WHIR no-epoch (prove-and-retire) prover: block 25368371 — work in progress

.github/workflows/benchmark-pr.yml

@@ -64,14 +64,15 @@ env:
   # from one real one. Only the headline screen was dropped.
   #
   # Cycle counts below are for the ELF THIS JOB BUILDS (see "Build ethrex guest ELF"),
-  # as of main @ 9ccdaf2 with clang 21. They move with guest optimisation (#861 gave the
-  # guest thin LTO) and ~2% with the clang major on PATH, so a count quoted against a
+  # as of the guest built with fat LTO and its own memcpy. They move with guest
+  # optimisation (#861 gave the guest thin LTO, fat LTO and the runtime memcpy took
+  # another 20 %) and ~2% with the clang major on PATH, so a count quoted against a
   # different ELF reads as a regression — always pin the ELF when repeating one.
   ELF: executor/program_artifacts/rust/ethrex.elf
   # The workload: a real Ethereum block. WHICH block lives in
   # the Makefile and nowhere else — nothing in this file names one, so a repoint
   # moves this job without editing it. At the current default and pinned ethrex rev that
-  # is 30,498,818 cycles, 10,659 keccak calls and 116 ecsm calls — several times the work
+  # is 23,935,913 cycles, 10,659 keccak calls and 116 ecsm calls — several times the work
   # of the synthetic block, at a very different keccak:ecrecover mix. That is the whole
   # point: a prover change can move the synthetic number and the real one in opposite
   # directions. All three figures move with the ethrex rev, so re-measure on a bump

.github/workflows/pr_main.yaml

@@ -96,14 +96,20 @@ jobs:
         run: |
           make compile-programs-asm
 
+      # The key hashes every source a Rust guest build reads: the guest crates, the guest
+      # runtime (syscalls), the crypto crates guests depend on by path (ethrex-crypto for the
+      # ethrex guest; crypto and math for keccak_transcript_pattern), the target spec and the
+      # Makefile's recipe. An exact hit skips the compile step below, so a change confined to
+      # one of them that the key missed would run every test on a stale ELF. The same key
+      # appears in each job that restores these ELFs.
       - name: Cache compiled Rust ELF artifacts and build cache
         id: cache-rust-elfs
         uses: actions/cache@v4
         with:
           path: |
             executor/program_artifacts/rust
             executor/shared_target
-          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'Makefile') }}
+          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'crypto/ethrex-crypto/src/**', 'crypto/ethrex-crypto/Cargo.toml', 'crypto/crypto/src/**', 'crypto/crypto/Cargo.toml', 'crypto/math/src/**', 'crypto/math/Cargo.toml', 'Makefile') }}
           restore-keys: |
             rust-elf-artifacts-
 
@@ -197,26 +203,72 @@ jobs:
         run: make test-ethrex-crypto
 
   # "Test" is a required check — keep this name to avoid branch protection changes.
-  # This gate job passes only when CLI, executor, disk-spill, and prover tests succeed.
+  # This gate job passes only when CLI, executor, and prover tests succeed.
+  host-kat:
+    # The device kernels' known-answer gates. `make test-*-host-kat` compiles the
+    # REAL `.cu` sources as host C++ through
+    # `crypto/math-cuda/tests/host_kat/cuda_host_shim.h` and runs them against
+    # external vectors (the official BLAKE3 vectors, miden-crypto's RPO vectors)
+    # and the committed oracle tables — g++ only, no CUDA, no cargo, seconds. It
+    # is the only per-PR check on the kernel arithmetic: the GPU parity suites
+    # (gpu-tests.yml) run on merge_group alone, and until this job existed the
+    # host-KAT targets lived in no workflow at all. Arithmetic only — nvcc
+    # acceptance and everything about execution stay with the GPU tests.
+    name: Host KAT (kernel pins)
+    runs-on: ubuntu-latest
+    if: github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+
+      - name: BLAKE3 host-KAT (7-round and 6-round arms)
+        run: make test-blake3-host-kat
+
+      - name: RPX host-KAT (permutation, leaf sponge, parent, leaf and tree kernels)
+        run: make test-rpx-host-kat
+
+      - name: Column-major LDE engine host-KAT (NTT passes, coset LDE)
+        run: make test-ntt-cm-host-kat
+
+      - name: WHIR host-KAT (fused round fold, lean first rounds)
+        run: make test-whir-host-kat
+
+      - name: GKR host-KAT (layer rounds over an input layer kept without its padding)
+        run: make test-gkr-host-kat
+
+      - name: Commit-time answers host-KAT (columns' values at one point, one pass)
+        run: make test-eq-dot-host-kat
+
+      - name: Round-slot host-KAT (a round's sums reduced by its last block)
+        run: make test-round-slot-host-kat
+
+      # Second source for the TABLES the BLAKE3 host-KAT trusts: upstream
+      # BLAKE3's portable C with its round loop parameterised, against the
+      # committed 6-round vectors and the Python oracle. A ~1 s C compile plus a
+      # few seconds of Python (cc + python3, both on the runner); it too had no
+      # workflow before this job.
+      - name: BLAKE3 second-source check of the 6-round tables
+        run: make test-blake3-second-source
+
   test:
     name: Test
     if: always()
-    needs: [test-executor, test-cli, test-prover, test-disk-spill, test-stark-cuda-lib]
+    needs: [test-executor, test-cli, test-prover, test-stark-cuda-lib, host-kat]
     runs-on: ubuntu-latest
     steps:
       - name: Check results
         run: |
           executor="${{ needs.test-executor.result }}"
           cli="${{ needs.test-cli.result }}"
           prover="${{ needs.test-prover.result }}"
-          disk_spill="${{ needs.test-disk-spill.result }}"
           stark_cuda_lib="${{ needs.test-stark-cuda-lib.result }}"
+          host_kat="${{ needs.host-kat.result }}"
 
           echo "test-executor: $executor"
           echo "test-cli: $cli"
           echo "test-prover: $prover"
-          echo "test-disk-spill: $disk_spill"
           echo "test-stark-cuda-lib: $stark_cuda_lib"
+          echo "host-kat: $host_kat"
 
           # Allow "success" or "skipped" (skipped on merge queue pushes)
           if [[ "$executor" != "success" && "$executor" != "skipped" ]]; then
@@ -228,72 +280,13 @@ jobs:
           if [[ "$prover" != "success" && "$prover" != "skipped" ]]; then
             exit 1
           fi
-          if [[ "$disk_spill" != "success" && "$disk_spill" != "skipped" ]]; then
+          if [[ "$stark_cuda_lib" != "success" && "$stark_cuda_lib" != "skipped" ]]; then
             exit 1
           fi
-          if [[ "$stark_cuda_lib" != "success" && "$stark_cuda_lib" != "skipped" ]]; then
+          if [[ "$host_kat" != "success" && "$host_kat" != "skipped" ]]; then
             exit 1
           fi
 
-  test-disk-spill:
-    name: Disk-spill tests
-    runs-on: ubuntu-latest
-    if: github.event_name != 'push' || github.actor != 'github-merge-queue[bot]'
-    steps:
-      - name: Checkout sources
-        uses: actions/checkout@v4
-
-      - name: Setup Rust Environment
-        uses: ./.github/actions/setup-rust
-
-      - name: Cache cargo build artifacts
-        uses: Swatinem/rust-cache@v2
-        with:
-          shared-key: "lambda-vm-disk-spill"
-          cache-all-crates: "true"
-
-      - name: Cache compiled ASM ELF artifacts
-        id: cache-asm-elfs
-        uses: actions/cache@v4
-        with:
-          path: executor/program_artifacts/asm
-          key: asm-elf-artifacts-${{ hashFiles('executor/programs/asm/**') }}
-
-      - name: Install clang and lld
-        if: steps.cache-asm-elfs.outputs.cache-hit != 'true'
-        run: sudo apt-get update && sudo apt-get install -y clang lld
-
-      - name: Compile ASM programs to ELF
-        if: steps.cache-asm-elfs.outputs.cache-hit != 'true'
-        run: |
-          make compile-programs-asm
-
-      - name: Cache compiled Rust ELF artifacts and build cache
-        id: cache-rust-elfs
-        uses: actions/cache@v4
-        with:
-          path: |
-            executor/program_artifacts/rust
-            executor/shared_target
-          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'Makefile') }}
-          restore-keys: |
-            rust-elf-artifacts-
-
-      - name: Compile Rust programs to ELF
-        if: steps.cache-rust-elfs.outputs.cache-hit != 'true'
-        run: |
-          make compile-programs-rust
-
-      - name: Run stark disk-spill tests
-        run: |
-          cargo test --release -p stark --features disk-spill disk_spill
-
-      - name: Run prover disk-spill tests
-        env:
-          FORCE_DISK_SPILL: "1"
-        run: |
-          cargo test --release -p lambda-vm-prover --features disk-spill -- disk_spill count_table_lengths
-
   test-stark-cuda-lib:
     name: Stark cuda-feature lib tests
     runs-on: ubuntu-latest
@@ -349,6 +342,11 @@ jobs:
             -p lambda-vm-prover -p stark -p crypto -p ecsm \
             --archive-file prover-tests.tar.zst
 
+      # The prover shards skip the tests listed in .config/ci-slow-tests.txt (they run in full on the project's own
+      # machines). Fails unless the filter skips exactly the listed tests and every test binary keeps a test.
+      - name: Check the slow-test list against the archive
+        run: python3 scripts/ci_slow_tests.py check prover-tests.tar.zst
+
       - name: Upload test archive
         uses: actions/upload-artifact@v4
         with:
@@ -391,7 +389,7 @@ jobs:
           path: |
             executor/program_artifacts/rust
             executor/shared_target
-          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'Makefile') }}
+          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'crypto/ethrex-crypto/src/**', 'crypto/ethrex-crypto/Cargo.toml', 'crypto/crypto/src/**', 'crypto/crypto/Cargo.toml', 'crypto/math/src/**', 'crypto/math/Cargo.toml', 'Makefile') }}
           restore-keys: |
             rust-elf-artifacts-
 
@@ -440,13 +438,16 @@ jobs:
         # the concurrent path or VramGate's blocking path on a PR. The other
         # three shards keep the default-k coverage. An empty value on those
         # fails to parse and falls back to the default, so this is inert there.
+        # The tests listed in .config/ci-slow-tests.txt are skipped here: each took more than 45 s on a runner, and
+        # the project's own machines run them (scripts/ci_slow_tests.py; the build job checks the list).
         env:
           TABLE_PARALLELISM: ${{ matrix.partition == 1 && '6' || '' }}
         run: |
           cargo nextest run \
             --archive-file prover-tests.tar.zst \
             --partition hash:${{ matrix.partition }}/4 \
-            --test-threads=1
+            --test-threads=1 \
+            -E "$(python3 scripts/ci_slow_tests.py expr)"
 
   test-prover-comprehensive:
     name: Prover comprehensive tests
@@ -480,7 +481,7 @@ jobs:
           path: |
             executor/program_artifacts/rust
             executor/shared_target
-          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'Makefile') }}
+          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'crypto/ethrex-crypto/src/**', 'crypto/ethrex-crypto/Cargo.toml', 'crypto/crypto/src/**', 'crypto/crypto/Cargo.toml', 'crypto/math/src/**', 'crypto/math/Cargo.toml', 'Makefile') }}
           restore-keys: |
             rust-elf-artifacts-
 
@@ -564,7 +565,7 @@ jobs:
           path: |
             executor/program_artifacts/rust
             executor/shared_target
-          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'Makefile') }}
+          key: rust-elf-artifacts-${{ hashFiles('executor/programs/rust/**', 'executor/programs/riscv64im-lambda-vm-elf.json', 'syscalls/**', 'crypto/ethrex-crypto/src/**', 'crypto/ethrex-crypto/Cargo.toml', 'crypto/crypto/src/**', 'crypto/crypto/Cargo.toml', 'crypto/math/src/**', 'crypto/math/Cargo.toml', 'Makefile') }}
           restore-keys: |
             rust-elf-artifacts-