Bump stwo-circuits.

[ilyalesokhin-starkware]

Bump stwo-circuits, stwo-cairo and stwo.
Adapt to the new cairo-circuit verifier API.

Upstream API changes:

• verify_fixed_cairo_circuit / build_and_fill_cairo_verifier_circuit now take the
  program output as a single Blake2sHash (the raw 256-bit Blake2s digest) instead of
  a Vec of felt-limb output cells.
• CairoVerifierConfig dropped its n_outputs field; the output count is now fixed at
  N_OUTPUTS = 2 in the dependency.
• AUX_DATA_FIXED_LEN now includes the output cells, so the proof-byte split no longer
  adds NUM_OUTPUTS separately.
• The verifier circuit now emits the program's Blake2s digest words directly as its
  public output (stwo-circuits #649) instead of re-hashing the output cells.

Privacy bootloader:

• Replace the compiled privacy_simple_bootloader with the version that emits its
  output as the raw 256-bit digest across two 128-bit memory cells, matching the new
  N_OUTPUTS = 2 layout.

proving-utils adaptations:

• privacy_circuit_verify: add compute_privacy_bootloader_output_hash (the raw digest);
  verify_cairo passes the Blake2sHash and drops the double-counted NUM_OUTPUTS from the
  proof-byte split; verify_recursive_circuit derives output_values from
  HashValue::::from(digest), the digest words the circuit now outputs.
• leaf_prover / privacy_prove / circuit_params: adapt to the Blake2sHash argument and
  the removed n_outputs field.
• leaf_prover test fixture: change use_all_opcodes_and_builtins.cairo to emit 2 output
  cells (n_output 50 -> 2) so the program matches the new N_OUTPUTS = 2 output contract;
  recompile it (--proof_mode --no_debug_info) and regenerate expected_output.json.
• Update PRIVACY_RECURSION_CIRCUIT_PREPROCESSED_ROOT, CAIRO_PROOF_UNCOMPRESSED_BYTES,
  and the bootloader program-hash snapshot for the new bootloader/deps.
• Rework test_privacy_simple_bootloader_output_hash to compare the two output cells
  against the raw Blake2s digest halves directly (no felt packing).

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

---

This change is 

[cursor]

PR Summary

High Risk
Touches Cairo/STARK proof verification, bootloader public outputs, and fixed circuit constants—any mismatch breaks proof acceptance across leaf and privacy flows.

Overview
Pins stwo, stwo-cairo (82f21252), and stwo-circuits (7bbff4c9) in the workspace and lockfile, including the transitive stwo → hashbrown 0.15.5 shift.

Adapts proving-utils to the new Cairo circuit verifier contract: program output is a single Blake2sHash (not felt-limb cells), CairoVerifierConfig no longer carries n_outputs (fixed N_OUTPUTS = 2 upstream), and proof-byte splitting uses AUX_DATA_FIXED_LEN without an extra output offset. Leaf proving, privacy prove/verify, and circuit_params pass the digest into build_and_fill_cairo_verifier_circuit / verify_fixed_cairo_circuit; recursive verification maps digest words via HashValue::<QM31>::from.

Privacy bootloader and tests: refreshed compiled bootloader; compute_privacy_bootloader_output_hash; integration test expects two 128-bit digest halves ( blake2 dev-dep in cairo-program-runner-lib ); leaf fixture/output expectations and snapshot constants updated for the new layout.

^{Reviewed by Cursor Bugbot for commit a47979c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[ilyalesokhin-starkware]

crates/privacy_prove/src/tests.rs line 19 at r1 (raw file):

    // md5sum: "0494f41365e482142d04b58bd64aa5fe"
    // Compiled by command:
    // `bazel build --config=rbe

Not sure what to do here.
This builds the bootloader with debug_info. But I don't think we want to keep all the debug info in the git.
Also, it is not clear what the MD5sum refers to.

Code quote:

    // Source code for this compiled privacy bootloader can be found at:
    // repo: https://github.com/starkware-industries/starkware
    // branch: "dev"
    // commit: "4d1ae5848dd49802ddd620601d2d1bb303d15c66"
    // md5sum: "0494f41365e482142d04b58bd64aa5fe"
    // Compiled by command:
    // `bazel build --config=rbe
    // //src/starkware/cairo/bootloaders/simple_bootloader:privacy_simple_bootloader_program`

[leo-starkware]

@leo-starkware reviewed 6 files and made 1 comment.
Reviewable status: 6 of 13 files reviewed, 2 unresolved discussions (waiting on ilyalesokhin-starkware).

---

crates/cairo-program-runner-lib/src/hints/privacy_simple_bootloader_hints.rs line 258 at r2 (raw file):

        // output cells: the low half followed by the high half. Recompute the digest directly
        // (the same felt encoding the Cairo hash uses, then a plain Blake2s-256) and compare each
        // half, avoiding the lossy `blake2s_to_felt` packing.

what's the reason that the hash is now split into 2? To avoid the reduction from 256 bits to a single 252bit felt?

Code quote:

        // The bootloader emits the raw 256-bit Blake2s digest of the preimage as two 128-bit
        // output cells: the low half followed by the high half. Recompute the digest directly
        // (the same felt encoding the Cairo hash uses, then a plain Blake2s-256) and compare each
        // half, avoiding the lossy `blake2s_to_felt` packing.

[leo-starkware]

@leo-starkware made 1 comment.
Reviewable status: 6 of 13 files reviewed, 3 unresolved discussions (waiting on ilyalesokhin-starkware).

---

crates/circuit_params/src/main.rs line 110 at r2 (raw file):

    );

    // Program length is held fixed for this measurement; only the trace size varies. The

what's the measurement?

Code quote:

for this measurement

[ilyalesokhin-starkware]

crates/cairo-program-runner-lib/src/hints/privacy_simple_bootloader_hints.rs line 258 at r2 (raw file):

Previously, leo-starkware wrote…

what's the reason that the hash is now split into 2? To avoid the reduction from 256 bits to a single 252bit felt?

yes

[leo-starkware]

@leo-starkware made 3 comments.
Reviewable status: 6 of 16 files reviewed, 5 unresolved discussions (waiting on ilyalesokhin-starkware).

---

crates/privacy_prove/src/tests.rs line 19 at r1 (raw file):

Previously, ilyalesokhin-starkware wrote…

Not sure what to do here.
This builds the bootloader with debug_info. But I don't think we want to keep all the debug info in the git.
Also, it is not clear what the MD5sum refers to.

I think how you did in the latest revision is fine. Now there no --config=rbe: what was that?

---

crates/leaf_prover/src/prove_leaf.rs line 89 at r2 (raw file):

        n_outputs, N_OUTPUTS,
        "The cairo-circuit verifier expects exactly {N_OUTPUTS} output cells (a Blake2s digest \
         split into 128-bit halves), but the program produced {n_outputs}."

cairo-circuit should be circuit-cairo i think (or better, "cairo-verifier circuit" as you do below). Also: does this mean that the cairo-verifier circuit always expects a hash (2 128halves) as output?

Code quote:

        "The cairo-circuit verifier expects exactly {N_OUTPUTS} output cells (a Blake2s digest \
         split into 128-bit halves), but the program produced {n_outputs}."

---

crates/privacy_circuit_verify/src/lib.rs line 195 at r2 (raw file):

/// [`Blake2Felt252::encode_felt252_data_and_calc_blake_hash`]) and stores the raw 256-bit digest
/// across its output cells. This returns that digest directly (before any packing/reduction into
/// a felt), which is the `output_hash` the cairo-circuit verifier expects.

cairo-verifier circuit

Code quote:

cairo-circuit verifier

[leo-starkware]

@leo-starkware resolved 1 discussion.
Reviewable status: 6 of 16 files reviewed, 4 unresolved discussions (waiting on ilyalesokhin-starkware).

[ilyalesokhin-starkware]

crates/leaf_prover/src/prove_leaf.rs line 89 at r2 (raw file):

Previously, leo-starkware wrote…

cairo-circuit should be circuit-cairo i think (or better, "cairo-verifier circuit" as you do below). Also: does this mean that the cairo-verifier circuit always expects a hash (2 128halves) as output?

Fixed, and yes, the cairo-verifier always expects a hash.

[ilyalesokhin-starkware]

crates/privacy_circuit_verify/src/lib.rs line 195 at r2 (raw file):

Previously, leo-starkware wrote…

cairo-verifier circuit

Done.

[ilyalesokhin-starkware]

crates/privacy_prove/src/tests.rs line 19 at r1 (raw file):

Previously, leo-starkware wrote…

I think how you did in the latest revision is fine. Now there no --config=rbe: what was that?

it does some of the building on a remote machine, I don't think it is needed.

[ilyalesokhin-starkware]

crates/circuit_params/src/main.rs line 110 at r2 (raw file):

Previously, leo-starkware wrote…

what's the measurement?

removed.

[ilyalesokhin-starkware]

@ilyalesokhin-starkware resolved 1 discussion.
Reviewable status: 6 of 16 files reviewed, 2 unresolved discussions (waiting on leo-starkware).

[leo-starkware]

@leo-starkware reviewed 10 files and all commit messages, made 1 comment, and resolved 2 discussions.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on ilyalesokhin-starkware).

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.86%. Comparing base (705ad6a) to head (a47979c).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #408      +/-   ##
==========================================
+ Coverage   67.85%   67.86%   +0.01%     
==========================================
  Files          42       42              
  Lines        5456     5459       +3     
==========================================
+ Hits         3702     3705       +3     
  Misses       1754     1754              

Files with missing lines	Coverage Δ
...r-lib/src/hints/privacy_simple_bootloader_hints.rs	95.48% <100.00%> (+0.11%)	⬆️
crates/circuit_params/src/main.rs	98.24% <100.00%> (-0.08%)	⬇️
crates/leaf_prover/src/prove_leaf.rs	97.19% <100.00%> (+0.13%)	⬆️
crates/privacy_circuit_verify/src/lib.rs	98.61% <100.00%> (-0.01%)	⬇️
crates/privacy_prove/src/lib.rs	97.51% <100.00%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.