AztecProtocol · ludamad · Mar 20, 2026 · Mar 13, 2026 · Mar 16, 2026 · Mar 16, 2026
diff --git a/.claude/agents/network-logs.md b/.claude/agents/network-logs.md
@@ -91,7 +91,8 @@ Pods follow the pattern `{namespace}-{component}-{index}`:
 
 ## Deployment-Specific Notes
 
-- **next-net** redeploys every morning at ~4am UTC. Always use timestamp range filters (not `--freshness`) when querying next-net for a specific date, and expect logs to only cover a single instance of the network.
+- **next-net** redeploys every morning at ~4am UTC. Always use timestamp range filters (not `--freshness`) when querying next-net for a specific date, and expect logs to only cover a single instance of the network. Because next-net resets daily, its block height should start near 0 after ~4am UTC. If you are running a morning healthcheck and the block height is unexpectedly large (e.g., hundreds or thousands), flag this as an error — it likely means the nightly redeploy failed and the network is running a stale instance.
+- **mainnet** does not run sequencer validators. Instead, it runs infrastructure in **fisherman mode**: nodes simulate building a block for every slot but never actually submit the L1 transaction. This means you will see "built block" or similar messages but no "Published checkpoint" or L1 submission logs. Errors with hash `0xf3e591ac` are a known artifact of fisherman mode and are safe to ignore.
 
 ## Filter Building
 
@@ -203,6 +204,7 @@ gcloud logging read '
   NOT jsonPayload.message=~"No active peers"
   NOT jsonPayload.message=~"Not enough txs"
   NOT jsonPayload.message=~"StateView contract not found"
+  NOT jsonPayload.message=~"[Bb]lob"
 ' --limit=100 --format='table[no-heading](timestamp.date("%H:%M:%S"), resource.labels.pod_name, jsonPayload.severity, jsonPayload.module, jsonPayload.message.slice(0,180))' --freshness=<freshness> --project=<project>
 ```
 
@@ -291,6 +293,20 @@ Then synthesize into a single status report covering:
 
 This is the most common query pattern — prefer this composite approach over individual queries when the user asks for general status.
 
+### 11. Multi-Network Healthcheck
+
+When the user asks for a healthcheck across multiple networks (e.g., "how are all the networks doing?"), query each network in parallel and present results as a **summary table**:
+
+```
+| Network   | Status | Block Height | Last Block | Proving | Notes |
+|-----------|--------|--------------|------------|---------|-------|
+| testnet   | ✅ OK  | 1234         | 2m ago     | Epoch 5 | —     |
+| next-net  | ✅ OK  | 45           | 1m ago     | Epoch 1 | —     |
+| mainnet   | ✅ OK  | 890          | 3m ago     | N/A     | Fisherman mode |
+```
+
+Use ✅ for healthy, ⚠️ for degraded, ❌ for down/erroring. Follow the table with brief per-network details only if there are issues worth calling out. Remember deployment-specific notes: next-net resets daily (check block height is reasonable for time of day), mainnet runs in fisherman mode (no L1 submissions, `0xf3e591ac` errors are expected).
+
 ## Known Noise Patterns
 
 These patterns appear frequently and are usually harmless — exclude or downplay them:
@@ -302,6 +318,8 @@ These patterns appear frequently and are usually harmless — exclude or downpla
 - `No active peers to send requests to` — P2P reqresp on isolated nodes (e.g., blob-sink)
 - `Not enough txs to build block` — Normal when transaction volume is low
 - `StateView contract not found` — Price oracle warning; Uniswap V4 StateView only exists on mainnet, so all other networks emit this. Safe to ignore unless namespace is `mainnet`
+- **Blob-related errors** — Errors related to blobs (e.g., blob fetching failures, blob unavailability) are generally expected and safe to ignore. Since the Fusaka hard fork, regular consensus nodes can no longer serve blob data, and we run a couple of these nodes. Exclude or downplay blob errors unless the user is specifically investigating blob issues.
+- `0xf3e591ac` — Fisherman mode error on mainnet. Safe to ignore (see Deployment-Specific Notes).
 
 ## Reference Tool
 

diff --git a/.claude/settings.local.json b/.claude/settings.local.json
@@ -0,0 +1,11 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(gh pr:*)",
+      "Bash(curl -s -X POST https://ethereum-sepolia-rpc.publicnode.com -H \"Content-Type: application/json\" -d '{\"\"\"\"jsonrpc\"\"\"\":\"\"\"\"2.0\"\"\"\",\"\"\"\"method\"\"\"\":\"\"\"\"eth_getBlockByNumber\"\"\"\",\"\"\"\"params\"\"\"\":[\"\"\"\"finalized\"\"\"\",false],\"\"\"\"id\"\"\"\":1}')",
+      "Bash(curl -s -X POST https://ethereum-rpc.publicnode.com -H \"Content-Type: application/json\" -d '{\"\"\"\"jsonrpc\"\"\"\":\"\"\"\"2.0\"\"\"\",\"\"\"\"method\"\"\"\":\"\"\"\"eth_getBlockByNumber\"\"\"\",\"\"\"\"params\"\"\"\":[\"\"\"\"finalized\"\"\"\",false],\"\"\"\"id\"\"\"\":1}')",
+      "Bash(curl -s -X POST https://ethereum-sepolia-rpc.publicnode.com -H \"Content-Type: application/json\" -d '{\"\"\"\"jsonrpc\"\"\"\":\"\"\"\"2.0\"\"\"\",\"\"\"\"method\"\"\"\":\"\"\"\"eth_getBlockByNumber\"\"\"\",\"\"\"\"params\"\"\"\":[\"\"\"\"latest\"\"\"\",false],\"\"\"\"id\"\"\"\":1}')",
+      "Bash(curl -s -X POST https://ethereum-rpc.publicnode.com -H \"Content-Type: application/json\" -d '{\"\"\"\"jsonrpc\"\"\"\":\"\"\"\"2.0\"\"\"\",\"\"\"\"method\"\"\"\":\"\"\"\"eth_getBlockByNumber\"\"\"\",\"\"\"\"params\"\"\"\":[\"\"\"\"latest\"\"\"\",false],\"\"\"\"id\"\"\"\":1}')"
+    ]
+  }
+}
diff --git a/.github-new/workflows/copy-bb-release-artifacts.yml b/.github-new/workflows/copy-bb-release-artifacts.yml
@@ -0,0 +1,71 @@
+name: Copy BB Release Artifacts
+# When a release is published on aztec-packages, copy barretenberg artifacts
+# from AztecProtocol/barretenberg to the aztec-packages release.
+# Historical bbup versions (~before April 2026) benefit from having these artifacts here.
+# Newer bbup versions are able to download experimental nightlies from barretenberg repo.
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to copy artifacts for (e.g. v0.82.0)"
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  copy-artifacts:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine tag
+        id: tag
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=${{ github.event.release.tag_name }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Download artifacts from AztecProtocol/barretenberg
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+        run: |
+          tag="${{ steps.tag.outputs.tag }}"
+          echo "Downloading artifacts for tag: $tag"
+          mkdir -p /tmp/bb-artifacts
+
+          # Download all release assets from the barretenberg repo
+          if ! gh release download "$tag" \
+            --repo AztecProtocol/barretenberg \
+            --dir /tmp/bb-artifacts; then
+            echo "::error::No release found for $tag in AztecProtocol/barretenberg"
+            exit 1
+          fi
+
+          echo "Downloaded artifacts:"
+          ls -la /tmp/bb-artifacts/
+
+      - name: Upload artifacts to aztec-packages release
+        env:
+          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+        run: |
+          tag="${{ steps.tag.outputs.tag }}"
+
+          # Ensure the release exists on aztec-packages (it should if triggered by release event,
+          # but for workflow_dispatch we may need to verify)
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            if ! gh release view "$tag" --repo AztecProtocol/aztec-packages &>/dev/null; then
+              echo "::error::No release found for $tag in AztecProtocol/aztec-packages. Create the release first, then re-run."
+              exit 1
+            fi
+          fi
+
+          echo "Uploading artifacts to aztec-packages release $tag"
+          gh release upload "$tag" \
+            --repo AztecProtocol/aztec-packages \
+            --clobber \
+            /tmp/bb-artifacts/*
+
+          echo "Done! Artifacts copied to https://github.com/AztecProtocol/aztec-packages/releases/tag/$tag"
@@ -41,7 +41,7 @@ jobs:
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           HAS_CI_LABEL: ${{ contains(github.event.pull_request.labels.*.name, 'ci-external') || github.event.label.name == 'ci-external-once' }}
-          GH_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -o pipefail
           git fetch origin "$PR_BASE_REF" --depth=1 &>/dev/null
@@ -68,7 +68,7 @@ jobs:
           MERGE_GROUP_BASE_REF: ${{ github.event.merge_group.base_ref }}
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
-          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           PR_LABELS_JSON: ${{ toJson(github.event.pull_request.labels.*.name) }}
         run: |
           # Parse labels from JSON env var to avoid shell injection via label names
@@ -85,7 +85,7 @@ jobs:
           # creds for being able to upload to cache.
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           BUILD_INSTANCE_SSH_KEY: ${{ secrets.BUILD_INSTANCE_SSH_KEY }}
           # DO NOT allow build instance key access to external jobs.
           CI_USE_BUILD_INSTANCE_KEY: "0"
@@ -104,7 +104,7 @@ jobs:
           # For updating success cache.
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          GITHUB_TOKEN: ${{ secrets.AZTEC_BOT_GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
           PR_BASE_REF: ${{ github.event.pull_request.base.ref }}

@@ -173,10 +173,9 @@ jobs:
       fail-fast: false
       matrix:
         test_set: ["1", "2"]
-    # We either run after a release (tag starting with v), or when the ci-network-scenario label is present in a PR.
-    # We exclude ci-release-pr test tags (v0.0.1-commit.*) which are only for testing the release process.
+    # We run on nightly tags only, or when the ci-network-scenario label is present in a PR.
     needs: ci
-    if: github.event.pull_request.head.repo.fork != true && github.event.pull_request.draft == false && ((startsWith(github.ref, 'refs/tags/v') && !contains(github.ref_name, '-commit.')) || contains(github.event.pull_request.labels.*.name, 'ci-network-scenario'))
+    if: github.event.pull_request.head.repo.fork != true && github.event.pull_request.draft == false && ((startsWith(github.ref, 'refs/tags/v') && contains(github.ref_name, '-nightly.')) || contains(github.event.pull_request.labels.*.name, 'ci-network-scenario'))
     steps:
       - name: Remove label (one-time use)
         if: github.event.pull_request && contains(github.event.pull_request.labels.*.name, 'ci-network-scenario')

@@ -228,7 +228,7 @@ jobs:
 
   update-irm:
     needs: deploy-network
-    if: contains(inputs.network, 'testnet') && !contains(inputs.semver, '-')
+    if: contains(inputs.network, 'testnet')
     uses: ./.github/workflows/deploy-irm.yml
     secrets: inherit
     with:

diff --git a/barretenberg/bbup/bbup b/barretenberg/bbup/bbup
@@ -114,15 +114,19 @@ install_bb() {
     local temp_dir=$(mktemp -d)
     local temp_tar="${temp_dir}/temp.tar.gz"
 
-    # Download and extract
-    local release_url_base="https://github.com/AztecProtocol/aztec-packages/releases/download"
+    # Download and extract — try AztecProtocol/barretenberg first, fall back to aztec-packages
     local release_tag="v${version}"
     if ! version_gte "$version" "0.77.0"; then
         release_tag="aztec-packages-v${version}"
     fi
-    local binary_url="${release_url_base}/${release_tag}/barretenberg-${architecture}-${platform}.tar.gz"
+    local artifact="barretenberg-${architecture}-${platform}.tar.gz"
+    local primary_url="https://github.com/AztecProtocol/barretenberg/releases/download/${release_tag}/${artifact}"
+    local fallback_url="https://github.com/AztecProtocol/aztec-packages/releases/download/${release_tag}/${artifact}"
 
-    curl -L --fail "$binary_url" -o "$temp_tar"
+    if ! curl -sL --fail "$primary_url" -o "$temp_tar"; then
+        printf "${BLUE}Trying fallback URL...${NC}\n"
+        curl -L --fail "$fallback_url" -o "$temp_tar"
+    fi
     mkdir -p "$BB_PATH"
     tar xzf "$temp_tar" -C "$BB_PATH"
     rm -rf "$temp_dir"

diff --git a/barretenberg/cpp/bootstrap.sh b/barretenberg/cpp/bootstrap.sh
@@ -323,10 +323,10 @@ function bench {
   bench_cmds | STRICT_SCHEDULING=1 parallelize
 }
 
-# Upload assets to release.
+# Upload assets to release in AztecProtocol/barretenberg.
 function release {
   echo_header "bb cpp release"
-  do_or_dryrun gh release upload $REF_NAME build-release/* --clobber
+  do_or_dryrun gh release upload $REF_NAME build-release/* --repo AztecProtocol/barretenberg --clobber
 }
 
 function bench_ivc {

diff --git a/barretenberg/rust/barretenberg-rs/README.md b/barretenberg/rust/barretenberg-rs/README.md
@@ -25,7 +25,7 @@ barretenberg-rs = "0.1"
 
 ### PipeBackend (default)
 
-Requires the `bb` binary to be available. Download from [Barretenberg releases](https://github.com/AztecProtocol/aztec-packages/releases).
+Requires the `bb` binary to be available. Download from [Barretenberg releases](https://github.com/AztecProtocol/barretenberg/releases).
 
 ```rust
 use barretenberg_rs::{BarretenbergApi, backends::PipeBackend};

diff --git a/barretenberg/rust/barretenberg-rs/build.rs b/barretenberg/rust/barretenberg-rs/build.rs
@@ -85,7 +85,7 @@ fn download_lib(out_dir: &PathBuf) {
     }
 
     let url = format!(
-        "https://github.com/AztecProtocol/aztec-packages/releases/download/v{}/barretenberg-static-{}.tar.gz",
+        "https://github.com/AztecProtocol/barretenberg/releases/download/v{}/barretenberg-static-{}.tar.gz",
         version, arch
     );
 

diff --git a/barretenberg/rust/bootstrap.sh b/barretenberg/rust/bootstrap.sh
@@ -68,7 +68,7 @@ function release {
 
   # Publish to crates.io (--allow-dirty because version was just set and generated files are gitignored)
   local extra_flags=""
-  if ! gh release view "v$version" --repo AztecProtocol/aztec-packages &>/dev/null; then
+  if ! gh release view "v$version" --repo AztecProtocol/barretenberg &>/dev/null; then
     # No matching GitHub release yet — skip verification build (which would try to download libbb-external.a)
     echo "No GitHub release found for v$version, adding --no-verify (pass REF_NAME matching a release for full verification)"
     extra_flags="--no-verify"
@@ -96,7 +96,7 @@ function test_download {
   cargo clean -p barretenberg-rs 2>/dev/null || true
 
   # Build with a known release version
-  local version=${BARRETENBERG_VERSION:-$(gh release list --repo AztecProtocol/aztec-packages --limit 1 --json tagName --jq '.[0].tagName' | sed 's/^v//')}
+  local version=${BARRETENBERG_VERSION:-$(gh release list --repo AztecProtocol/barretenberg --limit 1 --json tagName --jq '.[0].tagName' | sed 's/^v//')}
   echo "Testing download with version: $version"
 
   # Retry logic for network flakiness (GitHub releases can be flaky)

diff --git a/bootstrap.sh b/bootstrap.sh
@@ -486,36 +486,22 @@ function versions {
   echo "wasi-sdk: $wasi_sdk_version"
 }
 
-function release_github {
-  # Add an easy link for comparing to previous release.
-  local compare_link=""
-  if gh release view "v$CURRENT_VERSION" &>/dev/null; then
-    compare_link=$(echo -e "See changes: https://github.com/AztecProtocol/aztec-packages/compare/v${CURRENT_VERSION}...${COMMIT_HASH}")
-  fi
-  # Legacy releases. TODO: Eventually remove.
-  if gh release view "aztec-packages-v$CURRENT_VERSION" &>/dev/null; then
-    compare_link=$(echo -e "See changes: https://github.com/AztecProtocol/aztec-packages/compare/aztec-packages-v${CURRENT_VERSION}...${COMMIT_HASH}")
+function release_bb_github {
+  # Create a GitHub release in AztecProtocol/barretenberg for bb artifacts.
+  # Users can manually create releases in aztec-packages via the GitHub UI if needed.
+  local bb_repo="AztecProtocol/barretenberg"
+  if gh release view "$REF_NAME" --repo "$bb_repo" &>/dev/null; then
+    return
   fi
-  # Determine if this is a prerelease (has a prerelease tag like -rc.1, -alpha, etc.)
-  local is_prerelease=false
+  local prerelease_flag=""
   if [ -n "$(semver prerelease $REF_NAME)" ]; then
-    is_prerelease=true
-  fi
-  # Ensure we have a commit release.
-  if ! gh release view "$REF_NAME" &>/dev/null; then
-    local prerelease_flag=""
-    if $is_prerelease; then
-      prerelease_flag="--prerelease"
-    fi
-    do_or_dryrun gh release create "$REF_NAME" \
-      $prerelease_flag \
-      --target $COMMIT_HASH \
-      --title "$REF_NAME" \
-      --notes "$compare_link"
-  elif ! $is_prerelease; then
-    # Release exists but this is not a prerelease version - ensure it's marked as a full release
-    do_or_dryrun gh release edit "$REF_NAME" --prerelease=false
+    prerelease_flag="--prerelease"
   fi
+  do_or_dryrun gh release create "$REF_NAME" \
+    --repo "$bb_repo" \
+    $prerelease_flag \
+    --title "$REF_NAME" \
+    --notes "Release $REF_NAME — see https://github.com/AztecProtocol/aztec-packages/commits/$COMMIT_HASH"
 }
 
 function release {
@@ -525,9 +511,9 @@ function release {
   echo_header "release all"
   set -x
 
-  # Ensure we have a github release for our REF_NAME.
-  # This is in case were are not going through release-please.
-  release_github
+  # Ensure we have a github release in AztecProtocol/barretenberg for bb artifacts.
+  # Users can create aztec-packages releases manually via the GitHub "Create a release" button.
+  release_bb_github
 
   projects=(
     barretenberg/cpp
@@ -817,8 +803,24 @@ case "$cmd" in
     if ! semver check $REF_NAME; then
       exit 1
     fi
-    build release
-    release
+    if [[ "$(semver prerelease $REF_NAME)" == private* ]]; then
+      echo_header "Private fork release: $REF_NAME"
+      echo "Creating GitHub release from public repo context (COMMIT_HASH=$COMMIT_HASH)..."
+      release_github
+      echo "Fetching private source from aztec-packages-private..."
+      git remote add private "https://x-access-token:${GITHUB_TOKEN}@github.com/AztecProtocol/aztec-packages-private.git"
+      git fetch --depth 1 private "refs/tags/$REF_NAME"
+      git worktree add aztec-private FETCH_HEAD
+      cd aztec-private
+      echo "Initializing submodules in private worktree..."
+      git submodule update --init --recursive
+      echo "Private worktree ready at $(pwd) (HEAD=$(git rev-parse --short HEAD)). Cache uploads disabled."
+      export NO_CACHE_UPLOAD=1
+      # Unset so child bootstrap.sh re-derives these from the worktree.
+      unset COMMIT_HASH root
+    fi
+    ./bootstrap.sh build release
+    ./bootstrap.sh release
     ;;
 
   ##########################

@@ -22,6 +22,11 @@ if [[ -z "${S3_FORCE_UPLOAD:-}" && "${CI:-0}" -eq 0 ]]; then
   exit 0
 fi
 
+if [[ "${NO_CACHE_UPLOAD:-0}" -eq 1 ]]; then
+  echo_stderr "Skipping upload because NO_CACHE_UPLOAD=1."
+  exit 0
+fi
+
 # In SSM/instance-profile mode, AWS CLI falls back to IMDS for credentials.
 if [[ "${CI_SSM_MODE:-0}" -eq 0 ]]; then
   if [[ -z "${AWS_ACCESS_KEY_ID:-}" || -z "${AWS_SECRET_ACCESS_KEY:-}" ]] && ! aws configure get aws_access_key_id &>/dev/null; then

@@ -75,13 +75,18 @@ num_jobs=0
 
 # We'll handle errors explicitly.
 set +e
-run_tests | tee $output
+set -o pipefail
+run_tests | tee "$output"
+run_exit=$?
 
 # Loop to monitor jobs until one fails or all finish.
 while (( $(jobs -p | wc -l) > 0 )); do
   wait_for_job
 done
 
+# Propagate failure from run_tests (which runs in a subshell due to the pipe).
+[ $run_exit -ne 0 ] && exit $run_exit
+
 function filter_long_times {
   grep -E '\([0-9]+s\)$' |           # Match lines ending with (number)s
   sed 's/.*(\([0-9]\+\)s)$/\1 &/' |  # Extract number and keep original line

diff --git a/spartan/aztec-bot/templates/env.configmap.yaml b/spartan/aztec-bot/templates/env.configmap.yaml
@@ -17,3 +17,9 @@ data:
   BOT_STOP_WHEN_UNHEALTHY: {{ .Values.bot.stopIfUnhealthy | quote }}
   AZTEC_NODE_URL: {{ .Values.bot.nodeUrl | quote }}
   TEST_ACCOUNTS: {{ .Values.bot.testAccounts | quote }}
+  {{- if .Values.bot.daGasLimit }}
+  BOT_DA_GAS_LIMIT: {{ .Values.bot.daGasLimit | quote }}
+  {{- end }}
+  {{- if .Values.bot.l2GasLimit }}
+  BOT_L2_GAS_LIMIT: {{ .Values.bot.l2GasLimit | quote }}
+  {{- end }}