"aztec_getNodeInfo"}' <RPC_URL> | jq .result
 ```
 
 Parse the response to extract:
@@ -214,7 +214,7 @@ These files are auto-generated — do not hand-edit them.
 
 Regenerate the Node JSON-RPC API reference documentation. This script parses the
 TypeScript interface definitions and Zod schemas in `yarn-project/stdlib/src/interfaces/`
-to produce a complete markdown reference for the `node_` and `nodeAdmin_` RPC methods.
+to produce a complete markdown reference for the `aztec_` and `aztecAdmin_` RPC methods.
 
 **Prerequisite:** `yarn-project` must be built (already done in Step 6 prerequisites).
 
@@ -259,7 +259,7 @@ docs (Step 13), the generated content is included in the snapshot automatically.
 ### Step 9: Resolve Missing Contract Addresses & Update Network Info
 
 The `networks.md` L1 table includes contracts that are **not** returned by
-`node_getNodeInfo`. Before updating the tables, resolve these in three tiers.
+`aztec_getNodeInfo`. Before updating the tables, resolve these in three tiers.
 
 Determine the L1 RPC URL from the `l1ChainId`: `1` → Ethereum mainnet,
 `11155111` → Sepolia. The Rollup and Registry addresses are already known from

.claude/skills/release-network-docs/SKILL.md

@@ -45,7 +45,7 @@ Fetch node info from the provided RPC URL:
 
 ```bash
 curl -s -X POST -H 'Content-Type: application/json' \
-  -d '{"method":"node_getNodeInfo"}' <RPC_URL> | jq .result
+  -d '{"method":"aztec_getNodeInfo"}' <RPC_URL> | jq .result
 ```
 
 Parse the response to extract:
@@ -87,7 +87,7 @@ git tag -l "v<nodeVersion>"
 ### Step 3: Identify and Resolve Missing Contract Addresses
 
 The `networks.md` L1 table includes contracts that are **not** returned by
-`node_getNodeInfo`. Resolve these addresses in three tiers:
+`aztec_getNodeInfo`. Resolve these addresses in three tiers:
 
 #### Tier 1: Query on-chain from known contracts
 

.github/actions/network-teardown/action.yml

@@ -0,0 +1,52 @@
+name: "Spartan network teardown"
+description: >
+  Tear down a deployed Spartan network (delete any Chaos Mesh experiments and
+  the Kubernetes namespace) directly on the GitHub runner. This replaces the
+  EC2-backed `ci3.sh network-teardown` path for cleanup: teardown is pure
+  gcloud/kubectl work, so there is no need to provision a build instance.
+inputs:
+  env_file:
+    description: "Spartan environment file name (e.g. tps-scenario), used to source CLUSTER and GCP_REGION."
+    required: true
+  namespace:
+    description: "Kubernetes namespace to tear down."
+    required: true
+  gcp_sa_key:
+    description: "GCP service account key JSON (secrets.GCP_SA_KEY)."
+    required: true
+  gcp_project_id:
+    description: "GCP project id (secrets.GCP_PROJECT_ID)."
+    required: true
+runs:
+  using: "composite"
+  steps:
+    - name: Setup gcloud and install GKE auth plugin
+      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v2.1.4
+      with:
+        install_components: "gke-gcloud-auth-plugin"
+
+    - name: Tear down network
+      shell: bash
+      env:
+        GCP_SA_KEY: ${{ inputs.gcp_sa_key }}
+        GCP_PROJECT_ID: ${{ inputs.gcp_project_id }}
+        NAMESPACE: ${{ inputs.namespace }}
+        ENV_FILE: ${{ inputs.env_file }}
+        GOOGLE_APPLICATION_CREDENTIALS: /tmp/gcp-key.json
+        CI: "1"
+      run: |
+        set -euo pipefail
+        # Store the GCP service account key for gcloud auth and the teardown.
+        set +x
+        umask 077
+        printf '%s' "$GCP_SA_KEY" > "$GOOGLE_APPLICATION_CREDENTIALS"
+        jq -e . "$GOOGLE_APPLICATION_CREDENTIALS" >/dev/null
+
+        cd "$(git rev-parse --show-toplevel)/spartan"
+        # Reuse the same env + auth + teardown scripts the EC2 path runs, but
+        # execute them directly on the runner instead of via bootstrap_ec2.
+        source ./scripts/source_env_basic.sh
+        source ./scripts/gcp_auth.sh
+        source_env_basic "$ENV_FILE"
+        gcp_auth
+        ./scripts/network_teardown.sh

.github/ci3_labels_to_env.sh

@@ -127,6 +127,9 @@ function main {
     echo "WARNING: Skipping main CI because Chonk input refresh was requested; the update step will run after this step succeeds." >&2
     ci_mode="skip"
   elif has_label "ci-release-pr"; then
+    # Release-PR mode creates and pushes a release tag for this PR's head (ci3.sh::handle_release_pr).
+    # In the private repo that tag triggers a private release via the safety gate below — this is the
+    # manual way to cut a private release from a PR, alongside the nightly tag cron.
     ci_mode="release-pr"
   elif has_label "ci-full"; then
     ci_mode="full"
@@ -141,6 +144,9 @@ function main {
   elif has_label "ci-barretenberg" || [ "$target_branch" == "merge-train/barretenberg" ]; then
     ci_mode="barretenberg"
   elif [[ "${GITHUB_REF:-}" == refs/tags/v* ]]; then
+    # A pushed semver tag is a release; REF_NAME is the tag (see ci3/source_refname). In the private
+    # repo this is the nightly path (nightly-release-tag*.yml push v<ver>-nightly.<date> tags on next and
+    # v5-next); the private-repo safety gate below routes it to the internal Artifact Registry.
     ci_mode="release"
   else
     ci_mode="fast"
@@ -149,6 +155,17 @@ function main {
   echo "CI_MODE=$ci_mode" >> $GITHUB_ENV
   echo "CI mode: $ci_mode"
 
+  # Private-repo safety gate. The release flow can publish to DockerHub/npmjs/crates.io/github; that
+  # MUST NEVER run in the private fork. So whenever this repo would release — for ANY trigger (a pushed
+  # nightly tag, a ci-release-pr tag, anything future) — force the private path: publish only the docker
+  # image and npm packages to our internal Artifact Registry (bootstrap.sh::private_release). Keyed on
+  # the repo name (case-insensitive) so it can't be reached in the public repo.
+  if [ "$ci_mode" = "release" ] &&
+     [ "$(printf '%s' "${GITHUB_REPOSITORY:-}" | tr 'A-Z' 'a-z')" = "aztecprotocol/aztec-packages-private" ]; then
+    echo "PRIVATE_RELEASE=1" >> $GITHUB_ENV
+    echo "SKIP_COMPAT_E2E=1" >> $GITHUB_ENV
+  fi
+
   # Determine if benchmarks should be uploaded (merge-queue, full, or full-no-test-cache modes)
   if [[ "$ci_mode" == "merge-queue" || "$ci_mode" == "merge-queue-heavy" || "$ci_mode" == "full" || "$ci_mode" == "full-no-test-cache" ]]; then
     echo "SHOULD_UPLOAD_BENCHMARKS=1" >> $GITHUB_ENV

.github/workflows/avm-circuit-inputs.yml

@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   collect-avm-circuit-inputs:
+    if: github.repository != 'AztecProtocol/aztec-packages-private'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -66,6 +67,7 @@ jobs:
 
   avm-check-circuit:
     needs: collect-avm-circuit-inputs
+    if: github.repository != 'AztecProtocol/aztec-packages-private'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout

.github/workflows/bench-inclusion-point.yml

@@ -0,0 +1,62 @@
+name: Bench Inclusion Point
+
+# Reusable: runs ONE inclusion-sweep TPS point against an ALREADY-DEPLOYED
+# network (SKIP_NETWORK_DEPLOY=1). The caller (nightly-bench-inclusion-sweep.yml)
+# deploys the network once and calls this for each point (1/5/10 TPS), chaining
+# the calls so the points run sequentially on the same network. Deploy / wait /
+# teardown are done once by the caller, not here.
+
+on:
+  workflow_call:
+    inputs:
+      tps:
+        description: "Target TPS for this point"
+        required: true
+        type: string
+      namespace:
+        description: "k8s namespace of the already-deployed network"
+        required: true
+        type: string
+      network:
+        description: "Network env name (environments/<network>.env)"
+        required: false
+        type: string
+        default: bench-inclusion-sweep
+      docker_image:
+        description: "Full aztec docker image (already deployed)"
+        required: true
+        type: string
+      source_ref:
+        description: "Git ref to checkout for the bench scripts"
+        required: true
+        type: string
+      sweep_id:
+        description: "Shared sweep id so the dashboard groups the points"
+        required: true
+        type: string
+
+jobs:
+  bench:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+        with:
+          ref: ${{ inputs.source_ref }}
+      - name: Run ${{ inputs.tps }} TPS inclusion point
+        timeout-minutes: 120
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
+          GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}
+          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          RUN_ID: ${{ github.run_id }}
+          AWS_SHUTDOWN_TIME: 180
+          NO_SPOT: 1
+          SKIP_NETWORK_DEPLOY: "1"
+          TARGET_TPS: ${{ inputs.tps }}
+          BENCH_SWEEP_ID: ${{ inputs.sweep_id }}
+          BENCH_SWEEP_LABEL: inclusion-sweep
+        run: ./.github/ci3.sh network-inclusion-sweep ${{ inputs.network }} ${{ inputs.namespace }} "${{ inputs.docker_image }}"

.github/workflows/ci3.yml

@@ -7,6 +7,8 @@ name: CI3
 on:
   workflow_dispatch:
   push:
+    branches:
+      - next
     tags:
       - "v*"
   pull_request:
@@ -115,6 +117,9 @@ jobs:
           EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY: ${{ secrets.GCP_SEPOLIA_API_KEY }}
           EXTERNAL_ETHEREUM_CONSENSUS_HOST_API_KEY_HEADER: "X-goog-api-key"
           GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          # Internal GCP Artifact Registry the private repo's release pushes the docker image to (see
+          # bootstrap.sh::private_release). Empty in the public repo, where releases publish normally.
+          INTERNAL_DOCKER_REGISTRY: ${{ vars.INTERNAL_DOCKER_REGISTRY }}
           MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
           PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
@@ -254,6 +259,7 @@ jobs:
           DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
           DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          INTERNAL_DOCKER_REGISTRY: ${{ secrets.INTERNAL_DOCKER_REGISTRY }}
           CI3_INSTANCE_PROFILE_NAME: ${{ secrets.CI3_INSTANCE_PROFILE_NAME }}
           CI3_SECURITY_GROUP_ID: ${{ secrets.CI3_SECURITY_GROUP_ID }}
           RUN_ID: ${{ github.run_id }}
@@ -269,7 +275,16 @@ jobs:
             tag="${tag#v}"
             major_version=$(./ci3/semver major "$tag")
             namespace="v${major_version}-scenario"
-            docker_image="aztecprotocol/aztec:${tag}"
+            case "$GITHUB_REPOSITORY" in
+              AztecProtocol/aztec-packages-private)
+                image_registry="${INTERNAL_DOCKER_REGISTRY%/}"
+                echo "::add-mask::${image_registry}"
+                ;;
+              *)
+                image_registry="aztecprotocol"
+                ;;
+            esac
+            docker_image="${image_registry}/aztec:${tag}"
           else
             # branch name
             namespace=pr-$(echo "$HEAD_REF" | sed 's/[^a-z0-9-]/-/g' | cut -c1-20 | sed 's/-*$//')

.github/workflows/docs-typesense.yml

@@ -39,6 +39,11 @@ jobs:
         run: |
           set -euo pipefail
 
+          if [ -z "$TYPESENSE_API_KEY" ] || [ -z "$TYPESENSE_HOST" ]; then
+            echo "Typesense secrets are not configured; skipping docs search reindex."
+            exit 0
+          fi
+
           docker run \
             -e "TYPESENSE_API_KEY=$TYPESENSE_API_KEY" \
             -e "TYPESENSE_HOST=$TYPESENSE_HOST" \

.github/workflows/fuzzing-docker-avm-build-private.yml

@@ -1,9 +1,6 @@
 name: Build Private Fuzzing AVM Container
 
 on:
-  push:
-    branches:
-      - next
   workflow_dispatch:
     inputs:
       commit: