feat(circuits): support secure BFV committee presets [skip-line-limit]

.github/workflows/ci.yml

@@ -5,6 +5,13 @@ concurrency:
   cancel-in-progress: true
 
 on:
+  workflow_call:
+    inputs:
+      release_candidate:
+        description: Run every CI job for the exact release candidate.
+        required: false
+        type: boolean
+        default: false
   workflow_dispatch:
   pull_request:
     branches:
@@ -54,6 +61,7 @@ jobs:
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        if: ${{ !inputs.release_candidate }}
         id: filter
         with:
           # Required for the '!' exclusions below. The default 'some' quantifier
@@ -124,7 +132,7 @@ jobs:
           INTEGRATION="${{ steps.filter.outputs.integration_tests }}"
           DOCKER="${{ steps.filter.outputs.docker }}"
           CI="${{ steps.filter.outputs.ci }}"
-          FORCE="${{ github.event_name == 'workflow_dispatch' }}"
+          FORCE="${{ github.event_name == 'workflow_dispatch' || inputs.release_candidate }}"
 
           any() { for v in "$@"; do [ "$v" = "true" ] && echo "true" && return; done; echo "false"; }
 
@@ -157,6 +165,9 @@ jobs:
           echo "zk_prover_integration=$(any $FORCE $RUST $CIRCUITS $CI)" >> $GITHUB_OUTPUT
           echo "build_interfold_cli=$(any $FORCE $RUST $CONTRACTS $CIRCUITS $INTEGRATION $TEMPLATES $CRISP $SDK $CI)" >> $GITHUB_OUTPUT
 
+      - name: Check release promotion safeguards
+        run: node --test scripts/release.test.mjs
+
   rust_unit_tests:
     needs: [detect_changes]
     if: needs.detect_changes.outputs.rust_unit_tests == 'true'
@@ -1012,6 +1023,9 @@ jobs:
       - name: Build circuits
         run: pnpm build:circuits
 
+      - name: Test circuit artifact validation
+        run: pnpm test:circuit-tooling
+
       # The generated verifier contracts must match the freshly built verification keys. A drift
       # means the deployed verifier accepts a different circuit from the one in this tree.
       #
@@ -1024,6 +1038,36 @@ jobs:
       - name: Check generated verifiers are in sync
         run: pnpm check:verifiers --no-compile
 
+      - name: Pull the complete circuit matrix
+        run: pnpm store:circuits pull
+
+      - name: Verify release circuit provenance
+        run: pnpm store:circuits verify-release
+
+      - name: Check every generated BFV verifier
+        run: |
+          while read -r preset committee
+          do
+            pnpm build:circuits \
+              --preset "$preset" \
+              --committee "$committee" \
+              --hydrate-bin-only \
+              --no-clean-targets
+            pnpm generate:verifiers \
+              --circuits dkg_aggregator,decryption_aggregator \
+              --preset "$preset" \
+              --committee "$committee" \
+              --check \
+              --no-compile
+          done <<'EOF'
+          insecure-512 micro
+          insecure-512 small
+          secure-8192 minimum
+          secure-8192 micro
+          secure-8192 small
+          insecure-512 minimum
+          EOF
+
       # Asserted before the upload, so a step that consumes or clears a build output fails in the
       # job that did it rather than in the job that needed it. Same list `zk_prover_e2e` checks.
       - name: Verify recursive aggregation artifacts survived