Correct the proving-capability abstraction for usage with triton-vm Proof (as opposed to TransactionProof)

src/api/tx_initiation/builder/transaction_proof_builder.rs

@@ -43,6 +43,8 @@ use crate::triton_vm::proof::Claim;
 use crate::triton_vm::vm::NonDeterminism;
 use crate::triton_vm_job_queue::vm_job_queue;
 use crate::triton_vm_job_queue::TritonVmJobQueue;
+use crate::util_types::log_vm_state;
+use crate::util_types::log_vm_state::LogProofInputsType;
 
 /// a builder for [TransactionProof]
 ///
@@ -344,8 +346,16 @@ async fn gen_single<'a, F>(
     valid_mock: bool,
 ) -> Result<TransactionProof, CreateProofError>
 where
-    F: FnOnce() -> NonDeterminism + Send + Sync + 'a,
+    F: Clone + FnOnce() -> NonDeterminism + Send + Sync + 'a,
 {
+    // log proof inputs if matching env var is set. (does not expose witness secrets)
+    // maybe_write() logs warning if error occurs; we ignore any error.
+    let _ = log_vm_state::maybe_write(
+        LogProofInputsType::NoWitness,
+        &claim,
+        nondeterminism.clone(),
+    );
+
     Ok(TransactionProof::SingleProof(
         ProofBuilder::new()
             .program(SingleProof.program())

src/models/proof_abstractions/tasm/prover_job.rs

@@ -28,6 +28,8 @@ use crate::models::proof_abstractions::NonDeterminism;
 use crate::models::proof_abstractions::Program;
 use crate::models::state::vm_proving_capability::VmProvingCapability;
 use crate::models::state::vm_proving_capability::VmProvingCapabilityError;
+use crate::util_types::log_vm_state;
+use crate::util_types::log_vm_state::LogProofInputsType;
 
 /// represents an error running a [ProverJob]
 #[derive(Debug, thiserror::Error)]
@@ -174,6 +176,12 @@ impl ProverJob {
     /// If we are in a test environment, try reading it from disk. If it is not
     /// there, generate it and store it to disk.
     async fn prove(&self, rx: JobCancelReceiver) -> JobCompletion {
+        // log proof inputs if matching env var is set (may expose witness secrets)
+        // maybe_write() logs warning if error occurs; we ignore any error.
+        let _ = log_vm_state::maybe_write(LogProofInputsType::Proof, &self.claim, || {
+            self.nondeterminism.clone()
+        });
+
         // produce mock proofs if network so requires. (ie RegTest)
         if self.job_settings.network.use_mock_proof() {
             let proof = Proof::valid_mock(self.claim.clone());

src/models/state/vm_proving_capability.rs

@@ -1,6 +1,4 @@
 use std::fmt::Display;
-use std::io::Write;
-use std::path::PathBuf;
 use std::str::FromStr;
 
 use num_traits::Zero;
@@ -172,7 +170,6 @@ impl VmProvingCapability {
         debug_assert_eq!(program.hash(), claim.program_digest);
 
         let mut vmstate = VMState::new(program, claim.input.into(), nondeterminism);
-        let _ = Self::maybe_write_debuggable_vm_state_to_disk(&vmstate);
 
         let method = std::env::var("NEPTUNE_LOG2_PADDED_HEIGHT_METHOD")
             .unwrap_or_else(|_| "run".to_string());
@@ -202,37 +199,6 @@ impl VmProvingCapability {
         }
     }
 
-    /// If the environment variable NEPTUNE_WRITE_VM_STATE_DIR is set,
-    /// write the initial VM state to file `<DIR>/vm_state.<pid>.<random>.json`.
-    ///
-    /// This file can be used to debug the program using the [Triton TUI]:
-    /// ```sh
-    /// triton-tui --initial-state <file>
-    /// ```
-    ///
-    /// [Triton TUI]: https://crates.io/crates/triton-tui
-    pub fn maybe_write_debuggable_vm_state_to_disk(
-        vm_state: &VMState,
-    ) -> Result<Option<PathBuf>, LogVmStateError> {
-        let Ok(dir) = std::env::var("NEPTUNE_WRITE_VM_STATE_DIR") else {
-            return Ok(None);
-        };
-
-        let filename = format!(
-            "vm_state.{}.{}.json",
-            std::process::id(),
-            rand::random::<u32>()
-        );
-
-        let path = PathBuf::from(dir).join(filename);
-
-        let mut state_file =
-            std::fs::File::create(&path).map_err(|e| LogVmStateError::from((path.clone(), e)))?;
-        let state = serde_json::to_string(&vm_state)?;
-        write!(state_file, "{}", state).map_err(|e| LogVmStateError::from((path.clone(), e)))?;
-        Ok(Some(path))
-    }
-
     /// automatically detect the log2_padded_height for this device.
     ///
     /// for now this just:
@@ -313,24 +279,3 @@ pub enum VmProvingCapabilityError {
     #[error("device capability {capability} is insufficient to generate proof that requires capability {attempted}")]
     DeviceNotCapable { capability: u32, attempted: u32 },
 }
-
-#[derive(Debug, thiserror::Error, strum::EnumIs)]
-#[non_exhaustive]
-pub enum LogVmStateError {
-    #[error("could not obtain padded-height due to program execution error")]
-    IoError {
-        path: PathBuf,
-        #[source]
-        source: std::io::Error,
-    },
-
-    #[error(transparent)]
-    SerializeError(#[from] serde_json::Error),
-}
-
-impl From<(PathBuf, std::io::Error)> for LogVmStateError {
-    fn from(v: (PathBuf, std::io::Error)) -> Self {
-        let (path, source) = v;
-        Self::IoError { path, source }
-    }
-}

src/util_types/log_vm_state.rs

@@ -0,0 +1,145 @@
+use std::io::Write;
+use std::path::PathBuf;
+
+use crate::models::blockchain::shared::Hash as NeptuneHash;
+use crate::models::blockchain::transaction::validity::single_proof::SingleProof;
+use crate::models::proof_abstractions::tasm::program::ConsensusProgram;
+use crate::triton_vm::proof::Claim;
+use crate::triton_vm::vm::NonDeterminism;
+use crate::triton_vm::vm::VMState;
+
+/// enumerates types of proofs that can be logged.
+///
+/// this type facilitates offering distinct logging modes for:
+///
+/// 1. `Proof` (any kind of Proof)
+/// 2. `NoWitness`
+///
+/// The `Proof` mode is useful for logging inputs to every single Proof that is
+/// generated.  These include proofs generated from `PrimitiveWitness` meaning
+/// that the claims expose secrets and should not be shared. This mode of
+/// logging is considered a security risk, but can be useful for investigating
+/// or researching alone, or on testnet(s), etc.
+///
+/// The `NoWitness` mode is useful when logging proof inputs for purposes of
+/// sharing with others, eg neptune-core developers for debugging.  However it
+/// does not log any Proofs generated from a `PrimitiveWitness`.
+pub enum LogProofInputsType {
+    /// log any inputs of any kind of proof, possibly leaking witness secrets
+    Proof,
+
+    /// log inputs of proof, without leaking witness secrets
+    NoWitness,
+}
+
+impl LogProofInputsType {
+    /// returns name of logging environment variable
+    ///
+    /// each variant has an environment variable that specifies the
+    /// directory in which to write proof files.
+    pub const fn env_var_name(&self) -> &str {
+        match *self {
+            Self::Proof => "NEPTUNE_VM_STATE_DIR",
+            Self::NoWitness => "NEPTUNE_VM_STATE_NO_WITNESS_DIR",
+        }
+    }
+
+    /// returns file name prefix
+    pub const fn file_prefix(&self) -> &str {
+        match *self {
+            Self::Proof => "vm_state.claim",
+            Self::NoWitness => "vm_state.no_witness_claim",
+        }
+    }
+}
+
+/// If the environment variable specified by [LogProofInputsType::env_var_name()] is set,
+/// write the initial VM state to file `<DIR>/<prefix>.<pid>.<claim>.json`.
+///
+/// where:
+///  DIR = value of environment variable.
+///  prefix = LogProofInputsType::file_prefix()
+///  pid = process-id
+///  claim = hex-encoded hash of input Claim
+///
+/// This file can be used to debug the program using the [Triton TUI]:
+/// ```sh
+/// triton-tui --initial-state <file>
+/// ```
+///
+/// [Triton TUI]: https://crates.io/crates/triton-tui
+///
+/// Security:
+///
+/// Files of type [LogProofInputsType::Proof] should only be used for debugging
+/// by the wallet owner as they may contain wallet secrets.
+///
+/// Files of type [LogProofInputsType::NoWitness] can be shared with others
+/// eg, neptune-core developers, for purposes of debugging/assistance.
+///
+/// It is the *callers* responsibility to ensure that the provided claim matches
+/// the `log_proof_inputs_type`
+pub fn maybe_write<'a, F>(
+    log_proof_inputs_type: LogProofInputsType,
+    claim: &Claim,
+    nondeterminism: F,
+) -> Result<Option<PathBuf>, LogVmStateError>
+where
+    F: FnOnce() -> NonDeterminism + Send + Sync + 'a,
+{
+    let Ok(dir) = std::env::var(log_proof_inputs_type.env_var_name()) else {
+        return Ok(None);
+    };
+    let prefix = log_proof_inputs_type.file_prefix();
+
+    write(&dir, prefix, claim, nondeterminism()).inspect_err(|e| tracing::warn!("{}", e))
+}
+
+fn write(
+    dir: &str,
+    file_prefix: &str,
+    claim: &Claim,
+    nondeterminism: NonDeterminism,
+) -> Result<Option<PathBuf>, LogVmStateError> {
+    let vm_state = VMState::new(
+        SingleProof.program(),
+        claim.input.clone().into(),
+        nondeterminism,
+    );
+
+    let filename = format!(
+        "{}.{}.{}.json",
+        file_prefix,
+        std::process::id(),
+        NeptuneHash::hash(claim).to_hex(),
+    );
+
+    let path = PathBuf::from(dir).join(filename);
+
+    let mut state_file =
+        std::fs::File::create(&path).map_err(|e| LogVmStateError::from((path.clone(), e)))?;
+    let state = serde_json::to_string(&vm_state)?;
+    write!(state_file, "{}", state).map_err(|e| LogVmStateError::from((path.clone(), e)))?;
+    Ok(Some(path))
+}
+
+#[derive(Debug, thiserror::Error, strum::EnumIs)]
+#[non_exhaustive]
+pub enum LogVmStateError {
+    #[error("could not obtain padded-height due to program execution error")]
+    IoError {
+        path: PathBuf,
+        #[source]
+        source: std::io::Error,
+    },
+
+    #[error(transparent)]
+    SerializeError(#[from] serde_json::Error),
+}
+
+impl From<(PathBuf, std::io::Error)> for LogVmStateError {
+    fn from(v: (PathBuf, std::io::Error)) -> Self {
+        let (path, source) = v;
+        Self::IoError { path, source }
+    }
+}

src/util_types/mod.rs

@@ -1,4 +1,5 @@
 pub mod archival_mmr;
+pub(crate) mod log_vm_state;
 pub mod mutator_set;
 pub mod rusty_archival_block_mmr;