Validate Taproot primitives against pinned Bitcoin Core

.github/workflows/knowledge.yml

@@ -1,4 +1,4 @@
-name: Knowledge base
+name: Research validation
 
 on:
   push:
@@ -7,15 +7,86 @@ on:
 permissions:
   contents: read
 
+env:
+  # Optimize the host interpreter while retaining debug assertions and overflow
+  # checks. Generated Script bytecode still follows the repository policy.
+  CARGO_PROFILE_DEV_OPT_LEVEL: 1
+  CARGO_PROFILE_TEST_OPT_LEVEL: 1
+
 jobs:
   validate:
+    name: Knowledge, Python, and formatting
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
         with:
           toolchain: 1.98.0
+          # Preserve Cargo warning behavior; the setup action defaults to -D warnings.
+          rustflags: ""
+          components: rustfmt
+          cache: false
+      - name: Check Rust formatting
+        run: cargo fmt --all -- --check
       - name: Validate knowledge schema and links
         run: python3 tools/kb.py validate
-      - name: Run locked test suite
-        run: cargo test --locked
+      - name: Test knowledge and Core harnesses
+        run: python3 -m unittest discover -s tools -p 'test_*.py'
+
+  test:
+    name: Locked non-field Rust tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        with:
+          toolchain: 1.98.0
+          # Preserve Cargo warning behavior; the setup action defaults to -D warnings.
+          rustflags: ""
+          # The action also keys its Rust cache on the toolchain and Cargo.lock.
+          cache-key: nonfield-opt1
+      - name: Run locked tests without field arithmetic
+        run: cargo test --locked -- --skip 'fields::'
+
+  core:
+    name: Pinned Bitcoin Core comparisons
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
+        with:
+          toolchain: 1.98.0
+          # Preserve Cargo warning behavior; the setup action defaults to -D warnings.
+          rustflags: ""
+          cache-key: core-opt1
+      - name: Cache pinned Core release archive
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          # Each runner verifies the archive hash before extracting bitcoind.
+          path: target/core-regtest/*.tar.gz
+          key: bitcoin-core-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('tools/bitcoin_core_release.json') }}
+      - name: Test fixture determinism and local execution contracts
+        run: cargo test --locked --example core_validation_fixtures --example tapscript_signature_fixtures --example prince_validation_fixtures
+      - name: Compare Tapscript resource and policy profiles
+        run: python3 tools/core_regtest.py --download-core --output target/ci-reports/core-profiles.json
+      - name: Compare transaction-aware signature behavior
+        run: python3 tools/tapscript_signature_regtest.py --download-core --output target/ci-reports/tapscript-signatures.json
+      - name: Validate checked PRINCEv2 spends
+        run: python3 tools/prince_regtest.py --download-core --output target/ci-reports/prince.json
+      - name: Upload Core comparison reports
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: bitcoin-core-comparisons
+          path: target/ci-reports/*.json
+          if-no-files-found: warn
+          retention-days: 14

.gitignore

@@ -1,2 +1,3 @@
 /target/
 .DS_Store
+__pycache__/

Cargo.toml

@@ -25,6 +25,12 @@ serde_json = "1.0"
 rand_chacha = "0.3.1"
 sha2 = "0.10"
 
+# Apply the same repaired interpreter to this crate and bitcoin-script-stack.
+# Temporary immutable integration of resource and signature repairs; see
+# src/support/README.md for provenance and the criterion to return upstream.
+[patch."https://github.com/BitVM/rust-bitcoin-scriptexec"]
+bitcoin-scriptexec = { git = "https://github.com/adrienlacombe/rust-bitcoin-scriptexec", rev = "702544c9a045ac4fc14846da6da6559e2b7cd9d1" }
+
 [[bench]]
 name = "winternitz"
 harness = false