chore: Accumulated backports to v4-next (#23198)

BEGIN_COMMIT_OVERRIDE
chore: kv store test fully on vitest (#23096)
chore: backport kv-store vitest migration (#23096) to v4-next (#23185)
test: add noir tests for get_note_hash_membership_witness (#23190)
fix(aztec-up): explicit exit in CLI acceptance test harness (#23200)
refactor(pxe): batch nullifier sync across scopes (#23129)
refactor(pxe): backport batch nullifier sync across scopes (#23129) to
v4-next (#23208)
fix(ci): revert ci-compat-e2e to AWS access keys (#23211)
test: drop event_logs from compat matrix and loosen avm_simulator
assertion regex (#23193)
fix(aztec-up): install manifest-pinned Node version instead of LTS
(#23201)
fix(ci): move CLI acceptance test timeout from job to step (#23205)
END_COMMIT_OVERRIDE

Author: AztecBot

.github/workflows/aztec-cli-acceptance-test.yml

@@ -24,7 +24,6 @@ jobs:
       (github.event_name == 'workflow_run'
        && github.event.workflow_run.conclusion == 'success'
        && !contains(github.event.workflow_run.head_branch, '-commit.'))
-    timeout-minutes: 30
     env:
       VERSION: ${{ github.event.inputs.version || github.event.workflow_run.head_branch }}
     steps:
@@ -41,6 +40,7 @@ jobs:
           node-version: 22
 
       - name: Run Aztec CLI acceptance test
+        timeout-minutes: 30
         run: ./aztec-up/test/aztec-cli-acceptance-test/run-test.sh
 
       - name: Notify Slack on success

.github/workflows/ci3.yml

@@ -298,9 +298,6 @@ jobs:
   # Escape hatch: ci-skip-compat-e2e label makes failures non-blocking on release PRs.
   ci-compat-e2e:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
     needs: [ci]
     if: |
       always()
@@ -320,17 +317,11 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
-          aws-region: us-east-2
-          role-session-name: ci3-compat-e2e-${{ github.run_id }}
-          role-duration-seconds: 21600 # 6h – covers AWS_SHUTDOWN_TIME (300 min) + 60 min buffer
-
       - name: Run Backwards Compatibility E2E Tests
         timeout-minutes: 330
         env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
           BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}

aztec-up/bin/0.0.1/install

@@ -123,13 +123,13 @@ function install_node {
   # Need to install - check if nvm is available
   if [ ! -f "$HOME/.nvm/nvm.sh" ]; then
     echo "Minimum Node.js version $node_min_version not found (got $node_installed_version)."
-    echo "Installation: nvm install --lts && nvm alias default lts/*"
+    echo "Installation: nvm install $node_min_version && nvm alias default $node_min_version"
     exit 1
   fi
 
   . "$HOME/.nvm/nvm.sh"
-  nvm install --lts
-  nvm alias default lts/*
+  nvm install "$node_min_version"
+  nvm alias default "$node_min_version"
 }
 
 function install_versions_file {

aztec-up/test/aztec-cli-acceptance-test/aztec-cli-acceptance-test.ts

@@ -72,10 +72,14 @@ if (result.ok) {
   log(`All steps PASSED (${msToSecs(Date.now() - totalStart)}s total)`);
   console.log(`TEST_RESULT=pass version=${result.aztecVersion}`);
   rmSync(TMP_DIR, { recursive: true, force: true });
+  // Explicit exit fires the 'exit' handler registered in startLocalNetwork(), which SIGTERMs the
+  // long-running `aztec start --local-network` child. Without this, the child keeps Node's event
+  // loop alive — the handler never fires and the process hangs until the CI timeout cancels it.
+  process.exit(0);
 } else {
   reportFailure(result.stepName, result.aztecVersion, result.error);
   leaveTmpDirForInspection();
-  process.exitCode = 1;
+  process.exit(1);
 }
 
 async function main(): Promise<RunResult> {

noir-projects/aztec-nr/aztec/src/history/mod.nr

@@ -14,4 +14,4 @@ pub mod deployment;
 pub mod note;
 pub mod nullifier;
 pub mod storage;
-mod test;
+pub(crate) mod test;

noir-projects/aztec-nr/aztec/src/oracle/get_membership_witness.nr

@@ -21,7 +21,6 @@ unconstrained fn get_block_hash_membership_witness_oracle(
 
 /// Returns a membership witness for a `note_hash` in the note hash tree whose root is defined in
 // `anchor_block_header`.
-// TODO(https://linear.app/aztec-labs/issue/F-652): add Noir tests for this oracle
 pub unconstrained fn get_note_hash_membership_witness(
     anchor_block_header: BlockHeader,
     note_hash: Field,
@@ -55,10 +54,52 @@ pub unconstrained fn get_maybe_block_hash_membership_witness(
 }
 
 mod test {
+    use crate::history::test::{create_note, NOTE_CREATED_AT};
+    use crate::note::note_interface::NoteHash;
     use crate::oracle::block_header::get_block_header_at;
-    use crate::protocol::{merkle_tree::root::root_from_sibling_path, traits::Hash};
-    use crate::test::helpers::test_environment::TestEnvironment;
-    use super::{get_block_hash_membership_witness, get_maybe_block_hash_membership_witness};
+    use crate::protocol::{
+        hash::{compute_siloed_note_hash, compute_unique_note_hash},
+        merkle_tree::root::root_from_sibling_path,
+        traits::Hash,
+    };
+    use crate::test::helpers::test_environment::{PrivateContextOptions, TestEnvironment};
+    use super::{
+        get_block_hash_membership_witness, get_maybe_block_hash_membership_witness, get_note_hash_membership_witness,
+    };
+
+    #[test]
+    unconstrained fn get_note_hash_membership_witness_returns_valid_witness_for_known_note() {
+        let (env, hinted_note) = create_note();
+
+        env.private_context_opts(PrivateContextOptions::new().at_anchor_block_number(NOTE_CREATED_AT), |context| {
+            let anchor = context.anchor_block_header;
+
+            let note_hash =
+                hinted_note.note.compute_note_hash(hinted_note.owner, hinted_note.storage_slot, hinted_note.randomness);
+            let siloed = compute_siloed_note_hash(hinted_note.contract_address, note_hash);
+            let unique = compute_unique_note_hash(hinted_note.metadata.to_settled().note_nonce(), siloed);
+
+            let witness = get_note_hash_membership_witness(anchor, unique);
+
+            assert_eq(
+                root_from_sibling_path(unique, witness.leaf_index, witness.sibling_path),
+                anchor.state.partial.note_hash_tree.root,
+            );
+        });
+    }
+
+    #[test(should_fail_with = "not found in the note hash tree at block")]
+    unconstrained fn get_note_hash_membership_witness_panics_for_unknown_note() {
+        let env = TestEnvironment::new();
+
+        env.mine_block();
+        env.mine_block();
+
+        env.private_context(|context| {
+            let anchor = context.anchor_block_header;
+            let _witness = get_note_hash_membership_witness(anchor, 0xdeadbeef);
+        });
+    }
 
     #[test]
     unconstrained fn get_block_hash_membership_witness_returns_valid_witness_for_known_block() {

yarn-project/end-to-end/bootstrap.sh

@@ -262,6 +262,8 @@ function avm_check_circuit {
 # tests are known-flaky and provide no additional backwards-compat coverage). Also excludes
 # kernelless_simulation, which asserts on the exact number of nullifiers emitted and breaks whenever
 # contracts add/remove nullifier emissions across versions (unrelated to the compat contract surface).
+# event_logs is excluded because the new tagging-cache reconciliation test (#23044) calls a
+# TestLog method (deliver_squashed_and_surviving_notes) that does not exist in legacy artifacts.
 function compat_test_cmds {
   local version=${1:?version is required}
   local run_test_script="yarn-project/end-to-end/scripts/run_test.sh"
@@ -271,7 +273,7 @@ function compat_test_cmds {
   local tests=(
     src/e2e_!(prover|block_building|epochs)/*.test.ts
     src/e2e_p2p/reqresp/*.test.ts
-    src/e2e_!(block_building|prover_*|kernelless_simulation).test.ts
+    src/e2e_!(block_building|prover_*|kernelless_simulation|event_logs).test.ts
   )
   for test in "${tests[@]}"; do
     local name=${test#*e2e_}

yarn-project/end-to-end/src/e2e_avm_simulator.test.ts

@@ -56,16 +56,19 @@ describe('e2e_avm_simulator', () => {
        * at function.name();
        * let call = quote { $name($args) (/home/aztec-dev/aztec-packages/noir-projects/aztec-nr/aztec/src/macros/dispatch.nr:59:20)
        * at AvmTest.0xc3515746
+       *
+       * Older nargo (pre-#22911) recorded the assertion span as the inner boolean expression only,
+       * so legacy contract artifacts under compat-e2e emit `'not_true == true'` instead of the full
+       * `'assert(not_true == true, "This assertion should fail!")'`. The regex below accepts either
+       * form so the test passes against both current-nargo artifacts and pinned legacy artifacts.
        */
       describe('Not nested', () => {
         it('PXE processes user code assertions and recovers message (properly enriched)', async () => {
           await expect(
             avmContract.methods.assertion_failure().simulate({ from: defaultAccountAddress }),
           ).rejects.toThrow(
             expect.objectContaining({
-              message: expect.stringMatching(
-                /Assertion failed: This assertion should fail! 'assert\(not_true == true, "This assertion should fail!"\)'/,
-              ),
+              message: expect.stringMatching(/Assertion failed: This assertion should fail!.*not_true == true/),
               stack: expect.stringMatching(/at inner_helper_with_failed_assertion[\s\S]*at AvmTest\..*/),
             }),
           );

yarn-project/kv-store/.mocharc.json

@@ -16,10 +16,10 @@
     "build": "yarn clean && ../scripts/tsc.sh",
     "build:dev": "../scripts/tsc.sh --watch",
     "clean": "rm -rf ./dest .tsbuildinfo",
-    "test:node": "NODE_NO_WARNINGS=1 mocha --config ./.mocharc.json",
+    "test:node": "vitest run --project node",
     "test:browser": "bash scripts/run-browser-tests.sh",
-    "bench:browser": "VITE_BENCH=1 vitest run --config ./vitest.config.ts src/bench",
-    "test": "yarn test:node && yarn test:browser",
+    "bench:browser": "VITE_BENCH=1 vitest run --project browser src/bench",
+    "test": "vitest run",
     "test:jest": "NODE_NO_WARNINGS=1 node --experimental-vm-modules ../node_modules/.bin/jest --passWithNoTests --maxWorkers=${JEST_MAX_WORKERS:-8}"
   },
   "inherits": [
@@ -41,23 +41,13 @@
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
-    "@types/chai": "^5.0.1",
-    "@types/chai-as-promised": "^8.0.1",
     "@types/jest": "^30.0.0",
-    "@types/mocha": "^10.0.10",
-    "@types/mocha-each": "^2.0.4",
     "@types/node": "^22.15.17",
-    "@types/sinon": "^17.0.3",
     "@typescript/native-preview": "7.0.0-dev.20260113.1",
     "@vitest/browser-playwright": "^4.0.0",
     "buffer": "^6.0.3",
-    "chai": "^5.1.2",
-    "chai-as-promised": "^8.0.1",
     "jest": "^30.0.0",
-    "mocha": "^10.8.2",
-    "mocha-each": "^2.0.1",
     "playwright": "1.49.0",
-    "sinon": "^19.0.2",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.3",
     "util": "^0.12.5",