Revert "Generate append-only verifying-key rotation evidence bundles and per-…"

docs/vk-rotation-checklist.md

@@ -64,20 +64,7 @@ stellar contract invoke --id <CONTRACT_ID> -- set_paused --paused false
 
 ### 7. Record the rotation
 
-Record the rotation through the preflight evidence bundle for the pool and local release bundle:
-
-```bash
-node scripts/zk_release_preflight.mjs \
-  --bundle-path artifacts/zk/v<VERSION>/bundles/release-bundle.json \
-  --target-metadata-json '{"circuit_id":"withdraw","manifest_sha256":"0x...","public_input_arity":6,"schema_version":1}' \
-  --rotation-record-path rotation.json \
-  --rotation-bundle-path artifacts/zk/v<VERSION>/bundles/rotation-evidence/<POOL_ID>/rotation-bundle.json \
-  --rotation-log-path artifacts/zk/v<VERSION>/bundles/rotation-evidence/<POOL_ID>/rotation-log.md
-```
-
-The rotation record should include the operator identity, old and new VK SHA-256 hashes, manifest hash, circuit id, schema version, and rollback context. The log is append-only and must stay tied to one pool.
-
-If you need a manual summary for an incident note, mirror the same fields in `docs/vk-rotation-log.md`:
+Append an entry to `docs/vk-rotation-log.md` (create if absent):
 
 ```
 | Date       | Pool ID | Old VK SHA-256 | New VK SHA-256 | Circuit Version | Operator |

pr_body.md

@@ -1,7 +1,4 @@
 ### Summary
-
-Wave Issue Key: ZK-127
-
 This PR repairs the ZK artifact rebuild pipeline to strictly enforce the versioned layout contract and remove legacy unversioned artifacts. It ensures that compiled circuits, manifests, and commitment vectors all land in the `artifacts/zk/v{version}/` directory structure.
 
 ### Key Changes

scripts/refresh_manifest.mjs

@@ -7,13 +7,12 @@ import { spawnSync } from 'node:child_process';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(__dirname, '..');
 
+// ZK-041: Accept version parameter for versioned artifact layout
 const zkVersion = process.argv[2] || '1';
 const artifactsDir = path.join(repoRoot, 'artifacts', 'zk', `v${zkVersion}`);
 const versionedManifestPath = path.join(artifactsDir, 'manifests', 'manifest.json');
 const legacyManifestPath = path.join(repoRoot, 'artifacts', 'zk', 'manifest.json');
 const releaseBundlePath = path.join(artifactsDir, 'bundles', 'release-bundle.json');
-const benchmarkBaselinesPath = path.join(artifactsDir, 'bundles', 'benchmark-baselines.json');
-const rotationEvidenceDir = path.join(artifactsDir, 'bundles', 'rotation-evidence');
 const PRODUCTION_MERKLE_ROOT_DEPTH = 20;
 const WITHDRAW_PUBLIC_INPUT_SCHEMA = [
   'pool_id',
@@ -100,13 +99,6 @@ function normalizeBackend(backend) {
   };
 }
 
-function readJson(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
-}
-
-function ensureDirectory(filePath) {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-}
 
 function buildExtraFileEntries() {
   return Object.fromEntries(
@@ -128,26 +120,6 @@ function buildExtraFileEntries() {
   );
 }
 
-function loadManifest() {
-  if (fs.existsSync(versionedManifestPath)) {
-    return readJson(versionedManifestPath);
-  }
-
-  if (fs.existsSync(legacyManifestPath)) {
-    return readJson(legacyManifestPath);
-  }
-
-  return {
-    version: Number.parseInt(zkVersion, 10),
-    backend: {
-      name: 'nargo/noir',
-      nargo_version: 'unknown',
-      noirc_version: 'unknown',
-    },
-    circuits: {},
-  };
-}
-
 function buildReleaseBundle(manifest) {
   const withdraw = manifest.circuits.withdraw;
   if (!withdraw || !withdraw.public_input_schema) {
@@ -178,13 +150,6 @@ function buildReleaseBundle(manifest) {
       schema_version: 1,
       verifier_key_storage: 'DataKey::VerifyingKey',
     },
-    operational_artifacts: {
-      benchmark_baselines_path: path.relative(repoRoot, benchmarkBaselinesPath).replace(/\\/g, '/'),
-      rotation_evidence_dir: path.relative(repoRoot, rotationEvidenceDir).replace(/\\/g, '/'),
-    },
-  };
-}
-
 function computeChecksums(raw, artifact) {
   return {
     artifact_sha256: sha256Hex(raw),
@@ -193,50 +158,69 @@ function computeChecksums(raw, artifact) {
   };
 }
 
-function refreshCircuit(manifest, name) {
-  const filePath = path.join(artifactsDir, 'circuits', name, `${name}.json`);
-  const circuitFile = `circuits/${name}/${name}.json`;
+function main() {
+  console.log(`Refreshing ZK manifest for version ${zkVersion}...`);
 
-  if (!fs.existsSync(filePath)) {
-    console.warn(`Warning: Missing artifact for ${name} at ${filePath}`);
-    return;
+  if (!fs.existsSync(path.dirname(versionedManifestPath))) {
+    fs.mkdirSync(path.dirname(versionedManifestPath), { recursive: true });
   }
-
-  const raw = fs.readFileSync(filePath);
-  const artifact = JSON.parse(raw.toString('utf8'));
-  const checksums = computeChecksums(raw, artifact);
-  const circuitEntry = manifest.circuits[name] ?? (manifest.circuits[name] = {});
-
-  circuitEntry.circuit_id = name;
-  circuitEntry.path = circuitFile;
-  circuitEntry.artifact_sha256 = checksums.artifact_sha256;
-  circuitEntry.bytecode_sha256 = checksums.bytecode_sha256;
-  circuitEntry.abi_sha256 = checksums.abi_sha256;
-  circuitEntry.name = artifact.name ?? name;
-  circuitEntry.backend = manifest.backend.name;
-
-  if (name === 'withdraw') {
-    circuitEntry.root_depth = PRODUCTION_MERKLE_ROOT_DEPTH;
-    circuitEntry.public_input_schema = WITHDRAW_PUBLIC_INPUT_SCHEMA;
+  if (!fs.existsSync(path.dirname(releaseBundlePath))) {
+    fs.mkdirSync(path.dirname(releaseBundlePath), { recursive: true });
   }
-}
 
-function main() {
-  console.log(`Refreshing ZK manifest for version ${zkVersion}...`);
-
-  ensureDirectory(versionedManifestPath);
-  ensureDirectory(releaseBundlePath);
-  fs.mkdirSync(rotationEvidenceDir, { recursive: true });
+  let manifest;
+  if (fs.existsSync(versionedManifestPath)) {
+    manifest = JSON.parse(fs.readFileSync(versionedManifestPath, 'utf8'));
+  } else if (fs.existsSync(legacyManifestPath)) {
+    manifest = JSON.parse(fs.readFileSync(legacyManifestPath, 'utf8'));
+  } else {
+    throw new Error('No manifest found to refresh. Run the rebuild pipeline first.');
+    manifest = {
+      version: zkVersion,
+      backend: {
+        name: 'nargo/noir',
+        nargo_version: 'unknown',
+        noirc_version: 'unknown'
+      },
+      circuits: {},
+    };
+  }
 
-  const manifest = loadManifest();
   manifest.version = Number.parseInt(zkVersion, 10);
   manifest.backend = normalizeBackend(manifest.backend);
 
-  for (const name of ['withdraw', 'commitment', 'merkle']) {
-    refreshCircuit(manifest, name);
+  const circuits = ['withdraw', 'commitment', 'merkle'];
+
+  for (const name of circuits) {
+    const filePath = path.join(artifactsDir, 'circuits', name, `${name}.json`);
+    // ZK-041: Look for circuits in versioned directory structure
+    const circuitFile = `circuits/${name}/${name}.json`;
+    const filePath = path.join(artifactsDir, circuitFile);
+
+    if (!fs.existsSync(filePath)) {
+      console.warn(`Warning: Missing artifact for ${name} at ${filePath}`);
+      continue;
+    }
+
+    const raw = fs.readFileSync(filePath);
+    const artifact = JSON.parse(raw.toString('utf8'));
+    const circuitEntry = manifest.circuits[name] ?? (manifest.circuits[name] = {});
+    circuitEntry.circuit_id = name;
+    circuitEntry.path = `circuits/${name}/${name}.json`;
+    circuitEntry.artifact_sha256 = sha256Hex(raw);
+    circuitEntry.bytecode_sha256 = sha256Hex(String(artifact.bytecode ?? ''));
+    circuitEntry.abi_sha256 = sha256Hex(stableStringify(artifact.abi ?? null));
+    circuitEntry.name = artifact.name ?? name;
+    circuitEntry.backend = 'nargo/noir';
+
+    if (name === 'withdraw') {
+      circuitEntry.root_depth = PRODUCTION_MERKLE_ROOT_DEPTH;
+      circuitEntry.public_input_schema = WITHDRAW_PUBLIC_INPUT_SCHEMA;
+    }
   }
 
-  manifest.files = buildExtraFileEntries();
+  const extraFiles = buildExtraFileEntries();
+  manifest.files = extraFiles;
 
   const manifestText = JSON.stringify(manifest, null, 2) + '\n';
   const releaseBundle = buildReleaseBundle(manifest);
@@ -249,6 +233,42 @@ function main() {
   console.log(`Manifest updated at ${versionedManifestPath}`);
   console.log(`Legacy manifest updated at ${legacyManifestPath}`);
   console.log(`Release bundle updated at ${releaseBundlePath}`);
+    const checksums = computeChecksums(raw, artifact);
+
+    if (!manifest.circuits[name]) {
+      manifest.circuits[name] = {
+        circuit_id: name,
+        name: artifact.name ?? name,
+        backend: 'nargo/noir'
+      };
+    }
+
+    // ZK-041/ZK-085: Update path and checksums
+    manifest.circuits[name].path = circuitFile;
+    manifest.circuits[name].artifact_sha256 = checksums.artifact_sha256;
+    manifest.circuits[name].bytecode_sha256 = checksums.bytecode_sha256;
+    manifest.circuits[name].abi_sha256 = checksums.abi_sha256;
+
+    // Production artifact depth and schema (ZK-087)
+    if (name === 'withdraw') {
+      manifest.circuits[name].root_depth = PRODUCTION_MERKLE_ROOT_DEPTH;
+
+      const verifierSchemaPath = path.join(artifactsDir, 'verifier_schema.json');
+      if (fs.existsSync(verifierSchemaPath)) {
+        const schema = JSON.parse(fs.readFileSync(verifierSchemaPath, 'utf8'));
+        manifest.circuits[name].public_input_schema = schema.public_inputs.map(i => i.name);
+      } else {
+        manifest.circuits[name].public_input_schema = WITHDRAW_PUBLIC_INPUT_SCHEMA;
+      }
+    }
+  }
+
+  // Update extra files
+  manifest.files = buildExtraFileEntries();
+
+  // Idempotent write
+  fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+  console.log(`Manifest updated at ${manifestPath}`);
 }
 
 main();