chore: Accumulated backports to v4-next

.github/workflows/aztec-cli-acceptance-test.yml

@@ -24,7 +24,6 @@ jobs:
       (github.event_name == 'workflow_run'
        && github.event.workflow_run.conclusion == 'success'
        && !contains(github.event.workflow_run.head_branch, '-commit.'))
-    timeout-minutes: 30
     env:
       VERSION: ${{ github.event.inputs.version || github.event.workflow_run.head_branch }}
     steps:
@@ -41,6 +40,7 @@ jobs:
           node-version: 22
 
       - name: Run Aztec CLI acceptance test
+        timeout-minutes: 30
         run: ./aztec-up/test/aztec-cli-acceptance-test/run-test.sh
 
       - name: Notify Slack on success

.github/workflows/ci3.yml

@@ -298,9 +298,6 @@ jobs:
   # Escape hatch: ci-skip-compat-e2e label makes failures non-blocking on release PRs.
   ci-compat-e2e:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
     needs: [ci]
     if: |
       always()
@@ -320,17 +317,11 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
-          aws-region: us-east-2
-          role-session-name: ci3-compat-e2e-${{ github.run_id }}
-          role-duration-seconds: 21600 # 6h – covers AWS_SHUTDOWN_TIME (300 min) + 60 min buffer
-
       - name: Run Backwards Compatibility E2E Tests
         timeout-minutes: 330
         env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
           BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
           GCP_SA_KEY: ${{ secrets.GCP_SA_KEY }}

aztec-up/bin/0.0.1/install

@@ -123,13 +123,13 @@ function install_node {
   # Need to install - check if nvm is available
   if [ ! -f "$HOME/.nvm/nvm.sh" ]; then
     echo "Minimum Node.js version $node_min_version not found (got $node_installed_version)."
-    echo "Installation: nvm install --lts && nvm alias default lts/*"
+    echo "Installation: nvm install $node_min_version && nvm alias default $node_min_version"
     exit 1
   fi
 
   . "$HOME/.nvm/nvm.sh"
-  nvm install --lts
-  nvm alias default lts/*
+  nvm install "$node_min_version"
+  nvm alias default "$node_min_version"
 }
 
 function install_versions_file {

aztec-up/test/aztec-cli-acceptance-test/aztec-cli-acceptance-test.ts

@@ -72,10 +72,14 @@ if (result.ok) {
   log(`All steps PASSED (${msToSecs(Date.now() - totalStart)}s total)`);
   console.log(`TEST_RESULT=pass version=${result.aztecVersion}`);
   rmSync(TMP_DIR, { recursive: true, force: true });
+  // Explicit exit fires the 'exit' handler registered in startLocalNetwork(), which SIGTERMs the
+  // long-running `aztec start --local-network` child. Without this, the child keeps Node's event
+  // loop alive — the handler never fires and the process hangs until the CI timeout cancels it.
+  process.exit(0);
 } else {
   reportFailure(result.stepName, result.aztecVersion, result.error);
   leaveTmpDirForInspection();
-  process.exitCode = 1;
+  process.exit(1);
 }
 
 async function main(): Promise<RunResult> {

noir-projects/aztec-nr/aztec/src/history/mod.nr

@@ -14,4 +14,4 @@ pub mod deployment;
 pub mod note;
 pub mod nullifier;
 pub mod storage;
-mod test;
+pub(crate) mod test;

noir-projects/aztec-nr/aztec/src/oracle/get_membership_witness.nr

@@ -21,7 +21,6 @@ unconstrained fn get_block_hash_membership_witness_oracle(
 
 /// Returns a membership witness for a `note_hash` in the note hash tree whose root is defined in
 // `anchor_block_header`.
-// TODO(https://linear.app/aztec-labs/issue/F-652): add Noir tests for this oracle
 pub unconstrained fn get_note_hash_membership_witness(
     anchor_block_header: BlockHeader,
     note_hash: Field,
@@ -55,10 +54,52 @@ pub unconstrained fn get_maybe_block_hash_membership_witness(
 }
 
 mod test {
+    use crate::history::test::{create_note, NOTE_CREATED_AT};
+    use crate::note::note_interface::NoteHash;
     use crate::oracle::block_header::get_block_header_at;
-    use crate::protocol::{merkle_tree::root::root_from_sibling_path, traits::Hash};
-    use crate::test::helpers::test_environment::TestEnvironment;
-    use super::{get_block_hash_membership_witness, get_maybe_block_hash_membership_witness};
+    use crate::protocol::{
+        hash::{compute_siloed_note_hash, compute_unique_note_hash},
+        merkle_tree::root::root_from_sibling_path,
+        traits::Hash,
+    };
+    use crate::test::helpers::test_environment::{PrivateContextOptions, TestEnvironment};
+    use super::{
+        get_block_hash_membership_witness, get_maybe_block_hash_membership_witness, get_note_hash_membership_witness,
+    };
+
+    #[test]
+    unconstrained fn get_note_hash_membership_witness_returns_valid_witness_for_known_note() {
+        let (env, hinted_note) = create_note();
+
+        env.private_context_opts(PrivateContextOptions::new().at_anchor_block_number(NOTE_CREATED_AT), |context| {
+            let anchor = context.anchor_block_header;
+
+            let note_hash =
+                hinted_note.note.compute_note_hash(hinted_note.owner, hinted_note.storage_slot, hinted_note.randomness);
+            let siloed = compute_siloed_note_hash(hinted_note.contract_address, note_hash);
+            let unique = compute_unique_note_hash(hinted_note.metadata.to_settled().note_nonce(), siloed);
+
+            let witness = get_note_hash_membership_witness(anchor, unique);
+
+            assert_eq(
+                root_from_sibling_path(unique, witness.leaf_index, witness.sibling_path),
+                anchor.state.partial.note_hash_tree.root,
+            );
+        });
+    }
+
+    #[test(should_fail_with = "not found in the note hash tree at block")]
+    unconstrained fn get_note_hash_membership_witness_panics_for_unknown_note() {
+        let env = TestEnvironment::new();
+
+        env.mine_block();
+        env.mine_block();
+
+        env.private_context(|context| {
+            let anchor = context.anchor_block_header;
+            let _witness = get_note_hash_membership_witness(anchor, 0xdeadbeef);
+        });
+    }
 
     #[test]
     unconstrained fn get_block_hash_membership_witness_returns_valid_witness_for_known_block() {

yarn-project/end-to-end/bootstrap.sh

@@ -262,6 +262,8 @@ function avm_check_circuit {
 # tests are known-flaky and provide no additional backwards-compat coverage). Also excludes
 # kernelless_simulation, which asserts on the exact number of nullifiers emitted and breaks whenever
 # contracts add/remove nullifier emissions across versions (unrelated to the compat contract surface).
+# event_logs is excluded because the new tagging-cache reconciliation test (#23044) calls a
+# TestLog method (deliver_squashed_and_surviving_notes) that does not exist in legacy artifacts.
 function compat_test_cmds {
   local version=${1:?version is required}
   local run_test_script="yarn-project/end-to-end/scripts/run_test.sh"
@@ -271,7 +273,7 @@ function compat_test_cmds {
   local tests=(
     src/e2e_!(prover|block_building|epochs)/*.test.ts
     src/e2e_p2p/reqresp/*.test.ts
-    src/e2e_!(block_building|prover_*|kernelless_simulation).test.ts
+    src/e2e_!(block_building|prover_*|kernelless_simulation|event_logs).test.ts
   )
   for test in "${tests[@]}"; do
     local name=${test#*e2e_}

yarn-project/end-to-end/src/e2e_avm_simulator.test.ts

@@ -56,16 +56,19 @@ describe('e2e_avm_simulator', () => {
        * at function.name();
        * let call = quote { $name($args) (/home/aztec-dev/aztec-packages/noir-projects/aztec-nr/aztec/src/macros/dispatch.nr:59:20)
        * at AvmTest.0xc3515746
+       *
+       * Older nargo (pre-#22911) recorded the assertion span as the inner boolean expression only,
+       * so legacy contract artifacts under compat-e2e emit `'not_true == true'` instead of the full
+       * `'assert(not_true == true, "This assertion should fail!")'`. The regex below accepts either
+       * form so the test passes against both current-nargo artifacts and pinned legacy artifacts.
        */
       describe('Not nested', () => {
         it('PXE processes user code assertions and recovers message (properly enriched)', async () => {
           await expect(
             avmContract.methods.assertion_failure().simulate({ from: defaultAccountAddress }),
           ).rejects.toThrow(
             expect.objectContaining({
-              message: expect.stringMatching(
-                /Assertion failed: This assertion should fail! 'assert\(not_true == true, "This assertion should fail!"\)'/,
-              ),
+              message: expect.stringMatching(/Assertion failed: This assertion should fail!.*not_true == true/),
               stack: expect.stringMatching(/at inner_helper_with_failed_assertion[\s\S]*at AvmTest\..*/),
             }),
           );

yarn-project/kv-store/package.json

@@ -16,10 +16,10 @@
     "build": "yarn clean && ../scripts/tsc.sh",
     "build:dev": "../scripts/tsc.sh --watch",
     "clean": "rm -rf ./dest .tsbuildinfo",
-    "test:node": "NODE_NO_WARNINGS=1 mocha --config ./.mocharc.json",
+    "test:node": "vitest run --project node",
     "test:browser": "bash scripts/run-browser-tests.sh",
-    "bench:browser": "VITE_BENCH=1 vitest run --config ./vitest.config.ts src/bench",
-    "test": "yarn test:node && yarn test:browser",
+    "bench:browser": "VITE_BENCH=1 vitest run --project browser src/bench",
+    "test": "vitest run",
     "test:jest": "NODE_NO_WARNINGS=1 node --experimental-vm-modules ../node_modules/.bin/jest --passWithNoTests --maxWorkers=${JEST_MAX_WORKERS:-8}"
   },
   "inherits": [
@@ -41,23 +41,13 @@
   },
   "devDependencies": {
     "@jest/globals": "^30.0.0",
-    "@types/chai": "^5.0.1",
-    "@types/chai-as-promised": "^8.0.1",
     "@types/jest": "^30.0.0",
-    "@types/mocha": "^10.0.10",
-    "@types/mocha-each": "^2.0.4",
     "@types/node": "^22.15.17",
-    "@types/sinon": "^17.0.3",
     "@typescript/native-preview": "7.0.0-dev.20260113.1",
     "@vitest/browser-playwright": "^4.0.0",
     "buffer": "^6.0.3",
-    "chai": "^5.1.2",
-    "chai-as-promised": "^8.0.1",
     "jest": "^30.0.0",
-    "mocha": "^10.8.2",
-    "mocha-each": "^2.0.1",
     "playwright": "1.49.0",
-    "sinon": "^19.0.2",
     "ts-node": "^10.9.1",
     "typescript": "^5.3.3",
     "util": "^0.12.5",

yarn-project/kv-store/package.local.json

@@ -1,6 +1,6 @@
 {
   "scripts": {
-    "test": "yarn test:node && yarn test:browser",
+    "test": "vitest run",
     "test:browser": "bash scripts/run-browser-tests.sh"
   }
 }

yarn-project/kv-store/scripts/run_test.sh

@@ -1,20 +1,10 @@
 #!/usr/bin/env bash
-# Runs a single kv-store test file. Dispatches to vitest+chromium for
-# browser tests (under src/indexeddb or src/sqlite-opfs) and to mocha for
-# everything else. Emitted by yarn-project/kv-store/bootstrap.sh test_cmds
-# for CI per-file fan-out and runnable directly for local reproduction:
-#
-#   yarn-project/kv-store/scripts/run_test.sh src/lmdb-v2/store.test.ts
+# Runs a single kv-store test file via vitest. The vitest config
+# (vitest.config.ts, projects array) determines whether the file runs
+# in node or browser environment based on its path.
 source $(git rev-parse --show-toplevel)/ci3/source
 
 test=${1:?"Usage: $0 <test-file relative to kv-store/>"}
 cd ..
 
-case "$test" in
-  src/indexeddb/*|src/sqlite-opfs/*)
-    exec yarn vitest run --config ./vitest.config.ts "$test"
-    ;;
-  *)
-    NODE_NO_WARNINGS=1 exec yarn mocha --config ./.mocharc.json "$test"
-    ;;
-esac
+NODE_NO_WARNINGS=1 exec yarn vitest run --config ./vitest.config.ts "$test"

yarn-project/kv-store/src/indexeddb/version_management.test.ts

@@ -1,8 +1,6 @@
 import { EthAddress } from '@aztec/foundation/eth-address';
 import { DatabaseVersion } from '@aztec/stdlib/database-version/version';
 
-import { expect } from 'chai';
-
 import { mockLogger } from '../interfaces/utils.js';
 import { initStoreForRollupAndSchemaVersion } from '../utils.js';
 import { AztecIndexedDBStore } from './store.js';
@@ -31,8 +29,8 @@ describe('IndexedDB Version Management', () => {
         const stored = await versionSingleton.getAsync();
 
         const storedVersion = DatabaseVersion.fromBuffer(Buffer.from(stored!, 'utf-8'));
-        expect(storedVersion.schemaVersion).to.equal(schemaVersion);
-        expect(storedVersion.rollupAddress.toString()).to.equal(rollupAddress.toString());
+        expect(storedVersion.schemaVersion).toBe(schemaVersion);
+        expect(storedVersion.rollupAddress.toString()).toBe(rollupAddress.toString());
       });
     });
 
@@ -46,7 +44,7 @@ describe('IndexedDB Version Management', () => {
         await initStoreForRollupAndSchemaVersion(store, schemaVersion, rollupAddress, mockLogger);
 
         // Data should still exist
-        expect(await testMap.getAsync('key')).to.equal('value');
+        expect(await testMap.getAsync('key')).toBe('value');
       });
     });
 
@@ -60,7 +58,7 @@ describe('IndexedDB Version Management', () => {
         const newRollupAddress = EthAddress.random();
         await initStoreForRollupAndSchemaVersion(store, schemaVersion, newRollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
       });
     });
 
@@ -73,7 +71,7 @@ describe('IndexedDB Version Management', () => {
 
         await initStoreForRollupAndSchemaVersion(store, schemaVersion + 1, rollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
       });
 
       it('clears store when schema version decreases', async () => {
@@ -84,7 +82,7 @@ describe('IndexedDB Version Management', () => {
 
         await initStoreForRollupAndSchemaVersion(store, schemaVersion - 1, rollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
       });
     });
 
@@ -98,7 +96,7 @@ describe('IndexedDB Version Management', () => {
 
         await initStoreForRollupAndSchemaVersion(store, schemaVersion, rollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
       });
 
       it('clears store when version has wrong structure', async () => {
@@ -110,7 +108,7 @@ describe('IndexedDB Version Management', () => {
 
         await initStoreForRollupAndSchemaVersion(store, schemaVersion, rollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
       });
     });
 
@@ -126,13 +124,13 @@ describe('IndexedDB Version Management', () => {
         // Init with new version management should clear the old data
         await initStoreForRollupAndSchemaVersion(store, schemaVersion, rollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
 
         const versionSingleton = store.openSingleton<string>('dbVersion');
         const stored = await versionSingleton.getAsync();
         const storedVersion = DatabaseVersion.fromBuffer(Buffer.from(stored!, 'utf-8'));
-        expect(storedVersion.schemaVersion).to.equal(schemaVersion);
-        expect(storedVersion.rollupAddress.toString()).to.equal(rollupAddress.toString());
+        expect(storedVersion.schemaVersion).toBe(schemaVersion);
+        expect(storedVersion.rollupAddress.toString()).toBe(rollupAddress.toString());
       });
 
       it('clears store with old format even if rollup address matches', async () => {
@@ -145,7 +143,7 @@ describe('IndexedDB Version Management', () => {
 
         await initStoreForRollupAndSchemaVersion(store, schemaVersion, rollupAddress, mockLogger);
 
-        expect(await testMap.getAsync('key')).to.be.undefined;
+        expect(await testMap.getAsync('key')).toBeUndefined();
       });
     });
   });