Promote open PRs: SP1 6.5.0 stack, blake3, cc, prove_server imports

[robertbetts]

Summary

Umbrella for open PRs #19–#24, which all targeted main. This lands them on development as one coordinated change.

Source	Take?	Notes
#19 imports	Yes	Required: prove_server --features sp1 fails on development without ProveRequest / ProvingKey
#19 digests	No (as-is)	Local heavy-smoke hashes; after SP1 6.5.0 ELF/vk change again. Keep last Linux CI pin; refresh on Linux
#20 blake3 1.8.7	Yes	Lock only
#21 cc 1.4.4	Yes	Lock only
#22–#24 SP1 6.5.0	Yes, together	Pins sp1-sdk / sp1-build / sp1-zkvm 6.5.0 (one-crate PRs would skew)

Also: Dependabot target-branch: development + sp1-* group.

Tests (local)

• cargo test -p lean_tee_receipt -p lean_tee_compliance
• cargo build -p lean_tee_prove_server (mock) and --features sp1
• Lean bins + mock demos including confidentiality_local_demo (macOS)
• teeLoopback (flaky once, OK on retry)
• SP1_CHECK_DIGESTS=0 bash scripts/sp1_execute_ci.sh (execute OK; new ELF/vk not committed — Mac-local)

Follow-up

• Refresh artifacts/sp1_guest_digests.json from Linux after merge
• Close Dependabot PRs Bump blake3 from 1.8.5 to 1.8.7 in /host #20–Bump sp1-zkvm from 6.3.1 to 6.5.0 in /host #24 and Refresh SP1 guest digests and fix prove_server SP1 imports #19 once this merges
• Promote development → main after green mock CI

Test plan

• ci.yml lean-mock / rust-mock on this PR
• After merge: Linux scripts/sp1_guest_digest.sh + commit pin

Made with Cursor