🐻‍❄️ Propter polar bear: packed-state prover and deployable node

.dockerignore

@@ -1,33 +1,10 @@
-# Include any files or directories that you don't want to be copied to your
-# container here (e.g., local build artifacts, temporary files, etc.).
-#
-# For more help, visit the .dockerignore file reference guide at
-# https://docs.docker.com/go/build-context-dockerignore/
-
-**/.DS_Store
-**/.classpath
-**/.dockerignore
+.git
 **/.env
-**/.git
-**/.github
-**/.gitignore
-**/.project
-**/.settings
-**/.toolstarget
-**/.vs
-**/.vscode
-**/*.*proj.user
-**/*.dbmdl
-**/*.jfm
-**/charts
-**/docker-compose*
-**/compose.y*ml
-**/Dockerfile*
+**/.env.*
+!**/.env.example
 **/node_modules
-**/npm-debug.log
-**/secrets.dev.yaml
-**/values.dev.yaml
-/bin
-/target
-LICENSE
-README.md
+**/target
+elf
+prover-output*
+*.log
+release/m3tering-prover

.env.example

@@ -1,13 +1,42 @@
-
-PROVER_NODE_PORT=
-STREAMR_CLIENT_PORT=
-
-NETWORK_RPC_URL=https://rpc.mainnet.succinct.xyz
-RPC_URL=https://eth-sepolia.g.alchemy.com/v2/URjQnzNCUHumxPFL8VDoFBmpX4uqL6X8
+# Prefer ./node setup to create a private .env interactively.
+COMPOSE_PROJECT_NAME=m3tering
+POSTGRES_PASSWORD=replace-with-a-random-long-password
+CHAIN_ID=11155111
+RPC_URL=https://your-sepolia-rpc
+ROLLUP_ADDRESS=0x9a9ED9b9A9BEC10d1B5E41b1873E78d19501D5Fa
+HTTP_PORT=19000
 PRIVATE_KEY=
-BLOCK_INTERVAL=
-
-DATA_STRATEGY=delete
+SP1_PRIVATE_KEY=
+STREAM_ID=
+# Optional separate identity when the Streamr subscription needs authentication.
+STREAMR_PRIVATE_KEY=
+PROVING_ENABLED=false
+PROVE_INTERVAL_SECONDS=43200
+MAX_ACTIONS=10000
+MAX_SLOTS=4096
+MAX_BATCH_ACTIONS=1000
+GAS_SCHEDULE=current
+EXECUTION_GAS_BUDGET=15000000
+TOTAL_GAS_BUDGET=15000000
+FIXED_EXECUTION_ALLOWANCE=1500000
+PER_WORD_OVERHEAD_ALLOWANCE=12000
+MAX_FEE_PER_GAS_WEI=30000000000
+MAX_PRIORITY_FEE_PER_GAS_WEI=1000000000
+ETH_RESERVE_WEI=1000000000000000
+MAX_PROVER_CYCLES=100000000
+MAX_PROVER_PGU=100000000
+# auto = live SP1 quote; numeric = PROVE wei per PGU (must match auction tick).
+MAX_PRICE_PER_PGU=auto
+# Optional hard per-proof cap in PROVE wei, excluding retained credit reserve.
+MAX_PROOF_COST_WEI=
+SP1_CREDIT_RESERVE_WEI=0
+PROOF_TIMEOUT_SECONDS=3600
+CONFIRMATIONS=2
+# Standalone CLI only (Compose sets DATABASE_URL and SP1_ELF for you):
+# DATABASE_URL=postgres://user:password@localhost/m3tering
+# ACTIONS_FILE=actions.json
+# OUTPUT_DIR=prover-output-batch-0
+# SP1_ELF=release/program.elf
 
-STREAM_ID=0x567853282663b601bfdb9203819b1fbb3fe18926/m3tering/test
-STREAMR_ENV=live
+# Shared memory ceiling for SP1 native execution; allocated on demand.
+WORKER_SHM_SIZE=1g

.github/workflows/images.yml

@@ -0,0 +1,101 @@
+name: Publish prover images
+on:
+  push:
+    branches: [propter-polar-bear]
+    tags: ['prover-v*']
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: prover-images-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    services:
+      postgres:
+        image: postgres:16-bookworm@sha256:d81f7b51697014367236d07ec58b54153fc28f828b72bf247fe5c7487520bcb0
+        env: {POSTGRES_USER: m3tering, POSTGRES_PASSWORD: validation-only, POSTGRES_DB: m3tering}
+        ports: ['5432:5432']
+        options: --health-cmd "pg_isready -U m3tering" --health-interval 5s --health-retries 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@1.99.1
+      - uses: Swatinem/rust-cache@v2
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24.16.0'
+          cache: npm
+          cache-dependency-path: streamr-client/package-lock.json
+      - run: sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev protobuf-compiler
+      - run: cargo fmt --all -- --check
+      - run: cargo test --locked -p m3tering-protocol -p m3tering-prover
+      - run: npm ci --prefix streamr-client
+      - run: npm test --prefix streamr-client
+        env:
+          TEST_DATABASE_URL: postgres://m3tering:validation-only@localhost:5432/m3tering
+      - run: sha256sum -c release/program.sha256
+  images:
+    needs: tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: api
+            suffix: '-api'
+          - target: worker
+            suffix: ''
+    steps:
+      - uses: actions/checkout@v6
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v5
+        id: meta
+        with:
+          images: ghcr.io/m3tering/prover
+          tags: |
+            type=ref,event=branch,suffix=${{ matrix.suffix }}
+            type=ref,event=tag,suffix=${{ matrix.suffix }}
+            type=sha,format=long,suffix=${{ matrix.suffix }}
+          flavor: latest=false
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          target: ${{ matrix.target }}
+          platforms: linux/amd64
+          load: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=${{ matrix.target }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.target }}
+      - name: Smoke-test the built image before publication
+        env:
+          IMAGE_TAGS: ${{ steps.meta.outputs.tags }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          image=$(printf '%s\n' "$IMAGE_TAGS" | head -1)
+          if [ "$TARGET" = worker ]; then
+            docker run --rm --memory=4g -e WITNESS_FILE=/opt/m3tering/fixtures/input.json "$image" /usr/local/bin/m3tering-prover execute-fixture | tee execution.log
+            key=$(jq -r .program_key release/program-build.json)
+            grep -F "Program verification key: $key" execution.log
+          else
+            docker run --rm "$image" npm test
+          fi
+      - name: Publish tested images
+        env:
+          IMAGE_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          while IFS= read -r image; do
+            docker push "$image"
+            printf '%s\n' "$image" >> "$GITHUB_STEP_SUMMARY"
+          done <<< "$IMAGE_TAGS"