bump[

.dockerignore

@@ -0,0 +1,6 @@
+**
+!.dockerignore
+!Dockerfile
+!target/
+!target/release/
+!target/release/nockchain

.github/workflows/jam-consistency.yml

@@ -0,0 +1,53 @@
+name: "Check kernel jams are not stale relative to hoon sources"
+
+# hoonc output bytes are not reproducible across runs (HashMap iteration order
+# leaks into the jam), so a byte-for-byte rebuild-and-diff cannot pass
+# reliably. Instead, use git history: if any hoon/ file was modified in a
+# commit newer than the most recent commit touching assets/*.jam, the jams
+# are stale and must be rebuilt. This is what we actually want to catch —
+# the trap that hid the duplicate +lock-merkle-proof-full arm and let the
+# pre-Aletheia kernel ship.
+
+on:
+  push:
+    branches:
+      - master
+      - "nockpool/**"
+  pull_request:
+    branches:
+      - master
+      - "nockpool/**"
+
+jobs:
+  jam-staleness:
+    name: hoon vs assets git-log staleness
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Need full history so `git log -- assets/*.jam` can find the
+          # commit that last touched the jams.
+          fetch-depth: 0
+
+      - name: Fail if hoon/ has changed since assets/*.jam was last rebuilt
+        run: |
+          set -euo pipefail
+          LAST_JAM_COMMIT=$(git log -1 --format=%H -- 'assets/*.jam')
+          if [ -z "$LAST_JAM_COMMIT" ]; then
+            echo "::error::No commit found that touches assets/*.jam — repo state is unexpected."
+            exit 1
+          fi
+          echo "Last commit touching assets/*.jam: $LAST_JAM_COMMIT"
+          STALE_HOON=$(git log --name-only --pretty=format: "${LAST_JAM_COMMIT}..HEAD" -- 'hoon/**' | sort -u | sed '/^$/d')
+          if [ -n "$STALE_HOON" ]; then
+            echo "::error::These hoon files were modified after assets/*.jam was last rebuilt:"
+            echo "$STALE_HOON"
+            echo
+            echo "::error::Rebuild the jams and commit them:"
+            echo "  make install-hoonc"
+            echo "  make build-hoon-all"
+            echo "  git add assets/*.jam && git commit -m 'bump jams'"
+            exit 1
+          fi
+          echo "OK: no hoon changes since last jam rebuild."

.github/workflows/sync-to-nockchain.yml

@@ -4,6 +4,19 @@ on:
   push:
     branches:
       - master
+  workflow_dispatch:
+    inputs:
+      force_sync:
+        description: Force sync even if master heads already match
+        required: false
+        default: false
+        type: boolean
+  schedule:
+    - cron: "*/30 * * * *"
+
+concurrency:
+  group: sync-to-nockchain-master
+  cancel-in-progress: false
 
 jobs:
   sync:
@@ -14,7 +27,55 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Plan sync
+        id: plan
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          FORCE_SYNC: ${{ inputs.force_sync || 'false' }}
+        run: |
+          set -euo pipefail
+          staging_sha="$(git rev-parse HEAD)"
+          nockchain_sha="$(git ls-remote https://github.com/nockchain/nockchain.git refs/heads/master | awk '{print $1}')"
+
+          if [ -z "$nockchain_sha" ]; then
+            echo "failed to resolve nockchain/nockchain master SHA" >&2
+            exit 1
+          fi
+
+          should_sync=false
+          reason="already-in-sync"
+
+          if [ "$EVENT_NAME" = "push" ]; then
+            should_sync=true
+            reason="push-to-master"
+          elif [ "$FORCE_SYNC" = "true" ]; then
+            should_sync=true
+            reason="manual-force"
+          elif [ "$staging_sha" != "$nockchain_sha" ]; then
+            should_sync=true
+            reason="heads-diverged"
+          fi
+
+          echo "staging_sha=$staging_sha" >> "$GITHUB_OUTPUT"
+          echo "nockchain_sha=$nockchain_sha" >> "$GITHUB_OUTPUT"
+          echo "should_sync=$should_sync" >> "$GITHUB_OUTPUT"
+          echo "reason=$reason" >> "$GITHUB_OUTPUT"
+
+      - name: Sync plan summary
+        run: |
+          echo "event=${{ github.event_name }}"
+          echo "reason=${{ steps.plan.outputs.reason }}"
+          echo "staging master=${{ steps.plan.outputs.staging_sha }}"
+          echo "nockchain master=${{ steps.plan.outputs.nockchain_sha }}"
+          echo "should_sync=${{ steps.plan.outputs.should_sync }}"
+
       - name: Push to nockchain/nockchain
+        if: steps.plan.outputs.should_sync == 'true'
         run: |
           git remote add nockchain https://bitemyapp:${{ secrets.NOCKCHAIN_SYNC_TOKEN }}@github.com/nockchain/nockchain.git
           git push nockchain master:master
+
+      - name: Skip sync
+        if: steps.plan.outputs.should_sync != 'true'
+        run: |
+          echo "Skipping sync: staging and nockchain master are already aligned"

.gitignore

@@ -8,3 +8,5 @@ test-follower
 target
 !crates/nockapp/test-jams
 keys.export
+replay-checkpoints-51094
+nockchain-api-checkpoints-backup

.gitlab-ci.yml

@@ -51,10 +51,18 @@ docs-check:
 
 build-kernels:
   stage: kernels
+  # Kernel build + cargo-test gate the merge request into `open` (the
+  # required pre-merge check). Re-running them on the post-merge `open`
+  # push only delays sync-to-staging by ~2h, so skip them there.
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "open"'
+      when: never
+    - when: on_success
   script:
     - |
       nix develop -c bash -c '
         set -euo pipefail
+        export HOONC_FLAGS="--ephemeral"
         make update-hoonc
         make assets/dumb.jam
         make assets/miner.jam
@@ -72,6 +80,11 @@ cargo-test:
   needs:
     - job: build-kernels
       artifacts: true
+  # See build-kernels: validated on the MR into `open`, skipped on push.
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "open"'
+      when: never
+    - when: on_success
   script:
     - |
       nix develop -c bash -c '
@@ -85,8 +98,10 @@ cargo-test:
 
 sync-to-staging:
   stage: sync
-  needs:
-    - job: cargo-test
+  # Build/test validation already ran as a required check on the MR into
+  # `open`; the post-merge `open` pipeline only publishes, so don't gate on
+  # (or wait ~2h for) the build/test jobs.
+  needs: []
   rules:
     - if: '$CI_COMMIT_BRANCH == "open" && $CI_PIPELINE_SOURCE == "push"'
     - if: '$CI_COMMIT_BRANCH == "open" && $FORCE_SYNC_TO_STAGING == "1"'