chore: refresh pinned Chonk IVC inputs (fix nightly debug build)

[AztecBot]

Nightly Debug Build failure — root cause and fix

The Nightly Debug Build on next (7e94c2c) failed in bbapi_tests ChonkPinnedIvcInputsTest.AllPinnedFlows:

Assertion failed: (kernel_return_data_match)
Reason: kernel_return_data mismatch: proof contains
  { 0x18322739...e7ea4, 0x0 } but kernel_calldata commitment is { 0x1, 0x2 }
[  FAILED  ] ChonkPinnedIvcInputsTest.AllPinnedFlows

Root cause

The pinned Chonk IVC inputs (barretenberg/cpp/chonk-pinned-flows, pinned by barretenberg/cpp/scripts/chonk-inputs.hash = 209dde8e69a27c9f) are stale. The pin was last bumped on 2026-05-21 (2ab01bb56fa). Since then, 10 commits changed noir-projects/noir-protocol-circuits, several of them breaking protocol-circuit changes (e.g. feat!: add message signing and fallback keys #23510, feat!: shift remaining protocol-contract addresses to 1-3 #23218, feat!: demote auth registry to non-protocol contract #23106). These changed the kernel/app circuits and their VKs, so the recorded databus calldata in the pinned proofs no longer lines up with what the current circuits produce.

The run log confirms a wholesale VK drift — every selector/sigma reports Commitment mismatch and Does the precomputed vk match with the one generated during accumulation? false — followed by the fatal kernel_return_data_match assertion.

Why only the nightly debug build catches it

The consistency check in barretenberg/cpp/src/barretenberg/chonk/chonk.cpp is BB_ASSERT_DEBUG, so it is compiled out in release. Two guardrails that should catch drift do not:

• Release CI runs the same gtest with assertions disabled → passes.
• The per-PR chonk_inputs.sh check runs bb check with --disable_asserts in debug and only fails on a hard VK mismatch detected string → did not flag the drift, so it accumulated silently across ~500 commits.

The nightly debug build runs the gtest with assertions enabled, which is the only place this drift surfaces.

Fix

This PR carries the ci-refresh-chonk label, the documented mechanism (see barretenberg/cpp/CLAUDE.md). On this PR's CI, the chonk-input-update post-action runs barretenberg/cpp/scripts/ci_update_chonk_inputs.sh, which:

1. captures fresh IVC inputs from the current circuits,
2. uploads the new tarball and bumps barretenberg/cpp/scripts/chonk-inputs.hash,
3. verifies the refreshed inputs by re-running ChonkPinnedIvcInputsTest.AllPinnedFlows (native + bb.js),
4. pushes the updated hash onto this branch.

The committed source change is a comment on the test documenting that it is the canary for pinned-input drift, that it only fails in debug, and how to refresh — so the next person who hits this in nightly finds the fix immediately.

Verification

The refresh + the test re-run is performed by this PR's CI (it requires the build/capture infra and S3 artifact upload, so it cannot be reproduced in the investigation container). Do not merge until CI has pushed the regenerated chonk-inputs.hash and the green ChonkPinnedIvcInputsTest.AllPinnedFlows.

---

Created by claudebox · group: slackbot

[AztecBot]

Pinned Chonk inputs refreshed to 5192817c5292b2b6. The update commit includes a head-commit --ci-skip marker so the automatic follow-up run does not repeat CI.