From c1e552ff2819aebcf4ae36ed1528c3d4214776ee Mon Sep 17 00:00:00 2001
From: Jon Langevin <codingsloth@pm.me>
Date: Mon, 13 Jul 2026 12:59:04 -0400
Subject: [PATCH] fix(build): sync nested guest lockfiles

The locked real-guest release build rejected stale independent guest locks after changelog-core gained a dependency. Check every nested guest workspace in cached pull-request lint before expensive guest compilation.
---
 .github/workflows/lint-prototype.yml   | 23 +++++++++++++++++++++++
 ffproof/methods/guest/Cargo.lock       |  1 +
 ffproof/methods_bench/guest/Cargo.lock | 11 ++++++-----
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/lint-prototype.yml b/.github/workflows/lint-prototype.yml
index ecaf3bb..a7edaee 100644
--- a/.github/workflows/lint-prototype.yml
+++ b/.github/workflows/lint-prototype.yml
@@ -9,6 +9,8 @@ on:
       - '**/*.rs'
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+      - 'rust-toolchain*'
+      - '.cargo/**'
       - '.github/workflows/*.yml'
       - '.github/actions/**'
   pull_request:
@@ -17,6 +19,8 @@ on:
       - '**/*.rs'
       - '**/Cargo.toml'
       - '**/Cargo.lock'
+      - 'rust-toolchain*'
+      - '.cargo/**'
       - '.github/workflows/*.yml'
       - '.github/actions/**'
 
@@ -64,6 +68,25 @@ jobs:
         with:
           ssh-private-key: ${{ secrets.MERK_NOMIC_SSH_KEY }}
 
+      - name: Check nested guest lockfiles
+        shell: bash
+        run: |
+          set -euo pipefail
+          manifests_file="$(mktemp)"
+          trap 'rm -f "$manifests_file"' EXIT
+          find . \
+            -type d \( -name .git -o -name .worktrees -o -name node_modules -o -name target -o -name vendor \) -prune -o \
+            -type f -path '*/guest/Cargo.toml' -print0 | sort -z > "$manifests_file"
+          mapfile -d '' -t manifests < "$manifests_file"
+          if (( ${#manifests[@]} == 0 )); then
+            echo "No nested guest Cargo manifests found" >&2
+            exit 1
+          fi
+          for manifest in "${manifests[@]}"; do
+            cargo fetch --manifest-path "$manifest" --locked
+            cargo metadata --format-version 1 --manifest-path "$manifest" --frozen >/dev/null
+          done
+
       - name: Clippy (full workspace, all targets)
         run: cargo clippy --workspace --all-targets --locked -- -D warnings
 
diff --git a/ffproof/methods/guest/Cargo.lock b/ffproof/methods/guest/Cargo.lock
index ffd98cc..8f22085 100644
--- a/ffproof/methods/guest/Cargo.lock
+++ b/ffproof/methods/guest/Cargo.lock
@@ -933,6 +933,7 @@ dependencies = [
  "ffproof-tracer-shared",
  "hex",
  "instant",
+ "log",
  "merk",
  "postcard",
  "rand 0.9.2",
diff --git a/ffproof/methods_bench/guest/Cargo.lock b/ffproof/methods_bench/guest/Cargo.lock
index a0562a3..590f3ef 100644
--- a/ffproof/methods_bench/guest/Cargo.lock
+++ b/ffproof/methods_bench/guest/Cargo.lock
@@ -923,7 +923,7 @@ dependencies = [
 
 [[package]]
 name = "encrypted-spaces-acl-types"
-version = "0.0.1"
+version = "0.1.0"
 dependencies = [
  "pest",
  "pest_derive",
@@ -933,7 +933,7 @@ dependencies = [
 
 [[package]]
 name = "encrypted-spaces-changelog-core"
-version = "0.0.1"
+version = "0.1.0"
 dependencies = [
  "encrypted-spaces-acl-types",
  "encrypted-spaces-storage-encoding",
@@ -941,6 +941,7 @@ dependencies = [
  "ffproof-tracer-shared",
  "hex",
  "instant",
+ "log",
  "merk",
  "postcard",
  "rand 0.9.4",
@@ -963,7 +964,7 @@ dependencies = [
 
 [[package]]
 name = "encrypted-spaces-storage-encoding"
-version = "0.0.1"
+version = "0.1.0"
 dependencies = [
  "postcard",
  "serde",
@@ -1015,7 +1016,7 @@ checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 
 [[package]]
 name = "ffproof-tracer"
-version = "0.0.1"
+version = "0.1.0"
 dependencies = [
  "clap",
  "ffproof-tracer-methods",
@@ -1030,7 +1031,7 @@ dependencies = [
 
 [[package]]
 name = "ffproof-tracer-methods"
-version = "0.0.1"
+version = "0.1.0"
 dependencies = [
  "risc0-build",
 ]