Kahina/snapshot based recovery

.env

@@ -13,13 +13,22 @@ NIGHTFALL_ADDRESS="0x68B1D87F95878fE05B998F19b66F4baba5De1aed" # Contract(0)
 WEBHOOK_URL=
 # Azure Key Vault configuration
 AZURE_KEY_NAME=ethereum-signing-key
-AZURE_VAULT_URL=https://nightfall-kv-1760976507.vault.azure.net/
+AZURE_VAULT_URL=https://nightfall-certificate.vault.azure.net/
 CLIENT_SIGNING_KEY_NAME=ethereum-signing-key
 CLIENT2_SIGNING_KEY_NAME=ethereum-signing-key
 DEPLOYER_SIGNING_KEY_NAME=ethereum-signing-key
 PROPOSER_SIGNING_KEY_NAME=ethereum-signing-key
 PROPOSER_2_SIGNING_KEY_NAME=ethereum-signing-key
+
 # Azure Authentication (KEEP THESE SECRET!)
 AZURE_CLIENT_ID=your-client-id-here
-AZURE_CLIENT_SECRET=your-client-secret-her
+AZURE_CLIENT_SECRET=your-client-secret-here
 AZURE_TENANT_ID=your-tenant-id-here
+NF4_NIGHTFALL_CLIENT2__WALLET_TYPE=local
+NF4_NIGHTFALL_CLIENT__WALLET_TYPE=local
+NF4_NIGHTFALL_CLIENT__X509_SIGNER_TYPE=local
+NF4_NIGHTFALL_CLIENT2__X509_SIGNER_TYPE=local
+CLIENT_X509_SIGNING_KEY_NAME=user-1-cert-key
+CLIENT2_X509_SIGNING_KEY_NAME=your-client2-x509-key-name-here
+NF4_NIGHTFALL_PROPOSER__WALLET_TYPE=local
+NF4_NIGHTFALL_PROPOSER__X509_SIGNER_TYPE=local

.github/workflows/on-pull-request.yml

@@ -12,7 +12,15 @@ jobs:
     name: Check + Lint
     runs-on: self-hosted
     environment: DEV
+    env:
+      NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR: /tmp/proposer_snapshots/build
     steps:
+      - name: Cleanup stale proposer snapshots
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR:-}"
+          rm -rf "$NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR"
       - name: Checkout
         uses: actions/checkout@v4
         # Add Node so npx exists for OZ upgrades validation
@@ -42,33 +50,44 @@ jobs:
         env:
           RUST_BACKTRACE: "1"
           RUST_MIN_STACK: "8388608"
+      - name: Cleanup snapshots after tests
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR:-}"
+          rm -rf "$NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR"
   resync:
     name: Synchronisation Test with Mock Prover
     needs: [build]
     runs-on: self-hosted
     env:
       NF4_MOCK_PROVER: "true"
       NF4_CONTRACTS__DEPLOY_CONTRACTS: "true"
+      NF4_PROPOSER_SNAPSHOT_MOUNT: proposer_snapshots_data
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Clear previous run
-        run: docker compose --profile sync_test down -v
+        run: docker compose --profile sync_test down -v --remove-orphans
       - name: Build
         run: cargo build
       - name: Generate keys
         run: cargo run --release --bin key_generation
       - name: Build Docker Image
         run: docker compose --profile sync_test build
       - name: Run Integration Test
-        run: docker compose --profile sync_test run test
+        run: docker compose --profile sync_test run --rm test
       - name: Print logs
-        run: docker compose --profile sync_test logs
+        if: always()
+        run: docker compose --profile sync_test logs || true
       - name: Remove databases
-        run: docker compose --profile sync_test rm -fvs client client2 proposer db_client db_client2 db_proposer
+        if: always()
+        run: docker compose --profile sync_test rm -fvs client client2 proposer db_client db_client2 db_proposer || true
       - name: Shut Down Containers
+        if: always()
         run: |
-          docker compose --profile sync_test down -v
+          docker compose --profile sync_test down -v --remove-orphans || true
 
   rollup-prover:
     name: Rollup prover integration Test
@@ -79,6 +98,7 @@ jobs:
     env:
       NF4_MOCK_PROVER: "false"
       NF4_CONTRACTS__DEPLOY_CONTRACTS: "true"
+      NF4_PROPOSER_SNAPSHOT_MOUNT: proposer_snapshots_data
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -143,7 +163,7 @@ jobs:
             ls -l "$CACHE_FILE" "$TARGET"
           fi      
       - name: Clear previous run
-        run: docker compose --profile sync_test down -v
+        run: docker compose --profile sync_test down -v --remove-orphans
       - name: Build
         run: cargo build
       - name: Generate keys
@@ -177,19 +197,35 @@ jobs:
       - name: Build Docker Image
         run: docker compose --profile sync_test build
       - name: Run Integration Test
-        run: docker compose --profile development run test
+        run: docker compose --profile sync_test run --rm test
       - name: Print logs
-        run: docker compose --profile development logs
+        if: always()
+        run: docker compose --profile sync_test logs || true
       - name: Shut Down Containers
+        if: always()
         run: |
-          docker compose --profile sync_test down -v
-
+          docker compose --profile sync_test down -v --remove-orphans || true
   forge:
     name: Smart Contract Unit Tests
     needs: [build]
     runs-on: self-hosted
+    env:
+      NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR: /tmp/proposer_snapshots/forge
     steps:
+      - name: Cleanup stale proposer snapshots
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR:-}"
+          rm -rf "$NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR"
       - name: Checkout
         uses: actions/checkout@v4
       - name: Run Forge Tests
         run: forge test
+      - name: Cleanup snapshots after tests
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -n "${NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR:-}"
+          rm -rf "$NF4_NIGHTFALL_PROPOSER__SNAPSHOT_ROOT_DIR"

.gitignore

@@ -19,3 +19,6 @@ soljson*
 configuration/toml
 remappings.txt
 local.env
+/data/proposer_snapshots/
+/nightfall_proposer/data/
+temp/

README.md

@@ -7,3 +7,26 @@ Nightfall_4 is a ZK rollup build around the ZK Privacy of Nightfall. It enables
 
 Please note that this software should be treated as experimental. It should not be used to make significant value transactions.
 
+## Proposer MongoDB
+
+For Docker-based development and sync testing, proposer MongoDB runs as a single-node replica set so the proposer can later use MongoDB transactions safely.
+
+- `db_proposer` uses replica set `nf4-rs-proposer`
+- `db_proposer2` uses replica set `nf4-rs-proposer2`
+- proposer MongoDB URIs should include both `replicaSet=...` and `directConnection=true`
+
+Examples:
+
+```text
+mongodb://nf4_db_proposer:27017/?replicaSet=nf4-rs-proposer&directConnection=true
+mongodb://nf4_db_proposer2:27017/?replicaSet=nf4-rs-proposer2&directConnection=true
+```
+
+Quick verification:
+
+```bash
+docker exec nf4_db_proposer mongosh --quiet --eval 'rs.status()'
+docker exec nf4_db_proposer2 mongosh --quiet --eval 'rs.status()'
+```
+
+This change is proposer-only. `db_client` and `db_client2` remain standalone for now and client-side MongoDB replica set conversion is intentionally deferred to a separate task.

blockchain_assets/contracts/Nightfall.sol

@@ -447,15 +447,15 @@ contract Nightfall is
         uint256 secretHash,
         TokenType token_type
     ) external payable virtual onlyCertified nonReentrant {
-        uint256 nfTokenId = sha256_and_shift(abi.encode(ercAddress, tokenId));
+        uint256 nfTokenId = sha256_and_shift(abi.encode(ercAddress, 0, tokenId));
         tokenIdMapping[nfTokenId] = TokenIdValue(ercAddress, tokenId, token_type);
 
         uint256 nativeSlotId = tokenId;
         uint256 nfSlotId = nfTokenId;
         if (token_type == TokenType.ERC3525) {
             nativeSlotId = IERC3525(ercAddress).slotOf(tokenId);
             nfSlotId = uint256(
-                keccak256(abi.encode(ercAddress, nativeSlotId))
+                keccak256(abi.encode(ercAddress, 1, nativeSlotId))
             ) >> 4;
         }
         slotIdMapping[nfSlotId] = SlotIdValue(ercAddress, nativeSlotId, token_type);

configuration/src/addresses.rs

@@ -505,7 +505,16 @@ mod tests {
     use serial_test::serial;
 
     #[tokio::test]
+    #[serial]
     async fn test_checksum_validation() {
+        let tmp_run_mode = std::env::var("NF4_RUN_MODE").ok();
+        let tmp_client_wallet_type = std::env::var("NF4_NIGHTFALL_CLIENT__WALLET_TYPE").ok();
+        let tmp_proposer_wallet_type = std::env::var("NF4_NIGHTFALL_PROPOSER__WALLET_TYPE").ok();
+
+        std::env::set_var("NF4_RUN_MODE", "development");
+        std::env::set_var("NF4_NIGHTFALL_CLIENT__WALLET_TYPE", "local");
+        std::env::set_var("NF4_NIGHTFALL_PROPOSER__WALLET_TYPE", "local");
+
         let settings = Settings::new().expect("Could not load settings");
         // checksummed address (valid)
         let valid_address = "0x52908400098527886E0F7030069857D2E4169EE7";
@@ -525,6 +534,19 @@ mod tests {
         };
 
         addresses.ensure_nonzero(settings.mock_prover).unwrap();
+
+        match tmp_run_mode {
+            Some(val) => std::env::set_var("NF4_RUN_MODE", val),
+            None => std::env::remove_var("NF4_RUN_MODE"),
+        }
+        match tmp_client_wallet_type {
+            Some(val) => std::env::set_var("NF4_NIGHTFALL_CLIENT__WALLET_TYPE", val),
+            None => std::env::remove_var("NF4_NIGHTFALL_CLIENT__WALLET_TYPE"),
+        }
+        match tmp_proposer_wallet_type {
+            Some(val) => std::env::set_var("NF4_NIGHTFALL_PROPOSER__WALLET_TYPE", val),
+            None => std::env::remove_var("NF4_NIGHTFALL_PROPOSER__WALLET_TYPE"),
+        }
     }
     #[tokio::test]
     #[serial]