ledger-v9: port to the Midnight 2.x line (compactc 0.34.0, ledger 9, midnight-js 5)

.github/workflows/ci.yml

@@ -2,7 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # `main` is the 1.x/preview line; `ledger-v9` is the long-lived Midnight 2.x port
+    # (see README "Two lines"). Both get full CI on every push.
+    branches: [main, ledger-v9]
   pull_request:
   workflow_dispatch:
 
@@ -11,7 +13,12 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  COMPACT_VERSION: '0.31.1'
+  # ledger-v9 line: toolchain 0.34.0 = compactc 0.34.0, language 0.26.0,
+  # compact-runtime 0.19.0, ledger 9. MUST equal the `pragma language_version`
+  # in src/shielded-night.compact and the `+version` in package.json's compact
+  # scripts, or the byte-exact rebuild job below is meaningless.
+  # (`main` pins 0.31.1 / language 0.23.)
+  COMPACT_VERSION: '0.34.0'
 
 jobs:
   unit:
@@ -85,8 +92,8 @@ jobs:
   reproducible-build:
     name: Byte-exact contract rebuild
     runs-on: ubuntu-latest
-    # Full ZK key generation for all 11 circuits measures ~15s; the headroom is
-    # for a cold compiler install.
+    # Full ZK key generation for all 11 circuits measures ~14s on 0.34.0; the
+    # headroom is for a cold compiler install.
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
@@ -126,7 +133,23 @@ jobs:
   integration:
     name: Integration tests (docker stack)
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    # 150, not the 60 `main` uses. MEASURED, not guessed: the suite is 1.2-1.6x
+    # slower per file on the 2.x triple than on 1.x, and 60 was already thin on
+    # `main` (its last green run spent 50.3 min of its 60 inside vitest).
+    #
+    #   file                        main (1.x)   ledger-v9 (2.x)
+    #   security.test.ts (5)          1078.7 s        1373.4 s   1.27x
+    #   shielded-night.test.ts (8)     885.7 s        1101.2 s   1.24x
+    #   multiparty.test.ts (1)         471.8 s         753.9 s   1.60x
+    #   maintenance-authority (1)      153.8 s         153.8 s   1.00x  (fixed waits)
+    #   transient.test.ts (1)          249.8 s              --
+    #   combined.test.ts (1)           180.2 s              --
+    #
+    # The first run on this branch (33693462975) was PASSING every test and was
+    # killed by the 60-minute cap partway through transient.test.ts, having
+    # finished 15 of the 17 tests. Projected total here is ~66 min of test time,
+    # so 150 leaves room for the `retry: 2` tail without hiding a real hang.
+    timeout-minutes: 150
     steps:
       - uses: actions/checkout@v4
 

README.md

@@ -1,5 +1,23 @@
 # Shielded NIGHT
 
+> **You are on the `ledger-v9` branch — the Midnight 2.x line.**
+>
+> | Branch | Midnight line | Toolchain | Stack | Status |
+> |---|---|---|---|---|
+> | `main` | **1.x** (preview / preprod / mainnet) | compactc 0.31.1, language 0.23, compact-runtime 0.16.0, `@midnight-ntwrk/ledger-v8` 8.1.0, midnight-js 4.1.1 | node 1.0.0 / indexer-standalone 4.3.3 / proof-server 8.1.0 | what https://shielded-night.pages.dev runs |
+> | **`ledger-v9`** (here) | **2.x** | compactc **0.34.0**, language **0.26.0**, compact-runtime **0.19.0**, `@midnightntwrk/ledger-v9` 1.0.0-rc.3, midnight-js 5.0.0-beta.7 | node **2.0.0-rc.4** / indexer-standalone **4.4.0-rc.1** / proof-server **9.0.0-rc.5** | long-lived branch; **merged into `main` when the Midnight network moves to 2.x** |
+>
+> The two lines are kept separate on purpose: one dependency tree cannot hold both ledger
+> wasm modules (two copies give two class identities and every cross-copy `instanceof`
+> fails — the reason both `package.json`s carry an `overrides` block). Nothing in this
+> branch is deployed to a public network; it targets a local `undeployed` devnet and the
+> `midnight-2-offers` demo stack.
+>
+> **The contract source is unchanged apart from its `pragma language_version`, and all 33
+> ZK artifacts (11 circuits × prover/verifier/bzkir) are byte-identical to the `main`
+> build** — so the deployed preview contract's verifier keys remain valid; only the
+> generated TypeScript bindings differ.
+
 Convert native **unshielded NIGHT** into **shielded sNight** (a contract-minted wrapper token) and back, on Midnight.
 
 Live (preview): https://shielded-night.pages.dev
@@ -151,11 +169,11 @@ Anyone can check, without trusting us, that (1) the deployed contract is exactly
 
 ### 1. Reproduce the compiled artifacts byte-for-byte
 
-The compiler output is deterministic and the contract pins its language version (`pragma language_version 0.23`), so compiling [src/shielded-night.compact](src/shielded-night.compact) with the pinned toolchain reproduces [src/managed/](src/managed/) exactly:
+The compiler output is deterministic and the contract pins its language version (`pragma language_version 0.26` on this branch; `0.23` on `main`), so compiling [src/shielded-night.compact](src/shielded-night.compact) with the pinned toolchain reproduces [src/managed/](src/managed/) exactly:
 
 ```bash
 # Install the Compact toolchain (once): https://docs.midnight.network/relnotes/compact-tools
-compact update 0.31.1      # toolchain 0.31.1 = compactc 0.31.101, language 0.23.101
+compact update 0.34.0      # toolchain 0.34.0 = compactc 0.34.0, language 0.26.0, runtime 0.19.0, ledger 9
 
 bun install
 bun run compact            # recompiles src/shielded-night.compact -> src/managed/

TESTING.md

@@ -12,7 +12,7 @@ reference suites:
 
 - Node 22+ (vitest runs under Node; bun is the package manager)
 - `bun install`
-- The `compact` CLI (the scripts pin compiler `0.31.1`)
+- The `compact` CLI (this branch's scripts pin compiler `0.34.0`; `main` pins `0.31.1`)
 - Docker running (integration tier only)
 
 ## Unit tests
@@ -41,8 +41,9 @@ bun run test:integration
 ```
 
 `test/integration/global-setup.ts` boots the docker stack
-(`envs/docker-compose-dynamic.yml`: midnight-node 1.0.0, indexer-standalone
-4.3.3, proof-server 8.1.0) via testcontainers, then the suite deploys the
+(`envs/docker-compose-dynamic.yml`: on this `ledger-v9` branch midnight-node
+2.0.0-rc.4, indexer-standalone 4.4.0-rc.1, proof-server 9.0.0-rc.5 — the Midnight
+2.x triple; `main` runs 1.0.0 / 4.3.3 / 8.1.0) via testcontainers, then the suite deploys the
 contract with the genesis wallet and runs the full README round trip
 (depositUnshielded → withdrawShielded → depositShielded → withdrawUnshielded),
 the negative paths, and a two-wallet independence test.
@@ -197,8 +198,8 @@ locked (this guard was added by this suite; see git history).
 via `sendImmediateShielded` in the same transaction (a transient), so the
 wrapper supply is elastic both ways: minted on withdraw, burnt on deposit.
 [test/integration/shielded-night.transient.test.ts](test/integration/shielded-night.transient.test.ts)
-pins the fixed behavior on the current stack (toolchain 0.31.101 / ledger-v8
-8.1.0): the transaction applies, the credit equals the coin value, the **wallet
+pins the fixed behavior on the current stack (on `main`, toolchain 0.31.101 /
+ledger-v8 8.1.0; on `ledger-v9`, toolchain 0.34.0 / ledger-v9 1.0.0-rc.3): the transaction applies, the credit equals the coin value, the **wallet
 sees the coin as spent** (the historical bug left the spent UTXO listed as
 spendable, corrupting wallet state), and the credit withdraws again cleanly.