feat: merge-train/spartan

.github/workflows/deploy-irm.yml

@@ -69,7 +69,7 @@ jobs:
       CLUSTER_NAME: ${{ inputs.cluster }}
       GKE_CLUSTER_CONTEXT: "gke_testnet-440309_us-west1-a_${{ inputs.cluster }}"
       REGION: us-west1-a
-      INFURA_SECRET_NAME: infura-${{ inputs.l1_network }}-url
+      ETHEREUM_HOSTS_SECRET_NAME: irm-ethereum-hosts-${{ inputs.l1_network }}
 
     runs-on: ubuntu-latest
     steps:
@@ -150,4 +150,4 @@ jobs:
           echo "L1 network: ${{ inputs.l1_network }}"
           echo "Image tag: ${IMAGE_TAG}"
 
-          ./spartan/metrics/irm-monitor/scripts/update-monitoring.sh $NAMESPACE $MONITORING_NAMESPACE ${{ inputs.network }} $INFURA_SECRET_NAME
+          ./spartan/metrics/irm-monitor/scripts/update-monitoring.sh $NAMESPACE $MONITORING_NAMESPACE ${{ inputs.network }} $ETHEREUM_HOSTS_SECRET_NAME

.github/workflows/deploy-network.yml

@@ -10,11 +10,11 @@ on:
         required: true
         type: string
       semver:
-        description: "Semver version (e.g., 2.3.4)"
-        required: true
+        description: "Semver version (e.g., 2.3.4). Used to construct docker image if aztec_docker_image is not set."
+        required: false
         type: string
-      docker_image_tag:
-        description: "Full docker image tag (optional, defaults to semver)"
+      aztec_docker_image:
+        description: "Full Aztec docker image (e.g., aztecprotocol/aztec:2.3.4). If not set, constructed from semver."
         required: false
         type: string
       ref:
@@ -50,11 +50,11 @@ on:
           - testnet
           - mainnet
       semver:
-        description: "Semver version (e.g., 2.3.4)"
-        required: true
+        description: "Semver version (e.g., 2.3.4). Used to construct docker image if aztec_docker_image is not set."
+        required: false
         type: string
-      docker_image_tag:
-        description: "Full docker image tag (optional, defaults to semver)"
+      aztec_docker_image:
+        description: "Full Aztec docker image (e.g., aztecprotocol/aztec:2.3.4). If not set, constructed from semver."
         required: false
         type: string
       namespace:
@@ -76,7 +76,7 @@ on:
         type: string
 
 concurrency:
-  group: deploy-network-${{ inputs.network }}-${{ inputs.namespace || inputs.network }}-${{ inputs.semver }}-${{ github.ref || github.ref_name }}
+  group: deploy-network-${{ inputs.network }}-${{ inputs.namespace || inputs.network }}-${{ inputs.aztec_docker_image || inputs.semver }}-${{ github.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
@@ -120,16 +120,33 @@ jobs:
             exit 1
           fi
 
-          # Validate semver format
-          if ! echo "${{ inputs.semver }}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-.*)?$'; then
-            echo "Error: Invalid semver format '${{ inputs.semver }}'. Expected format: X.Y.Z or X.Y.Z-suffix"
+          # Require at least one of aztec_docker_image or semver
+          if [[ -z "${{ inputs.aztec_docker_image }}" && -z "${{ inputs.semver }}" ]]; then
+            echo "Error: Either 'aztec_docker_image' or 'semver' must be provided"
             exit 1
           fi
 
-          # Extract major version for v2 check
-          major_version="${{ inputs.semver }}"
-          major_version="${major_version%%.*}"
-          echo "MAJOR_VERSION=$major_version" >> $GITHUB_ENV
+          # Validate semver format if provided
+          if [[ -n "${{ inputs.semver }}" ]]; then
+            if ! echo "${{ inputs.semver }}" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-.*)?$'; then
+              echo "Error: Invalid semver format '${{ inputs.semver }}'. Expected format: X.Y.Z or X.Y.Z-suffix"
+              exit 1
+            fi
+          fi
+
+          # Resolve the docker image
+          if [[ -n "${{ inputs.aztec_docker_image }}" ]]; then
+            AZTEC_DOCKER_IMAGE="${{ inputs.aztec_docker_image }}"
+          else
+            AZTEC_DOCKER_IMAGE="aztecprotocol/aztec:${{ inputs.semver }}"
+          fi
+          echo "AZTEC_DOCKER_IMAGE=$AZTEC_DOCKER_IMAGE" >> $GITHUB_ENV
+
+          # Only use the separate prover-agent image for official semver builds;
+          # for custom images, let the deploy script fall back to AZTEC_DOCKER_IMAGE
+          if [[ -n "${{ inputs.semver }}" ]]; then
+            echo "PROVER_AGENT_DOCKER_IMAGE=aztecprotocol/aztec-prover-agent:${{ inputs.semver }}" >> $GITHUB_ENV
+          fi
 
       - name: Store the GCP key in a file
         env:
@@ -174,12 +191,12 @@ jobs:
           RUN_ID: ${{ github.run_id }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
           GOOGLE_APPLICATION_CREDENTIALS: ${{ env.GOOGLE_APPLICATION_CREDENTIALS }}
-          REF_NAME: "v${{ inputs.semver }}"
+          REF_NAME: ${{ inputs.semver && format('v{0}', inputs.semver) || '' }}
           GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
           NAMESPACE: ${{ inputs.namespace }}
-          AZTEC_DOCKER_IMAGE: "aztecprotocol/aztec:${{ inputs.docker_image_tag || inputs.semver }}"
+          AZTEC_DOCKER_IMAGE: ${{ env.AZTEC_DOCKER_IMAGE }}
           CREATE_ROLLUP_CONTRACTS: ${{ inputs.deploy_contracts == true && 'true' || '' }}
-          PROVER_AGENT_DOCKER_IMAGE: "aztecprotocol/aztec-prover-agent:${{ inputs.docker_image_tag || inputs.semver }}"
+          PROVER_AGENT_DOCKER_IMAGE: ${{ env.PROVER_AGENT_DOCKER_IMAGE || env.AZTEC_DOCKER_IMAGE }}
           VALIDATOR_HA_DOCKER_IMAGE: ${{ inputs.ha_docker_image || '' }}
         run: |
           echo "Deploying network: ${{ inputs.network }}"
@@ -209,7 +226,7 @@ jobs:
             echo "| Item | Value |"
             echo "|------|-------|"
             echo "| Network | \`${{ inputs.network }}\` |"
-            echo "| Semver | \`${{ inputs.semver }}\` |"
+            echo "| Docker Image | \`${{ env.AZTEC_DOCKER_IMAGE }}\` |"
             echo "| Ref | \`${{ steps.checkout-ref.outputs.ref }}\` |"
             if [[ -n "${{ inputs.source_tag }}" ]]; then
               echo "| Source Tag | [\`${{ inputs.source_tag }}\`](https://github.com/${{ github.repository }}/releases/tag/${{ inputs.source_tag }}) |"
@@ -229,7 +246,7 @@ jobs:
 
           CHANNEL="#alerts-${{ inputs.network }}"
           RUN_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
-          TEXT="Deploy Network workflow FAILED for *${{ inputs.network }}* (version ${{ inputs.semver }}): <${RUN_URL}|View Run> (🤖)"
+          TEXT="Deploy Network workflow FAILED for *${{ inputs.network }}* (image ${{ env.AZTEC_DOCKER_IMAGE }}): <${RUN_URL}|View Run> (🤖)"
 
           # Post to Slack and capture timestamp for permalink
           RESP=$(curl -sS -X POST https://slack.com/api/chat.postMessage \
@@ -247,11 +264,11 @@ jobs:
           fi
 
           # Dispatch ClaudeBox to investigate the failure
-          PROMPT="Deployment of ${{ inputs.network }} (version ${{ inputs.semver }}) failed. \
+          PROMPT="Deployment of ${{ inputs.network }} (image ${{ env.AZTEC_DOCKER_IMAGE }}) failed. \
           Follow .claude/claudebox/deploy-investigation.md to investigate. \
           GitHub Actions run: ${RUN_URL}. \
-          Network: ${{ inputs.network }}. Version: ${{ inputs.semver }}. \
-          Docker image: ${{ inputs.docker_image_tag || inputs.semver }}. \
+          Network: ${{ inputs.network }}. \
+          Docker image: ${{ env.AZTEC_DOCKER_IMAGE }}. \
           Git ref: ${{ steps.checkout-ref.outputs.ref }}. \
           Namespace: ${{ inputs.namespace || inputs.network }}. \
           Deploy contracts: ${{ inputs.deploy_contracts }}."

.github/workflows/deploy-next-net.yml

@@ -10,7 +10,7 @@ on:
   workflow_dispatch:
     inputs:
       image_tag:
-        description: 'Docker image tag (e.g., 2.3.4, 3.0.0-nightly.20251004-amd64, or leave empty for latest nightly)'
+        description: "Docker image tag (e.g., 2.3.4, 3.0.0-nightly.20251004-amd64, or leave empty for latest nightly)"
         required: false
         type: string
 
@@ -67,6 +67,6 @@ jobs:
     with:
       network: next-net
       semver: ${{ needs.get-image-tag.outputs.semver }}
-      docker_image_tag: ${{ needs.get-image-tag.outputs.tag }}
+      aztec_docker_image: "aztecprotocol/aztec:${{ needs.get-image-tag.outputs.tag }}"
       ref: ${{ github.ref }}
     secrets: inherit

.github/workflows/merge-train-stale-check.yml

@@ -0,0 +1,22 @@
+name: Merge-Train Stale Check
+
+on:
+  schedule:
+    # Daily at 09:15 UTC — once per day, off the round-minute mark.
+    - cron: "15 9 * * *"
+  workflow_dispatch:
+
+jobs:
+  spartan:
+    name: Check merge-train/spartan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - name: Run stale check
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        run: ./ci3/merge_train_stale_check merge-train/spartan '#team-alpha'

.test_patterns.yml

@@ -294,6 +294,14 @@ tests:
     owners:
       - *palla
 
+  # tx_stats_bench's 10 TPS sub-test occasionally returns valid:false from a single IVC
+  # verification under heavy concurrency (8 parallel verifiers, each spawning a fresh bb subprocess
+  # via the bb.js NativeUnixSocket backend introduced in #21564). The serial sub-tests pass.
+  - regex: "tx_stats_bench"
+    error_regex: "tx_stats_bench\\.test\\.ts:[0-9]+:[0-9]+"
+    owners:
+      - *charlie
+
   - regex: "src/e2e_token_bridge_tutorial.test.ts"
     error_regex: "Error: Unable to find low leaf for block"
     owners:

barretenberg/cpp/src/barretenberg/bbapi/bbapi_chonk.cpp

@@ -189,6 +189,33 @@ ChonkVerify::Response ChonkVerify::execute(const BBApiRequest& /*request*/) &&
     return { .valid = verified };
 }
 
+ChonkVerifyFromFields::Response ChonkVerifyFromFields::execute(const BBApiRequest& /*request*/) &&
+{
+    BB_BENCH_NAME(MSGPACK_SCHEMA_NAME);
+
+    using VerificationKey = Chonk::MegaVerificationKey;
+    validate_vk_size<VerificationKey>(vk);
+
+    auto hiding_kernel_vk = std::make_shared<VerificationKey>(from_buffer<VerificationKey>(vk));
+
+    // Validate total field count: must match num_public_inputs + fixed overhead.
+    const size_t expected_field_count =
+        static_cast<size_t>(hiding_kernel_vk->num_public_inputs) + ChonkProof::PROOF_LENGTH_WITHOUT_PUB_INPUTS;
+    if (proof.size() != expected_field_count) {
+        throw_or_abort("ChonkVerifyFromFields: proof has wrong field count: expected " +
+                       std::to_string(expected_field_count) + ", got " + std::to_string(proof.size()));
+    }
+
+    // Split the flat field array into the structured ChonkProof. Layout knowledge stays here.
+    auto structured = ChonkProof::from_field_elements(proof);
+
+    auto vk_and_hash = std::make_shared<ChonkNativeVerifier::VKAndHash>(hiding_kernel_vk);
+    ChonkNativeVerifier verifier(vk_and_hash);
+    const bool verified = verifier.verify(structured);
+
+    return { .valid = verified };
+}
+
 ChonkBatchVerify::Response ChonkBatchVerify::execute(const BBApiRequest& /*request*/) &&
 {
     BB_BENCH_NAME(MSGPACK_SCHEMA_NAME);

barretenberg/cpp/src/barretenberg/bbapi/bbapi_chonk.hpp

@@ -157,6 +157,36 @@ struct ChonkVerify {
     bool operator==(const ChonkVerify&) const = default;
 };
 
+/**
+ * @struct ChonkVerifyFromFields
+ * @brief Verify a Chonk proof passed as a flat field-element array (with public inputs prepended).
+ *
+ * The split into structured ChonkProof sub-proofs is done server-side via
+ * ChonkProof::from_field_elements, so callers do not need to know the per-component sub-proof
+ * sizes. This is the recommended entry point for TypeScript callers that hold the proof as a
+ * flat Fr[] (e.g. from tx.chonkProof.attachPublicInputs).
+ */
+struct ChonkVerifyFromFields {
+    static constexpr const char MSGPACK_SCHEMA_NAME[] = "ChonkVerifyFromFields";
+
+    struct Response {
+        static constexpr const char MSGPACK_SCHEMA_NAME[] = "ChonkVerifyFromFieldsResponse";
+
+        /** @brief True if the proof is valid */
+        bool valid;
+        SERIALIZATION_FIELDS(valid);
+        bool operator==(const Response&) const = default;
+    };
+
+    /** @brief Flat proof field elements with public inputs prepended */
+    std::vector<bb::fr> proof;
+    /** @brief The verification key */
+    std::vector<uint8_t> vk;
+    Response execute(const BBApiRequest& request = {}) &&;
+    SERIALIZATION_FIELDS(proof, vk);
+    bool operator==(const ChonkVerifyFromFields&) const = default;
+};
+
 /**
  * @struct ChonkComputeVk
  * @brief Compute MegaHonk verification key for a circuit to be accumulated in Chonk

barretenberg/cpp/src/barretenberg/bbapi/bbapi_execute.hpp

@@ -27,6 +27,7 @@ using Command = NamedUnion<AvmProve,
                            ChonkAccumulate,
                            ChonkProve,
                            ChonkVerify,
+                           ChonkVerifyFromFields,
                            ChonkBatchVerify,
                            VkAsFields,
                            MegaVkAsFields,
@@ -90,6 +91,7 @@ using CommandResponse = NamedUnion<ErrorResponse,
                                    ChonkAccumulate::Response,
                                    ChonkProve::Response,
                                    ChonkVerify::Response,
+                                   ChonkVerifyFromFields::Response,
                                    ChonkBatchVerify::Response,
                                    VkAsFields::Response,
                                    MegaVkAsFields::Response,

barretenberg/cpp/src/barretenberg/srs/factories/http_download.hpp

@@ -1,4 +1,5 @@
 #pragma once
+#include "barretenberg/common/log.hpp"
 #include "barretenberg/common/throw_or_abort.hpp"
 #include <cstdint>
 
@@ -24,13 +25,19 @@
 #pragma clang diagnostic pop
 #endif
 
+#include <chrono>
 #include <string>
+#include <thread>
 #include <vector>
 
 namespace bb::srs {
 
 /**
  * @brief Download data from a URL with optional Range header support
+ *
+ * Retries on transient failures (connection errors, 5xx, 429) with exponential
+ * backoff so a momentary CDN/network blip doesn't propagate as a hard failure.
+ *
  * @param url Full URL (e.g., "http://crs.aztec-cdn.foundation/g1.dat")
  * @param start_byte Starting byte for range request (0 for no range)
  * @param end_byte Ending byte for range request (0 for no range)
@@ -70,20 +77,48 @@ inline std::vector<uint8_t> http_download([[maybe_unused]] const std::string& ur
         headers.emplace("Range", "bytes=" + std::to_string(start_byte) + "-" + std::to_string(end_byte));
     }
 
-    // Download
-    auto res = cli.Get(path.c_str(), headers);
+    constexpr int max_attempts = 3;
+    // Bound retry-induced latency: each retry attempt uses tighter timeouts than the first try
+    // so the worst-case extra time (backoffs + retry attempts) stays under ~15s.
+    // Math: backoff 1s + 2s + 2 retries * 5s timeout = 13s.
+    constexpr int retry_timeout_seconds = 5;
 
-    if (!res) {
-        throw_or_abort("HTTP request failed for " + url + ": " + httplib::to_string(res.error()));
-    }
+    std::chrono::milliseconds backoff{ 1000 };
+    std::string last_error;
+    for (int attempt = 1; attempt <= max_attempts; ++attempt) {
+        if (attempt == 2) {
+            cli.set_connection_timeout(retry_timeout_seconds);
+            cli.set_read_timeout(retry_timeout_seconds);
+        }
 
-    if (res->status != 200 && res->status != 206) {
-        throw_or_abort("HTTP request failed for " + url + " with status " + std::to_string(res->status));
-    }
+        auto res = cli.Get(path.c_str(), headers);
+
+        if (res && (res->status == 200 || res->status == 206)) {
+            const std::string& body = res->body;
+            return std::vector<uint8_t>(body.begin(), body.end());
+        }
 
-    // Convert string body to vector<uint8_t>
-    const std::string& body = res->body;
-    return std::vector<uint8_t>(body.begin(), body.end());
+        bool retryable = false;
+        if (!res) {
+            last_error = httplib::to_string(res.error());
+            retryable = true;
+        } else {
+            last_error = "status " + std::to_string(res->status);
+            // Retry on 5xx and 429 (rate limit); other 4xx are client errors and won't change with retry.
+            retryable = res->status >= 500 || res->status == 429;
+        }
+
+        if (!retryable || attempt == max_attempts) {
+            throw_or_abort("HTTP request failed for " + url + ": " + last_error + " (after " + std::to_string(attempt) +
+                           " attempt" + (attempt == 1 ? "" : "s") + ")");
+        }
+
+        vinfo("HTTP download of ", url, " failed (", last_error, "), retrying in ", backoff.count(), "ms");
+        std::this_thread::sleep_for(backoff);
+        backoff *= 2;
+    }
+    // Unreachable: loop above either returns on success or throws on the final attempt.
+    throw_or_abort("HTTP request failed for " + url + ": " + last_error);
 #endif
 }
 } // namespace bb::srs