ci: Standardize benchmarks and input constants

.github/actions/bencher-track/action.yml

@@ -12,7 +12,7 @@ inputs:
     description: Bencher testbed slug.
     required: true
   workload:
-    description: Workload key for the `bencher-thresholds-reset-<workload>` tag (e.g. ix-compile, aiur).
+    description: Workload key for the `bencher-thresholds-reset-<workload>` tag (the backend testbed minus its runner-arch suffix, e.g. zisk-check-execute).
     required: true
   file:
     description: Bencher Metric Format JSON file to upload.

.github/actions/install-sp1/action.yml

@@ -0,0 +1,31 @@
+name: Install SP1
+description: >-
+  Install the system build deps and the SP1 zkVM toolchain (sp1up) needed to
+  build and run the SP1 host. Assumes a Rust toolchain is already set up.
+
+runs:
+  using: composite
+  steps:
+    # The shared zkVM apt superset (the ZisK book's full Ubuntu list — the
+    # prebuilt cargo tooling and proofman's C++ link OpenMPI/OpenMP/GMP/
+    # nlohmann-json/nasm/secp256k1/… — plus pkg-config + libssl-dev for SP1's
+    # host crates). The Nix shells provided this; a bare runner doesn't.
+    - name: Install system build deps
+      shell: bash
+      run: |
+        # Some warpbuild images ship an unreachable azure mirror that hangs
+        # `apt-get update`; drop it first (no-op elsewhere).
+        sudo sed -i '/azure\.archive\.ubuntu\.com/d' /etc/apt/apt-mirrors.txt 2>/dev/null || true
+        sudo apt-get update
+        sudo apt-get install -y \
+          xz-utils jq curl build-essential qemu-system libomp-dev libgmp-dev \
+          nlohmann-json3-dev protobuf-compiler uuid-dev libgrpc++-dev \
+          libsecp256k1-dev libsodium-dev libpqxx-dev nasm libopenmpi-dev \
+          openmpi-bin openmpi-common libclang-dev clang gcc-riscv64-unknown-elf \
+          pkg-config libssl-dev
+    - name: Install SP1 toolchain (sp1up, latest)
+      shell: bash
+      run: |
+        curl -L https://sp1up.succinct.xyz | bash
+        ~/.sp1/bin/sp1up
+        echo "$HOME/.sp1/bin" >> "$GITHUB_PATH"

.github/actions/install-zisk/action.yml

@@ -0,0 +1,95 @@
+name: Install Zisk
+description: >-
+  Install the system build deps, the ZisK zkVM toolchain (ziskup, CPU build),
+  and — unless `proving-key: false` — the fork-matching proving key needed to
+  RUN the Zisk host. Execute needs the key too (zisk-host's `client.setup()`
+  loads the circuit's const-tree files before either the execute or the prove
+  branch), but BUILDING the host does not, so build-only callers skip the
+  ~3 GB download + const-tree regeneration. Assumes a Rust toolchain is
+  already set up.
+
+inputs:
+  proving-key:
+    description: >-
+      Install the fork-matching proving key (required to execute or prove;
+      not needed to build). Set false for build-only jobs.
+    required: false
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    # The shared zkVM apt superset — the ZisK book's full Ubuntu list (prebuilt
+    # cargo-zisk + proofman's C++ link OpenMPI/OpenMP/GMP/nlohmann-json/nasm/
+    # secp256k1/…), kept identical to install-sp1 so a host that links both is
+    # covered. The Nix shells provided this; a bare runner doesn't.
+    - name: Install system build deps
+      shell: bash
+      run: |
+        # Some warpbuild images ship an unreachable azure mirror that hangs
+        # `apt-get update`; drop it first (no-op elsewhere).
+        sudo sed -i '/azure\.archive\.ubuntu\.com/d' /etc/apt/apt-mirrors.txt 2>/dev/null || true
+        sudo apt-get update
+        sudo apt-get install -y \
+          xz-utils jq curl build-essential qemu-system libomp-dev libgmp-dev \
+          nlohmann-json3-dev protobuf-compiler uuid-dev libgrpc++-dev \
+          libsecp256k1-dev libsodium-dev libpqxx-dev nasm libopenmpi-dev \
+          openmpi-bin openmpi-common libclang-dev clang gcc-riscv64-unknown-elf \
+          pkg-config libssl-dev
+    # `--version 0.18.0` pins the toolchain to match our deps. Our host links the
+    # argumentcomputer/zisk `blake3-precompile` fork, which is based on v0.18.0
+    # (its cargo-zisk has `check-setup`, used below to regenerate the key's
+    # const-trees). Without the pin, ziskup installs `releases/latest`, which
+    # resolves to upstream `v1.0.0-alpha` — a different circuit whose cargo-zisk
+    # dropped the `check-setup` subcommand, breaking the key step. `--cpu` picks
+    # the CPU build (no GPU on the runner) and `--nokey` skips ziskup's key
+    # install — both avoid its interactive /dev/tty prompts. We keep `--nokey`
+    # because the upstream `zisk-setup` bucket only carries the upstream circuit's
+    # key; our fork has a different circuit (extra Blake3f AIR), so we restore the
+    # fork-matching key from our own S3 in the next step. `--prefix $HOME/.zisk`
+    # pins the install where cargo-zisk's ZiskPaths fallback looks (the runner
+    # sets XDG_CONFIG_HOME, which would otherwise relocate it).
+    - name: Install Zisk toolchain (ziskup, pinned v0.18.0)
+      shell: bash
+      run: |
+        curl -L https://raw.githubusercontent.com/0xPolygonHermez/zisk/main/ziskup/install.sh \
+          | bash -s -- --cpu --nokey -y --version 0.18.0 --prefix "$HOME/.zisk"
+        echo "$HOME/.zisk/bin" >> "$GITHUB_PATH"
+    # Pre-build the proofman C++ sys crate ALONE so its build script runs
+    # exactly once before any parallel zisk-host build. zisk-host pulls
+    # zisk-sdk as both a dependency and a build-dependency, so cargo compiles
+    # proofman-starks-lib-c as two units whose build scripts can run
+    # CONCURRENTLY — and both run `make` inside the SHARED
+    # ~/.cargo/git/checkouts/pil2-proofman-* source dir. On a cold runner the
+    # Makefile stamp is absent, so both units take the `make clean` +
+    # `make -j` path and race: one unit's clean deletes build/ while the
+    # other's g++ is mid-compile ("opening dependency file ….d: No such file
+    # or directory"). Building the crate solo writes the stamp; the second
+    # unit then skips the clean and its `make -j` is a no-op.
+    # (Proper fix is an flock in pil2-proofman's build.rs — upstream.)
+    - name: Pre-build proofman-starks-lib-c (serialize the shared make)
+      shell: bash
+      run: cargo build --release -p proofman-starks-lib-c
+      working-directory: zisk
+    # Execute still needs a proving key present: zisk-host calls `client.setup()`
+    # (which the SDK runs before the execute branch), and that loads the circuit's
+    # const-tree files. We host the fork-matching key in a public S3 bucket
+    # WITHOUT the const-trees — exactly like Zisk's released
+    # `zisk-provingkey-*.tar.gz` on `storage.googleapis.com/zisk-setup` — and
+    # regenerate them here with `cargo-zisk check-setup -a`, which is how `ziskup`
+    # itself populates them. That keeps the artifact ~3 GB (gzip) instead of
+    # ~48 GB. The object name carries the fork rev so a circuit change can't
+    # silently reuse a stale key. Public bucket → plain curl, no AWS creds.
+    - name: Restore Zisk proving key (fork circuit) from S3
+      if: inputs.proving-key == 'true'
+      shell: bash
+      run: |
+        mkdir -p "$HOME/.zisk"
+        curl -fSL --retry 3 \
+          https://argument-zisk-setup.s3.amazonaws.com/zisk-provingkey-blake3-8f9e24d5-cpu.tar.gz \
+          -o /tmp/zisk-provingkey.tar.gz
+        tar -C "$HOME/.zisk" -xzf /tmp/zisk-provingkey.tar.gz
+        rm -f /tmp/zisk-provingkey.tar.gz
+        # Regenerate the const-tree files omitted from the artifact (CPU build, so
+        # no --gpu). This is the "may take a while" step ziskup prints.
+        cargo-zisk check-setup --proving-key "$HOME/.zisk/provingKey" -a

.github/scripts/watchdog.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Hard memory cap: run <cmd> in a systemd user scope with cgroup-v2
+# memory.max = <ceiling_gb> and swap disabled. The kernel OOM-kills at
+# the cap — SIGKILL, exit 137, which the orchestrator (`ix bench run`)
+# reads as the in-flight constant's OOM. No sampler to race, nothing to
+# sum: the cgroup charges the whole tree's resident memory, and cached
+# allocator reservations don't count. Validated on ubuntu-latest and
+# warp runners (see ix-cpu-info's cgroup-memcap.yml).
+#
+#   watchdog.sh <ceiling_gb> <cmd> [args...]
+#
+# Needs a user systemd instance: the linger call boots one on CI
+# (passwordless sudo); it no-ops locally, where a desktop session
+# already provides the user manager.
+set -u
+ceiling_gb=${1:?ceiling_gb}
+shift
+[ $# -ge 1 ] || { echo "watchdog: no command given" >&2; exit 2; }
+
+sudo -n loginctl enable-linger "${USER:-$(id -un)}" 2>/dev/null || true
+export XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR:-/run/user/$(id -u)}
+
+# memory.oom.group=1: on breach the kernel kills the WHOLE scope (exit
+# 137 -> oom row), not just its biggest process. Without it, Zisk's ASM
+# service gets singled out and the surviving host converts the memory
+# kill into a clean exit 1 — which the orchestrator must treat as a
+# deterministic failure. The scope's cgroup is user-delegated, so the
+# write needs no sudo; if it fails, exit 2 rather than run with wrong
+# kill semantics.
+exec systemd-run --user --scope --quiet \
+  -p MemoryMax="${ceiling_gb}G" -p MemorySwapMax=0 \
+  bash -c 'echo 1 > "/sys/fs/cgroup$(cut -d: -f3- /proc/self/cgroup)/memory.oom.group" \
+             || { echo "watchdog: cannot set memory.oom.group" >&2; exit 2; }
+           exec "$@"' watchdog "$@"