0.5.0-rc2: rebase ironwood onto 0.4.3 (CI only)

.github/workflows/ci.yml

@@ -105,3 +105,6 @@ jobs:
 
       - name: Check at MSRV
         run: cargo check --all-targets
+
+  # (The former dedicated `ironwood` clippy job is gone: ironwood is now compiled unconditionally,
+  # so the `test` job's `cargo clippy --all-targets -- -D warnings` above already covers it.)

.github/workflows/regtest.yml

@@ -19,6 +19,11 @@ name: Regtest E2E
 # notes and times multi-minute sends - so it is gated separately (ZECD_REGTEST_STRESS) and runs
 # ONLY on a monthly cron (1st of the month) or a manual dispatch with the `stress` box ticked.
 # It compiles on every run but skips in seconds otherwise.
+#
+# A separate `regtest-ironwood` job (schedule + manual dispatch, plus the
+# ironwood-on-transparent-fixes branch) builds zecd `--features ironwood` - against the official
+# zcash/librustzcash ironwood RC (no `nu6.3` cfg needed any more) - and runs the NU6.3 receive+send
+# e2e against the ironwood toolchain images - see that job's header.
 
 on:
   workflow_dispatch:
@@ -35,6 +40,18 @@ on:
         description: "Notes to build in the stress test (blank = default 256)"
         required: false
         default: ""
+      zebra-ironwood-image:
+        description: "Ironwood tier: NU6.3-capable zebrad image (default zfnd/zebra:6.0.0); blank = the job default"
+        required: false
+        default: ""
+      lwd-ironwood-image:
+        description: "Ironwood tier: V6-aware lightwalletd image; blank = the job default"
+        required: false
+        default: ""
+      devtool-ironwood-image:
+        description: "Ironwood tier: regtest-aware zcash-devtool image; blank = the job default"
+        required: false
+        default: ""
   schedule:
     # Weekly canary against zfnd/zebra:latest (Mondays 06:17 UTC; an off-peak odd minute).
     - cron: "17 6 * * 1"
@@ -200,11 +217,14 @@ jobs:
           ZECD_STDERR: "1"
           RUST_LOG: "zecd=info,zecd::wallet::actor=debug,zecd::chain=debug"
           # The extended tier (reorg, multiwallet, stop/restore, watch-only) runs on the weekly "big
-          # run" and on manual dispatches; PR/push runs let those tests skip in seconds.
+          # run" and on manual dispatches; all PR/push runs (incl. the ironwood dev branch) let those
+          # tests skip in seconds. The dev branch deliberately does NOT force extended: its reorg
+          # test is timing/finalization-boundary sensitive and flakes, which would redden the PR for
+          # reasons unrelated to the ironwood work and obscure that signal. (It still runs weekly.)
           ZECD_REGTEST_EXTENDED: ${{ (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && '1' || '' }}
           # The heavy note-scaling stress test runs ONLY on the monthly cron (the 1st-of-month
           # schedule) and on a manual dispatch that ticks `stress` - never on push/PR, and not on
-          # the weekly cron. Its note target is `stress-note-count` on dispatch (blank → default 256).
+          # the weekly cron. Its note target is `stress-note-count` on dispatch (blank -> default 256).
           ZECD_REGTEST_STRESS: ${{ (github.event.schedule == '33 7 1 * *' || (github.event_name == 'workflow_dispatch' && inputs.stress)) && '1' || '' }}
           ZECD_STRESS_NOTE_COUNT: ${{ inputs.stress-note-count }}
           # ZEBRAD_BIN / LIGHTWALLETD_BIN are exported by the provisioning step above.
@@ -221,3 +241,107 @@ jobs:
           df -h / "$RUNNER_TEMP" || true
           echo "== zebrad log (last 200 lines) =="
           tail -n 200 "$RUNNER_TEMP/zebrad.log" 2>/dev/null || echo "(no zebrad log was written)"
+
+  # Ironwood (NU6.3) tier. Builds zecd with the `ironwood` feature (no cfg - the librustzcash pin,
+  # zcash/librustzcash `dw/ironwood-scan-model`, exposes the ironwood wallet APIs unconditionally),
+  # and runs the gated regtest_ironwood receive e2e against the NU6.3 toolchain: the OFFICIAL zebra
+  # ironwood release (`zfnd/zebra:6.0.0`) plus a still-dev V6-aware lightwalletd and a regtest-aware
+  # zcash-devtool funder. It funds zecd post-NU6.3 (auto-routed to an ironwood output) and asserts
+  # zecd labels the received note `pool == "ironwood"`.
+  #
+  # zebra is now an official image, but lwd + devtool are still DEV images (emersonian/*) that may
+  # move or vanish, so this job runs ONLY on the weekly schedule and on manual dispatch - never on
+  # other branches' PRs, so a missing image can't redden PR CI. Bump the image refs in `env` below
+  # (or pass them as dispatch inputs) as the ironwood stack is rebuilt; keep the NU6.3 height (8) in
+  # lockstep with the harness' NU6_3_ACTIVATION_HEIGHT, zecd's network::regtest(), and devtool's
+  # regtest_params().
+  regtest-ironwood:
+    # schedule + manual dispatch, plus the ironwood integration line so ironwood-work PRs auto-run
+    # the NU6.3 e2e without a manual dispatch. `base_ref` matches any PR **into** `ironwood` (its
+    # merge target); `ref` matches a direct push to `ironwood`. Never on unrelated branches' PRs -
+    # the emersonian/* lwd/devtool images are dev artifacts and must not gate anyone else's CI. Drop
+    # this keying (run it everywhere) once ironwood merges to the mainline and those images ship.
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.base_ref == 'ironwood' || github.ref == 'refs/heads/ironwood' }}
+    runs-on: ubuntu-latest
+    name: regtest (ironwood / NU6.3)
+    env:
+      # zebrad is now the OFFICIAL ironwood-capable release on Docker Hub (`zfnd/zebra:6.0.0`),
+      # which is NU6.3-capable and accepts the `"NU6.3"` regtest activation-height key - so the dev
+      # `emersonian/zcash-zakura` image is retired. lwd + devtool stay pinned to dev images by
+      # @sha256 digest (their tags are mutable), both rebuilt against the official zebra RC's V6 wire
+      # format: lwd = `emersonian/zcash-lwd-ironwood:360a37d-zr8-nu63` (V6 parser for zebra 6.0.0);
+      # devtool = `emersonian/zcash-devtool:cac96846` (== ironwood-valar tip), built with
+      # `regtest_support` so its regtest `init` takes `--activation-heights`; sends+receives ironwood.
+      # A dispatch input can override any of them (e.g. with a `repo:tag`) when the stack is rebuilt;
+      # bump these as the images are rebuilt.
+      ZEBRAD_IRONWOOD_IMAGE: ${{ inputs.zebra-ironwood-image || 'zfnd/zebra:6.0.0' }}
+      LWD_IRONWOOD_IMAGE: ${{ inputs.lwd-ironwood-image || 'emersonian/zcash-lwd-ironwood@sha256:5f63b64ed788330ad8fe859fbbb334ceea844cf8a376318e7e25fbd3351b2f9f' }}
+      DEVTOOL_IRONWOOD_IMAGE: ${{ inputs.devtool-ironwood-image || 'emersonian/zcash-devtool@sha256:fd95d8b432f47d3eec6e5f1eca0bdfbb8daa094c28742d230bec3ac47957bd6c' }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install protobuf compiler
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler
+
+      - uses: dtolnay/rust-toolchain@stable
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: |
+            .
+            regtest-harness
+          # Separate cache key: this build carries the ironwood feature + nu6.3 cfg.
+          key: ironwood
+
+      # zecd compiles the ironwood scan/balance/pool/send paths unconditionally now (no cargo
+      # feature) - this is a plain release build. NU6.3 activation on the regtest chain is turned on
+      # for the zecd process below via the `ZECD_REGTEST_NU63_HEIGHT` env var (see the e2e step).
+      - name: Build zecd (release)
+        run: cargo build --release --bin zecd
+
+      # Extract zebrad + lightwalletd + the devtool funder from the ironwood toolchain images.
+      - name: Provision ironwood zebrad + lightwalletd + devtool from images
+        run: |
+          set -euo pipefail
+          mkdir -p "$RUNNER_TEMP/bin"
+          extract() {
+            img="$1"; name="$2"; out="$RUNNER_TEMP/bin/$name"
+            docker pull -q "$img"
+            cid=$(docker create "$img")
+            rel=$(docker export "$cid" | tar -tf - | grep -m1 -E "(^|/)${name}\$" || true)
+            if [ -z "$rel" ]; then echo "::error::could not locate $name in $img"; docker rm "$cid" >/dev/null; exit 1; fi
+            docker cp "$cid:/$rel" "$out"
+            docker rm "$cid" >/dev/null
+            chmod +x "$out"
+            echo "$name -> $out"; file -b "$out" || true
+          }
+          extract "$ZEBRAD_IRONWOOD_IMAGE" zebrad
+          extract "$LWD_IRONWOOD_IMAGE" lightwalletd
+          extract "$DEVTOOL_IRONWOOD_IMAGE" zcash-devtool
+          echo "ZEBRAD_BIN=$RUNNER_TEMP/bin/zebrad" >> "$GITHUB_ENV"
+          echo "LIGHTWALLETD_BIN=$RUNNER_TEMP/bin/lightwalletd" >> "$GITHUB_ENV"
+          echo "DEVTOOL_BIN=$RUNNER_TEMP/bin/zcash-devtool" >> "$GITHUB_ENV"
+
+      - name: Run ironwood (NU6.3) receive e2e
+        env:
+          ZECD_BIN: ${{ github.workspace }}/target/release/zecd
+          ZECD_REGTEST_IRONWOOD: "1"
+          # Activate NU6.3 at height 8 on the regtest chain for the zecd process (matches the zebra
+          # the ironwood harness configures). Ironwood is always compiled; this env var is what turns
+          # its activation on for regtest. The standard regtest tier leaves it unset (no NU6.3).
+          ZECD_REGTEST_NU63_HEIGHT: "8"
+          ZEBRAD_STDERR: ${{ runner.temp }}/zebrad.log
+          # Stream zecd's own logs into the run output (info level) so a failure is diagnosable
+          # without the debug flood that the receive/send bring-up needed.
+          ZECD_STDERR: "1"
+          RUST_LOG: "zecd=info"
+          # ZEBRAD_BIN / LIGHTWALLETD_BIN / DEVTOOL_BIN are exported by the provisioning step.
+        run: cargo test --locked --manifest-path regtest-harness/Cargo.toml --test regtest_ironwood --no-fail-fast -- --nocapture --test-threads=1
+
+      - name: Dump diagnostics on failure
+        if: failure()
+        run: |
+          echo "== disk =="
+          df -h / "$RUNNER_TEMP" || true
+          echo "== zebrad log (last 200 lines) =="
+          tail -n 200 "$RUNNER_TEMP/zebrad.log" 2>/dev/null || echo "(no zebrad log was written)"

CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to zecd are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com), and this
 project adheres to [Semantic Versioning](https://semver.org).
 
+## [0.5.0-rc2] - 2026-07-12
+
+### Changed
+- librustzcash is repointed from the interim zecrocks fork to the upstream zcash/librustzcash ironwood line; its fixes have landed upstream, so the fork is no longer needed.
+- Rebased onto 0.4.3, so the ironwood line now carries every 0.4.x maintenance fix through 0.4.3 (Sapling-output fused-path routing, the `/readyz` "synced" default with per-wallet `scan_lag`, and the host-local datadir-lock documentation).
+
+## [0.5.0-rc1] - 2026-07-09
+
+### Added
+- Ironwood (NU6.3 / V6) support: receive discovery, balance rollup, `pool == "ironwood"` labelling, and the Ironwood send and proof path, with an NU6.3 regtest end-to-end covering receive, send, and memo decryption. Compiled unconditionally and activated by consensus height - on for testnet, off for mainnet, opt-in on regtest - so no build flag is needed. Pins librustzcash to a working zecrocks fork, to be repointed to mainline before release.
+
 ## [0.4.3] - 2026-07-12
 
 ### Added
@@ -163,6 +174,8 @@ Zcash, backed entirely by librustzcash and running as a light client.
 ### Security
 - Pre-release audit hardening; refuse to start on mainnet with the placeholder RPC password; enforce a 12-character passphrase minimum.
 
+[0.5.0-rc2]: https://github.com/zecrocks/zecd/compare/v0.5.0-rc1...v0.5.0-rc2
+[0.5.0-rc1]: https://github.com/zecrocks/zecd/compare/v0.4.2...v0.5.0-rc1
 [0.4.3]: https://github.com/zecrocks/zecd/compare/v0.4.2...v0.4.3
 [0.4.2]: https://github.com/zecrocks/zecd/compare/v0.4.1...v0.4.2
 [0.4.1]: https://github.com/zecrocks/zecd/compare/v0.4.0...v0.4.1