server: HTTP verify sidecar for a trustless indexer

[dkijania]

What

Adds mina-verify-server — a long-lived HTTP service that answers one question: "is this precomputed block's proof honest?" Built for a trustless indexer: verify each block's SNARK proof before ingesting it, with no trusted daemon.

GET  /health  -> { "status": "ok", "network": "devnet" }
POST /verify  (precomputed-block JSON) -> { "valid": true, "height",
                "state_hash", "previous_state_hash", "staged_ledger_hash" }
              (or { "valid": false, "error": ... })

The caller ingests iff valid, keyed by the proof-backed hashes. A valid proof attests the entire chain to genesis by recursion, so trust in whoever produced the block isn't required.

Design

• Links only the mina-verify lib (the precomputed path needs no networking) → small, stateless, CPU-bound. The expensive Verifier setup is paid once at startup; each request is just the proof check.
• tiny_http + a worker pool — verification is blocking CPU work, so no async/tokio.
• Lossy UTF-8 body decode. Real precomputed blocks are not strictly UTF-8: the OCaml daemon emits some byte-string fields (e.g. sok_digest in staged_ledger_diff) as mixed raw/escaped bytes. Verification ignores those fields (only protocol_state + the proof, both ASCII, are read), so the body is decoded lossily — matching how JS clients read these blocks. Verified against fresh devnet blocks that carry these bytes.
• Config via env: BIND, MINA_VK_JSON (for mesa/mesa-mut), MINA_NETWORK, VERIFY_THREADS.
• Docker: the image builds the bin; run as a sidecar via --entrypoint mina-verify-server.

Verified (live devnet)

• /health → ok
• fresh real block (with non-UTF-8 sok_digest) → valid:true, correct height/hashes, ~1–2 s
• tampered proof → valid:false

Native release verifies in ~1–2 s/block (no wasm overhead / no num-bigint opt penalty), so an indexer can afford to verify every block, not just the tip. The README documents the docker-compose indexer topology and the --verify-block-exe curl-shim wiring (reusing the indexer's existing exe-hook pattern, so the Rust-1.94 toolchain stays bottled up in its own container).

Notes

• Branches off main (independent of the mina-verify-wasm / BlockSource PR monitor: unified BlockSource (precomputed | live node) → VerifiedBlock #1).
• Includes a cargo fmt --all commit to satisfy the existing (currently-red-on-main) Format CI gate; isolated so reviewers can skip it.

🤖 Generated with Claude Code