avmd 2.8.0 + B7 provers (devnet keys)

avmd 2.8.0 + B7 provers — the daemon can now answer its own client

avmd 2.1.2 shipped a daemon that could not answer the client p2pnetwork already
ships. prove_zkwasm returned {"error":"unknown method"}. This release closes
that: the seam, the prover binaries it spawns, and the canonical keys they use
all land together, because any one of them alone is useless.

Assets

asset	platforms
avmd-{platform}-{arch}	darwin-arm64, darwin-x64, linux-x64, linux-arm64
b7-zkwasm-prover-*.tar.gz	darwin/linux × arm64/amd64
b7-compose-prover-*.tar.gz	darwin/linux × arm64/amd64
SHA256SUMS	all 12

requireSha256: true has been in AVM_MANIFEST since it was written and no
release has ever published checksums. This one does.

What a b7 proof is, and is not

It proves a commitment binds to its attestations —
MiMC(coreCommitment, attestationsRoot). It is not execution verification
and does not show any computation ran correctly. Recompute does that. The
caveat is in --help, in vkey output, in the module headers and in every log
line, and it belongs here too.

Verified before publishing

• Gated E2E with a real prover. The leg that had never been closed: only a
  labelled stand-in had previously run behind the argv boundary. Note the
  documented command is wrong — B7_ZKWASM_PROVER_E2E is read as a path, so
  =1 makes the test skip and report success. Run with the binary path, it
  passes.
• Tamper rejection on these exact artifacts, extracted from the tarballs
  below rather than the build tree: valid proof verifies; tampered core,
  tampered attestations, and a tampered child commitment in a composed proof
  are all refused. A prover that accepts a tampered proof is worse than none.
• Performance within baselines — proof size is 164 bytes, matching the
  measured figure exactly, which is the clearest confirmation that the circuit
  and curve are unchanged.
• Executed on real hardware. The linux binaries were not merely
  cross-compiled: avmd, both provers, and a full prove→verify round trip were
  run on an x86_64 host.

Keys

Canonical devnet keysets are published separately at
b7-keys-b7a-mimc-binding-v1_b7b-bundle-binding-v1, and the pins
(B7_EXPECTED_VK_HASH, B7_COMPOSE_VK_PINS) are committed in a1-blockchain as
b7-canonical-pins.env. Before this, nodes ran per-node dev keys and could not
verify each other's proofs at all.

Single-party trusted setup — devnet/testnet only. The minting party is the
setup party. That is an acceptable, and stated, trust model for a binding proof
in development. It must be re-minted through a multi-party ceremony before it
secures anything of value.