ci: field-separation guard + per-backend standalone builds#469
Open
BornPsych wants to merge 2 commits into
Open
ci: field-separation guard + per-backend standalone builds#469BornPsych wants to merge 2 commits into
BornPsych wants to merge 2 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Add three CI jobs: a field-separation guard (check-field-separation.sh verifies the goldilocks backend never pulls a bn254/256-bit dependency, fail-closed), and standalone build+test jobs for each backend and its fixtures, so a field backend that stops building in isolation is caught.
BornPsych
force-pushed
the
ci/field-separation-guard
branch
from
95271b8 to
631bd1c
Compare
CSP benchmarks
Prover time, peak RSS, peak heap, and verifier time are arithmetic means across the iterations. Peak heap comes from the largest Each metric cell shows the current value followed by the percentage delta against the latest successful Results
|
zkfriendly
reviewed
Jul 8, 2026
The goldilocks_standalone job's fixtures step pulled provekit-fixtures, whose dev-dependencies include both backends, so it compiled the entire bn254 stack — defeating the 'standalone, no --all-features' intent and slowing the job. Move both fixtures test steps into one shared job so the standalone jobs stay pure backend build+test; field separation is still enforced by the cargo-tree guard.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds three CI jobs that enforce two invariants the existing
--all-featuresbuildsilently masks: that the 64-bit Goldilocks backend never links a bn254/256-bit
dependency, and that each backend (plus its welded tooling and fixtures) still builds
and tests in isolation. No production code changes.
Why
#458–#460 made the proving spine field-generic and added a second backend
(
provekit-backend-goldilocks) whose entire point is a pure 64-bit dependency graph.Two things now need machine enforcement:
curve stack, or the Noir/Mavros frontend) would defeat the separation the backend split
was built for, and a monolithic
--all-featuresbuild would never catch it.not actually standalone. These jobs catch a backend or its tooling that stops building on
its own.
What changed
scripts/check-field-separation.sh(new, fail-closed): captures each backend'scargo treeand (1) allowlists the workspace-local crates the Goldilocks graph maycontain (
provekit-common,-prover,-verifier, and the goldilocks backend itself),(2) denylists external bn254/256-bit crate families (
ark-bn254,ark-ec,k256,acir,mavros-*, …) as defense-in-depth, and (3) aborts ifcargo treeerrors orreturns an empty graph — a guard that cannot inspect the graph must not pass.
.github/workflows/ci.yml: three new jobs —field_separationruns the guard script.goldilocks_standalonebuilds + testsprovekit-backend-goldilockswith no--all-features, plus its fixtures.bn254_standalonebuilds + testsprovekit-backend-bn254and its welded tooling(
r1cs-compiler,cli,ffi,gnark,bench,verifier-server,passport-input-gen), plus its fixtures.Verification
./scripts/check-field-separation.sh→OK: field-backend dependency separation holds.(exit 0) against current
main.ci.ymlparses as valid YAML; all three jobs registered.Commits