v0.22.0-alpha.1

Major breaking changes

• [BREAKING] build_trace() no longer assumes valid user input (#2747).
• [BREAKING] Migrate to lifted-STARK backend and miden-crypto to v0.23 (#2783).

Changes

• Added math::u128 comparison (lt, lte, gt, gte), bitwise (and, or, xor, not), and shift (shl, shr, rotl, rotr) operations (#2624).
• Consolidated error variants: simplified AceError and FRI errors to string-based types, merged DynamicNodeNotFound/NoMastForestWithProcedure into ProcedureNotFound, introduced HostError for handler-related variants (#2675).
• Added optional tagging instrumentation for AIR constraints (test-only; enables stable ID tracking and OOD parity checks) (#2713).
• [BREAKING] Processor and FastProcessor decorator execution is now immutable (#2718).
• [BREAKING] Tracer API significantly refactored (#2720).
• Added general stack transition constraints (shift/no‑shift) (#2725).
• Added stack overflow table constraints (#2735).
• Added stack shuffling ops constraints (#2736).
• [BREAKING] Renamed miden::core::crypto::dsa::falcon512poseidon2 module to falcon512_poseidon2 to align with snake_case naming convention (#2740).
• Fix a possible panic in decorator serialization (#2742).
• Added miden-ace-codegen crate for lowering AIR constraints to ACE circuit format (#2757).
• [BREAKING] Operation enum now only encodes basic block operations (#2771).
• Added AIR constraints for system, range checker, stack, decoder, and chiplets components (#2772).
• Added math::u128 division operations (#2776).
• Added recursion guards for assembly inputs and tests (#2792).
• Introduced build_trace_with_max_len() which stops building the trace after a given max, and build_trace() no longer allocates more than 2^29 rows (#2809).
• DebugHandler's default method implementations are now no-ops (instead of prints) (#2837).
• Added ExecutionTrace::check_constraints() for fast debug constraint checking without STARK proving, and migrated tests from prove_and_verify (#2846).

Fixes

• Fixed Constant::PartialEq to include visibility field in equality comparison, making it consistent with other exportable items (Procedure, TypeAlias, EnumType).
• Cryptostream operation now correctly sends chiplets bus memory requests (#2686).
• Hardened untrusted deserialization by enforcing budgets and depth limits, plus expanded fuzzing coverage (#2777).
• Added documentation for math::u64 module operations (#2781).
• Hardened AEAD decrypt size calculations (#2789).
• Fixes an possible u64 overflow issue in op_eval_circuit() #2799
• SystemEvent::HpermToMap handler now computes the correct permutation (#2801).
• Preserved dynexec/dyncall distinction (and digests) when remapping or merging MAST forests (#2784).
• Hardened MASM parsing and constants handling (lexer invalid-token spans, repeat count bounds, constant range checks, field division folding, and push.WORD[...] index validation) (#2803).
• Introduced FastProcessor safe stack method accesses for event handlers (#2797).
• Hardened syscall target validation to avoid panic paths and reject invalid digests at assembly time (#2804).
• Add bounds to attacker-controlled allocation sizes in advice map and keccak256/sha512 precompiles (#2805).
• build_trace() no longer panics when no core trace contexts are provided (#2809).
• Set a bound on ContinuationStack size, checked during execution (#2824).
• Prevented a trace-generation panic by validating op batch groups in basic blocks (#2782).
• Validated push immediate group commitments and slot placement to reject invalid immediates (#2779).
• Fixed undefined behavior in parallel trace generation by limiting H0 batch inversion to initialized rows (#2842).
• Hardened boundary and overflow checks for u64::shr, ilog2, u32clz, and Falcon mod_12289 (#2808).