fix(ci): allow ci-refresh-chonk PRs to run while draft so pinned-input refresh can complete

[AztecBot]

Problem

The Nightly Debug Build (run 26739379231) fails on the test bbapi_tests ChonkPinnedIvcInputsTest.AllPinnedFlows. The build/compile succeed; the failing flow (CI log) shows:

Pub inputs offset mismatch: 669 vs 673
Does the precomputed vk match with the one generated during accumulation? false
Commitment mismatch: Q_M / Q_C / SIGMA_* / ID_* / ...
Assertion failed: (kernel_return_data_match)
Reason: kernel_return_data mismatch: proof contains { 0x18322739..., 0x0 }
        but kernel_calldata commitment is { 0x...01, 0x...02 }

Immediate cause: stale pinned Chonk inputs

The pinned Chonk flows are an S3 tarball keyed by barretenberg/cpp/scripts/chonk-inputs.hash, last refreshed 2026-05-21 (2ab01bb56fa). Since then, breaking protocol-circuit / contract changes landed on next — protocol-contract address shift to 1–3 (#23218), multi_call_entrypoint / public_checks / auth-registry demotions (#23197, #23217, #23106), and several aztec-nr changes — which alter the kernel public-input layout and VKs. The +4 public-inputs shift (669→673) and the wholesale precomputed-VK mismatch are consistent with legitimate circuit evolution, so the fix is to refresh the pin (per barretenberg/cpp/CLAUDE.md and the chonk-inputs skill).

Why it isn't self-healing (the actual fix here)

The nightly already auto-dispatches a ClaudeBox session on failure, which opens a ci-refresh-chonk PR (e.g. #23751, #23744). The refresh push-back (ci3_success.sh → ci_update_chonk_inputs.sh) runs inside the ci job. But that job is gated:

if: ... && (github.event.pull_request.draft == false || contains(labels, 'ci-draft'))

create_pr opens these refresh PRs as drafts, so the ci job is skipped (confirmed on #23751: the CI3 run was skipped/cancelled in ~9s, head never advanced, chonk-inputs.hash unchanged). The refresh never runs → the nightly stays red → another duplicate draft refresh PR is opened. A loop.

Fix

Add ci-refresh-chonk to the draft escape-hatch on the ci job (same pattern as the existing ci-draft label). A ci-refresh-chonk PR runs CI_MODE=skip for the main body anyway (ci3_labels_to_env.sh) and only performs the lightweight regenerate + small-flow smoke-test + hash push-back, so running it on drafts is cheap and is exactly the intent of the label.

-    if: ... && (draft == false || contains(labels, 'ci-draft'))
+    if: ... && (draft == false || contains(labels, 'ci-draft') || contains(labels, 'ci-refresh-chonk'))

Follow-up to actually green the nightly

This PR fixes the mechanism but does not itself regenerate the pin. To clear the current failure, an existing refresh PR (#23751, already labeled ci-refresh-chonk, base next) needs to run its refresh and be merged. Once this gate change is on next, re-triggering #23751 (mark ready / re-push) runs the refresh, which pushes the new chonk-inputs.hash; merging it turns the nightly green. The two open duplicates (#23751, #23744) should be deduplicated to one.

---

Created by claudebox · group: slackbot

[AztecBot]

Automatically closing this stale claudebox draft PR (no updates for 5+ days). Re-open if still needed.