build(zisk): bump Zisk to 1.1.0-alpha

[maximmenshikov]

Update the guest build image to nethermindeth/zisk:1.1.0-alpha and raise Nethermind.ZiskOS.Runtime to 1.0.0-preview.7 so the managed runtime matches the new zkVM ABI.

Changes

• Bump Zisk to 1.1.0-alpha

Types of changes

What types of changes does your code introduce?

• Bugfix (a non-breaking change that fixes an issue)
• New feature (a non-breaking change that adds functionality)
• Breaking change (a change that causes existing functionality not to work as expected)
• Optimization
• Refactoring
• Documentation update
• Build-related changes
• Other: Description

Testing

Requires testing

• Yes
• No

If yes, did you write tests?

• Yes
• No

Documentation

Requires documentation update

• Yes
• No

Requires explanation in Release Notes

• Yes
• No

[claude]

Claude finished @maximmenshikov's task in 2m 45s —— View job

---

Code review: ZisK toolchain bump to 1.1.0-alpha

• Gather context (diff, changed files)
• Inspect ZisK guest build wiring (Makefile, csproj, Program.cs, workflows)
• Verify version/digest consistency across the repo
• Check CI status for this branch
• Post review

Verdict: no Critical / High / Medium findings. This is a clean, minimal two-line toolchain bump. The blast radius is genuinely confined to the ZisK guest, and I verified that rather than assuming it.

What I checked

Check	Result
Other references to the old zisk image tag / preview.4	None — Directory.Packages.props:71 and Makefile:10 are the only pins
Consumers of Nethermind.ZiskOS.Runtime	Only Nethermind.Stateless.ZiskGuest.csproj:11; nothing in the node build path
Emulator version pinned in CI separately	No — both stateless-tests.yml and stateless-glamsterdam-devnet-tests.yml invoke make build / make run, so ZISK_IMAGE is the single source of truth
Nix lock (nix/nuget-deps.json)	Contains no ZisK/Zkvm packages, so no regeneration needed
Nethermind.Runner/packages.lock.json	No ZisK entries — untouched
Guest source changes needed	None expected: Program.cs talks only to IO from Nethermind.Zkvm.Abstractions (still preview.2), so the runtime swap is behind that abstraction
Digest pinning	tag@sha256:… — Docker resolves by digest, so a mismatched pairing fails loudly at pull rather than silently running the wrong image

Also worth noting: CentralPackageTransitivePinningEnabled is on, so if ZiskOS.Runtime preview.7 now requires a newer Nethermind.Zkvm.Abstractions than the pinned preview.2, restore fails with a downgrade error instead of resolving quietly. That's a good failure mode here — it means "restore succeeded" is real evidence the two packages still agree.

Low-severity notes

1. Merge should gate on the Stateless execution tests job, not just the generic build. No tests were added (correctly — there's nothing unit-testable in an image bump), so that workflow is the only validation of the new zkVM. It matters more than usual because .github/workflows/stateless-tests.yml:99-101 greps for the expected state root plus a hardcoded trailing suffix (0125000000010000…) — i.e. the exact output-encoding bytes. Any change to output framing in 1.1.0 shows up there as a mismatch across all 9 block inputs. At the time of this review that job was still in_progress; everything already completed is green (Dependency review, Code formatting, Gas benchmarks).
2. Input-framing docs may have drifted. README.md:38-46 documents the len: u64le | bytes[len] | zero-padding framing as "starting from Zisk v0.16.0" and points at --legacy-inputs for the old behaviour. With the toolchain now on the 1.x line, it's worth confirming --legacy-inputs still exists; if 1.1.0 dropped it, that last line is stale. Docs-only, no functional impact.
3. Runtime skips two previews (preview.4 → preview.7) and BFLAT_IMAGE is unchanged — raised inline on Makefile:10 with the reasoning for why the unchanged bflat pin is probably correct.

Not verified

I could not confirm that sha256:ded53e7e… is actually the digest currently behind nethermindeth/zisk:1.1.0-alpha, nor run dotnet restore to confirm preview.7 resolves — registry/NuGet network calls and dotnet were outside my allowed tools in this environment. Both are self-verifying in CI (digest mismatch fails the pull; a bad version fails restore), so this is a note on my evidence, not a gap in the change.

Recommendation: approve and merge once Stateless execution tests is green.
· branch feature/zisk-1.1.0-alpha

[github-actions]

EVM Opcode Benchmark Diff

Aggregated runs: base=3, pr=3
Noisy rerun opcodes: SGT

Regressions (1)

Opcode	Base Median (ns)	PR Median (ns)	Delta	Abs Δ (ns)	Base CV	PR CV	Threshold	Uncertainty	Effective
DIV	321.180	354.610	+10.41%	33.430	1.9%	1.4%	±5.0%	±2.3%	±5.0%

Improvements (1)

Opcode	Base Median (ns)	PR Median (ns)	Delta	Abs Δ (ns)	Base CV	PR CV	Threshold	Uncertainty	Effective
MULMOD	895.510	178.930	-80.02%	716.580	1.9%	1.5%	±5.0%	±1.5%	±5.0%

[claude]

Claude finished @maximmenshikov's task in 2m 27s —— View job

---

Re-review: ZisK toolchain bump to 1.1.0-alpha

• Re-diff against master (scope changed since my last review)
• Resolve the outstanding Stateless execution tests gate
• Triage the one red check
• Close out the prior Low findings
• Check for stale version references

Verdict: no Critical / High / Medium findings. Mergeable.

The one open item from my 23:42Z review — "approve and merge once Stateless execution tests is green" — is now resolved, and the scope grew slightly in a way that closes another finding.

What changed since my last review

Commit 82a4d17 also bumps BFLAT_IMAGE (b255bce5 → acee0ec1), which is exactly Low #1 from my inline comment. So the diff is now 3 lines: guest compiler image, emulator image, and managed runtime, all moved together. That's the right grouping — those three are a single ABI triple, and bumping the emulator without the compiler is what would have been risky.

Stateless execution tests: green, and it's real evidence

Run 32345730930 — Build plus all 9 input jobs plus Status all success. This matters more than a typical green check because of how the assertion is written (.github/workflows/stateless-tests.yml:99-101):

suffix=012500000001000000000000000c00000004000000080000000800000057b05d6900000000
grep -q "${{ matrix.output }}$suffix" "$RUNNER_TEMP/run.log"

It greps for the expected state root plus a hardcoded trailing output-framing byte string. Nine passes against that literal establishes concretely that:

Property	Evidence
New bflat image produces a working riscv64 guest	Build job succeeded with unchanged ISA_GATES (--error-on-float/-binary/-compressed/-atomic, Makefile:13)
ziskemu 1.1.0-alpha executes that guest	9/9 run jobs succeeded
Output encoding is byte-identical to 1.0.0	the hardcoded suffix still matches — any framing change in 1.1.0 would fail all 9
preview.7 runtime is ABI-compatible with the pinned Zkvm.Abstractions preview.2	restore + build succeeded under CentralPackageTransitivePinningEnabled (a required-upgrade would be a hard downgrade error, not a silent resolve)
Input framing (len: u64le | bytes | pad) unchanged	inputs are fetched from the fixed 20260714 bucket with sha256 verification and parsed fine

Both my earlier "not verified" caveats are now settled by CI rather than by inspection: the digest resolved (the pull would fail on a mismatched tag@sha256 pairing) and preview.7 restored.

The one red check is unrelated

Sync PR Gate (Hoodi) (32345730934) fails in both Flat and HalfPath, but the failure is entirely in the Install Sedge step — a Go build failure in a third-party module:

cockroachdb/swiss@v0.0.0-20251224182025/map.go:286:7: undefined: hashFn
...map.go:338:22: undefined: fastrand64
make: *** [Makefile:78: install-abigen] Error 1

That dependency reaches into unexported Go runtime internals and broke against the runner's Go toolchain. Nethermind never started — the cascading No such container: sedge-consensus-client and Input required and not supplied: path errors are just the cleanup steps failing on a stack that never came up. Not caused by this PR (a zisk guest bump cannot affect Hoodi sync), and it will hit any PR on this runner image until the Sedge dependency or Go pin is fixed. Worth a separate issue, not a blocker here.

Remaining Low (1)

README.md:46 — --legacy-inputs mention may be stale. The doc says "For the old behavior, use the --legacy-inputs option." Now that the toolchain is on the 1.x line, that flag may no longer exist. I still can't verify it (no registry access), but it's lower-stakes than I implied last time: Makefile:71 invokes ziskemu -e ... -i ... and never passes --inputs or --legacy-inputs, so the flag is purely informational and nothing in the build or CI path depends on it. Docs-only, safe to leave for a follow-up.

Fix this →

Closed since last review

• Merge should gate on Stateless execution tests — green, 9/9.
• BFLAT_IMAGE left unbumped — bumped in 82a4d17.
• Input-framing docs may have drifted — the framing described at README.md:38-44 is confirmed still correct by the passing runs; only the --legacy-inputs line remains unverified.

Other checks

• No stale references anywhere: Directory.Packages.props:71 and Makefile:9-10 are the only pins; nothing still points at preview.4, 1.0.0-alpha, or bflat b255bce5.
• BFLAT_REFS is unchanged, so the ArrayPool exemption in .agents/rules/robustness.md that keys off that list needs no update.
• No tests added, correctly — there is nothing unit-testable in an image/package pin, and the stateless workflow is the appropriate integration gate. The PR's "requires testing: yes / wrote tests: no" combination is honest here.
• Code formatting, Spell check, Code Lint, Build solutions, Nix, Trivy, Integration tests (E2E), Nethermind tests (Flat DB), extra test variants: all green. Nethermind/Ethereum tests still in progress at time of writing.

Recommendation: approve and merge. The Hoodi sync red is pre-existing infra and should not gate this.
· branch feature/zisk-1.1.0-alpha