mirror-pool: Rust-only ZK behavioral-privacy protocol — circuit, native program, verifiable ceremony, compliance, live devnet

.github/workflows/ci.yml

@@ -0,0 +1,91 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+
+jobs:
+  # Fast, host-only gates: formatting, lints, and the full test suite
+  # (circuit unit tests, program logic tests, the Poseidon equality test, and
+  # the compute-unit benchmark). These run on the stable toolchain pinned by
+  # rust-toolchain.toml.
+  check:
+    name: fmt + clippy + test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache cargo registry and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-
+
+      - name: rustfmt
+        run: cargo fmt --all -- --check
+
+      # Lint everything, including the `bench`-gated code paths.
+      - name: clippy
+        run: cargo clippy --workspace --all-targets --all-features
+
+      # Default features = the DEPLOYED configuration (no `bench`). This is the
+      # run that exercises `verify_membership_absent_from_default_build`.
+      - name: test (default features = deployed config)
+        run: cargo test --workspace
+
+  # The on-chain program must compile to SBF bytecode. This gate catches
+  # BPF-only breakage (host-forbidden syscalls, oversized stack frames) that
+  # the host build above cannot.
+  build-sbf:
+    name: build-sbf (program)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache cargo registry and target
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-sbf-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-sbf-
+
+      - name: Install Solana (Agave) toolchain
+        run: |
+          sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)"
+          echo "$HOME/.local/share/solana/install/active_release/bin" >> "$GITHUB_PATH"
+
+      # The DEPLOYED artifact: default features, so the benchmark-only
+      # VerifyMembership instruction is NOT in the bytecode.
+      # --arch v3 matches the sBPF version enabled on current Agave clusters
+      # (the default v0 is not yet feature-gated on-chain).
+      - name: cargo build-sbf (deployed artifact)
+        run: cargo build-sbf --manifest-path program/Cargo.toml --arch v3
+
+      - name: full flow (prove → execute_action → all negatives/invariants)
+        run: cargo run --release --manifest-path bench/Cargo.toml --bin flow
+
+      - name: compliance (screening hook + selective disclosure)
+        run: cargo run --release --manifest-path bench/Cargo.toml --bin compliance
+
+      - name: privacy trace red-team (fee payer, anonymity set, no linkage)
+        run: cargo run --release --manifest-path bench/Cargo.toml --bin trace
+
+      # The CU benchmark needs the bench-featured build (VerifyMembership). This
+      # rebuilds the .so with the feature; it does NOT ship.
+      - name: cargo build-sbf (bench feature) + CU benchmark < 200k CU
+        run: |
+          cargo build-sbf --manifest-path program/Cargo.toml --features bench --arch v3
+          cargo test -p mirror-pool-program --features bench --test gen_fixture -- --ignored --nocapture
+          cargo run --release --manifest-path bench/Cargo.toml --bin cu-bench

.gitignore

@@ -0,0 +1,17 @@
+/target
+/bench/target
+**/*.rs.bk
+Cargo.lock.orig
+.DS_Store
+# Local validator ledger / keys produced by demo.sh
+/test-ledger
+*.so
+!program/**/*.so
+# Generated proving/verifying keys (regenerated by the circuit trusted setup)
+/artifacts/*.bin
+
+# Never commit keypairs or local ledgers (devnet/test keys live outside the repo)
+*.json
+!package.json
+/keys/
+/test-ledger/