feat(airbender): adapt prover server to v31 verifier wire format (#4880)

Adapt the Airbender prover server to the v31 verifier wire format and
add the plumbing needed to prove and verify a batch with it end-to-end:
a zkstack knob to deploy the Airbender L1 verifier, and a GPU e2e CI
lane that proves batch 1 and checks the proof on L1.

## What ❔

**Verifier bump (v31 wire format)**
- Bump `eravm-airbender-verifier` to the released `v31.1.1` tag, which
removes the `V0`/`V1` `AirbenderVerifierInput` envelope and adopts the
v31 wire layout (`L2PubdataValidator`, `settlement_layer`,
`interop_fee`).
- client: deserialize the FRI job directly into the single
`AirbenderVerifierInput` instead of polling `V1AirbenderVerifierInput`
and wrapping it in `AirbenderVerifierInput::V1`; the integration test
drops `.into_v1()` accordingly.
- `build.rs` resolves guest/VK artifacts from the pinned tag as usual
(with retry on transient download errors); the `AIRBENDER_*` env
overrides remain available for local development.
- SNARK wrapper: bind the guest program paths so the wrapper proves the
pinned guest.
- Note: the committed LFS bincode corpus used by the (ignored,
GPU-gated) integration test predates the v31 layout and still needs
regenerating.

**zkstack: `--verifier-type` (`testnet` | `dual` | `airbender`)**
- New `VerifierType` threaded through `ecosystem init` and `ctm` init
into the CTM deploy scripts; `airbender` wires the Airbender PLONK
verifier into the third slot of the Era dual verifier. Defaults preserve
current behavior (`testnet` for `no-proofs`, `dual` otherwise). Named
`--verifier-type` to avoid colliding with forge's `--verifier`.
- genesis validation: the dual verifier's sub-verifier VK check now
recognizes Airbender chains (index 2 on the Era dual verifier) and only
treats index 2 as Airbender when index 0 (FFLONK) also resolves, since
the ZKsyncOS dual verifier reuses index 2 for its own PLONK
sub-verifier. There is no config field for the Airbender VK hash yet
(TODO in code); a mismatch surfaces on L1 at prove time.
- `setDAValidatorPair` call sites updated for the new signature (adds
`access_control_restriction`).

**CI: Airbender GPU e2e lane**
- New `ci-airbender-prover-e2e.yml`: builds the prover server with CUDA
13 on a high-CPU runner, then on an RTX6000 GPU runner inits an
ecosystem with `--verifier-type airbender`, sends precompile txs into
batch 1, proves FRI then SNARK, and asserts on-chain that
`getTotalBatchesVerified` advances (real `proveBatchesSharedBridge`
through the Airbender verifier).
- The lane only runs for same-repo PRs: it executes a PR-built binary on
a persistent self-hosted GPU runner, so fork-controlled code never
reaches it.
- New checkers (`airbender_proof_status_checker`,
`batch_verified_on_l1_checker`) and `bin/prepare_airbender_fixture` to
collect proof artifacts for refreshing the era-contracts
`AirbenderPlonkProofFixture.sol`.
- `setup-env` gains an `sccache` toggle (the GPU hosts cannot
authenticate the GCS backend).

## Why ❔

The v31 protocol upgrade changed the batch commitment inputs (pubdata
validator, settlement layer, interop fee), and the Airbender verifier
repo followed with a breaking wire-format change. This PR keeps the
prover server compatible and adds the missing deployment/CI story so the
Airbender proving path is exercised end-to-end on every relevant change.

## Is this a breaking change?
- [ ] Yes
- [x] No

## Operational changes

- `zkstack ecosystem init` / `zkstack ctm init` accept `--verifier-type
{testnet,dual,airbender}`; omitting it preserves current defaults.
- The CTM deploy-script input gains an optional `airbender_verifier`
flag (older input configs stay compatible).
- The prover server accepts `PROVER_GUEST_DIST_DIR`, `FRI_VK`,
`SNARK_VK`, `SNARK_TRUSTED_SETUP_FILE`, `PROVER_SERVER_URL` to point at
artifacts explicitly.

## Checklist

- [x] PR title corresponds to the body of PR (we generate changelog
entries from PRs).
- [x] Tests for the changes have been added / updated.
- [x] Documentation comments have been added / updated.
- [x] Code has been formatted via `zkstack dev fmt` and `zkstack dev
lint`.

---------

Signed-off-by: Danil Lugovskoi <dl@matterlabs.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

.github/actions/setup-env/action.yml

@@ -4,6 +4,11 @@ inputs:
   runner-compose-file:
     description: 'Path to the runner compose file'
     default: 'docker-compose.yml'
+  sccache:
+    description: >-
+      Wire sccache to the shared GCS cache and start its servers. Disable on runners that can't
+      reach the GCS backend (e.g. the Hetzner GPU hosts, which lack the GCP metadata service).
+    default: 'true'
 
 runs:
   using: composite
@@ -20,9 +25,11 @@ runs:
         echo CI=1 >> $GITHUB_ENV
         echo IN_DOCKER=1 >> .env
         echo CI=1 >> .env
+        echo DOCKER_PWD=$(pwd) >> .env
         echo RUNNER_COMPOSE_FILE=${{ inputs.runner-compose-file }} >> $GITHUB_ENV
 
     - name: Setup sccache for building rust code outside Docker
+      if: inputs.sccache == 'true'
       shell: bash
       run: |
         echo SCCACHE_CACHE_SIZE=50G >> $GITHUB_ENV
@@ -36,6 +43,7 @@ runs:
         echo SCCACHE_SERVER_PORT=4225 >> $GITHUB_ENV
 
     - name: Setup sccache for building rust code inside Docker
+      if: inputs.sccache == 'true'
       shell: bash
       run: |
         echo SCCACHE_CACHE_SIZE=50G >> .env
@@ -44,7 +52,13 @@ runs:
         echo SCCACHE_ERROR_LOG=/tmp/sccache_log.txt >> .env
         echo SCCACHE_GCS_RW_MODE=READ_WRITE >> .env
         echo RUSTC_WRAPPER=sccache >> .env
-        echo DOCKER_PWD=$(pwd) >> .env
+
+    # The zk-environment image bakes in RUSTC_WRAPPER=sccache; empty means "no wrapper" to cargo.
+    - name: Disable sccache inside Docker
+      if: inputs.sccache != 'true'
+      shell: bash
+      run: |
+        echo RUSTC_WRAPPER= >> .env
 
     - name: Start localnet
       shell: bash
@@ -53,6 +67,7 @@ runs:
         ci_localnet_up
 
     - name: Start sccache servers
+      if: inputs.sccache == 'true'
       shell: bash
       run: |
         ci_run sccache --start-server

.github/workflows/ci-airbender-prover-e2e.yml

@@ -15,7 +15,6 @@ jobs:
       CUDA_ARCH: "75;80;89;90"
       CUDAARCHS: "75;80;89;90"
       PASSED_ENV_VARS: "CUDA_ARCH,CUDAARCHS"
-
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/ci-prover-e2e.yml

@@ -16,6 +16,7 @@ jobs:
       core: ${{ steps.changed-files.outputs.core_any_changed }}
       prover: ${{ steps.changed-files.outputs.prover_any_changed }}
       airbender_prover_server: ${{ steps.changed-files.outputs.airbender_prover_server_any_changed }}
+      airbender_e2e: ${{ steps.changed-files.outputs.airbender_e2e_any_changed }}
       docs: ${{ steps.changed-files.outputs.docs_any_changed }}
       all: ${{ steps.changed-files.outputs.all_any_changed }}
     steps:
@@ -57,6 +58,23 @@ jobs:
               - '.github/workflows/actions/**'
               - '!**/*.md'
               - '!**/*.MD'
+            # Airbender GPU e2e lane: the prover server and the core code it exercises.
+            airbender_e2e:
+              - 'airbender_prover_server/**'
+              - 'docker/airbender-prover-server/**'
+              - 'core/node/airbender_proof_data_handler/**'
+              - 'core/lib/airbender_prover_interface/**'
+              - 'core/lib/airbender_verifier/**'
+              - 'core/lib/dal/src/airbender_proof_generation_dal.rs'
+              - 'core/lib/dal/src/models/storage_airbender_proof.rs'
+              - 'core/lib/dal/migrations/*airbender*'
+              - '.github/workflows/ci-airbender-prover-e2e.yml'
+              - '.github/workflows/build-airbender-prover-server-template.yml'
+              # Only setup-env, not all actions — this lane occupies a scarce GPU runner for hours.
+              - '.github/actions/setup-env/**'
+              - 'bin/prover_checkers/**'
+              - '!**/*.md'
+              - '!**/*.MD'
             core:
               - 'core/**'
               - '!core/CHANGELOG.md'
@@ -124,6 +142,16 @@ jobs:
     if: ${{ (needs.changed_files.outputs.airbender_prover_server == 'true' || needs.changed_files.outputs.all == 'true') && !contains(github.head_ref, 'release-please--branches') }}
     uses: ./.github/workflows/ci-airbender-prover-server-reusable.yml
 
+  e2e-for-airbender-prover:
+    name: E2E Test for Airbender Prover
+    needs: changed_files
+    permissions:
+      contents: read
+    # Same-repo PRs only: the e2e job executes a PR-built binary on a persistent self-hosted GPU
+    # runner, so fork-controlled code must never reach it.
+    if: ${{ (needs.changed_files.outputs.airbender_e2e == 'true' || needs.changed_files.outputs.all == 'true') && !contains(github.head_ref, 'release-please--branches') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
+    uses: ./.github/workflows/ci-airbender-prover-e2e.yml
+
   ci-for-docs:
     needs: changed_files
     if: needs.changed_files.outputs.docs == 'true'
@@ -196,6 +224,7 @@ jobs:
         build-prover-images,
         build-airbender-prover-server-images,
         e2e-for-prover,
+        e2e-for-airbender-prover,
       ]
     steps:
       - name: Status

.github/workflows/ci.yml

@@ -102,16 +102,8 @@ vise-exporter = "0.3.2"
 # workspace dep — a member's `default-features = false` is otherwise ignored.
 airbender-host = { git = "https://github.com/matter-labs/airbender-platform", tag = "v0.2.3", default-features = false }
 
-# eravm-airbender-verifier crates, pinned to the released tag `v29.8.0`.
-# `build.rs` derives this tag from cargo metadata and downloads the matching
-# artifacts, so they track the verifier code we compile against.
-# `default-features = false` drops the host crate's default `gpu_fri`; the
-# server re-enables it via its own `gpu_fri` feature. Set on the workspace dep
-# so a member's `default-features = false` isn't ignored.
-eravm-prover-host = { git = "https://github.com/matter-labs/eravm-airbender-verifier", tag = "v29.8.0", default-features = false }
-# Same tag as eravm-prover-host so the two git copies unify into one crate
-# instance. Used by the client to deserialize jobs into the verifier input type.
-zksync_airbender_verifier = { git = "https://github.com/matter-labs/eravm-airbender-verifier", tag = "v29.8.0" }
+eravm-prover-host = { git = "https://github.com/matter-labs/eravm-airbender-verifier", tag = "v31.1.1", default-features = false }
+zksync_airbender_verifier = { git = "https://github.com/matter-labs/eravm-airbender-verifier", tag = "v31.1.1" }
 
 # Local crates in this workspace.
 zksync_cli_utils = { path = "crates/lib/cli_utils" }