chore: check NUT pre-fork state snapshots

Author: ajsutton

.circleci/continue/main.yml

@@ -1716,6 +1716,25 @@ jobs:
       - go-save-cache:
           namespace: check-nut-locks
 
+  check-nut-prefork-states:
+    docker:
+      - image: <<pipeline.parameters.c-default_docker_image>>
+    resource_class: large.gen2
+    steps:
+      - utils/checkout-with-mise:
+          checkout-method: blobless
+          enable-mise-cache: true
+      - attach_workspace:
+          at: .
+      - go-restore-cache:
+          namespace: check-nut-prefork-states
+      - run:
+          name: check NUT pre-fork states
+          command: |
+            just _check-nut-prefork-states
+      - go-save-cache:
+          namespace: check-nut-prefork-states
+
   nut-provenance-verify:
     docker:
       - image: <<pipeline.parameters.c-default_docker_image>>
@@ -2442,6 +2461,13 @@ workflows:
             - prep-go-modules
           context:
             - circleci-repo-readonly-authenticated-github-token
+      - check-nut-prefork-states:
+          requires:
+            - contracts-bedrock-build
+            - prep-superchain
+            - prep-go-modules
+          context:
+            - circleci-repo-readonly-authenticated-github-token
       - nut-provenance-verify:
           requires:
             - prep-go-modules
@@ -2644,6 +2670,7 @@ workflows:
             - check-generated-mocks-op-service: terminal
             # Misc checks that run on the merge queue.
             - check-nut-locks: terminal
+            - check-nut-prefork-states: terminal
             - check-op-geth-version: terminal
             - op-deployer-forge-version: terminal
             - l2-chains-sync-check: terminal

justfile

@@ -418,6 +418,24 @@ build-rust-release:
 check-nut-locks:
   go run ./ops/scripts/check-nut-locks
 
+# Checks that committed NUT pre-fork states regenerate without drift. Assumes required build artifacts are present.
+[script('bash')]
+_check-nut-prefork-states:
+  set -euo pipefail
+  shopt -s nullglob
+  for state in op-core/nuts/state/*_state.json; do
+    fork="$(basename "$state" _state.json)"
+    if [ "$fork" = "jovian" ]; then
+      continue
+    fi
+    just _nut-prefork-state-for "$fork"
+  done
+  git diff --exit-code -- op-core/nuts/state/*_state.json
+
+# Checks that committed NUT pre-fork states regenerate without drift.
+check-nut-prefork-states: build-contracts build-superchain-go
+  just _check-nut-prefork-states
+
 # Snapshots current-upgrade-bundle.json as a fork's NUT bundle and updates the lock file.
 nut-snapshot-for fork:
   go run ./ops/scripts/nut-snapshot-for {{fork}}
@@ -427,9 +445,12 @@ nut-provenance-verify fork:
   go run ./ops/scripts/nut-provenance-verify {{fork}}
 
 # Generates op-core/nuts/state/<fork>_state.json (predecessor state + frozen <fork> bundle).
-nut-prefork-state-for fork:
-  OP_E2E_GEN_PREFORK_STATE={{fork}} go test -run TestGenerateForkState ./rust/kona/tests/proofs/
+_nut-prefork-state-for fork:
+  OP_E2E_GEN_PREFORK_STATE={{fork}} go test -count=1 -run TestGenerateForkState ./rust/kona/tests/proofs/
 
+# Generates op-core/nuts/state/<fork>_state.json (predecessor state + frozen <fork> bundle).
+nut-prefork-state-for fork: build-contracts build-superchain-go
+  just _nut-prefork-state-for {{fork}}
 
 # Checks that TODO comments have corresponding issues.
 todo-checker:

op-core/nuts/README.md

@@ -63,6 +63,7 @@ Requires `forge` for the provenance check (step 2).
 ### CI checks
 
 - **`check-nut-locks`** — Verifies all bundle hashes match their lock entries, all entries have a commit, every `*_nut_bundle.json` file has a corresponding lock entry, and each locked fork has a committed pre-fork state (`op-core/nuts/state/<fork>_state.json`). Runs in CI on every PR.
+- **`check-nut-prefork-states`** — Regenerates every committed non-seed `op-core/nuts/state/<fork>_state.json` file and fails if any committed state snapshot drifts.
 
 ## fork_lock.toml schema
 

op-core/nuts/state/README.md

@@ -60,6 +60,15 @@ bundle, so current tooling is fine despite the ABI drift above.
 compile time, so `<prev>_state.json` must be on disk before generating
 `<fork>_state.json`.
 
+To verify every committed fork state is up to date, run:
+
+```bash
+just check-nut-prefork-states
+```
+
+This regenerates committed non-seed fork states and fails if the committed JSON
+changes.
+
 ## Determinism
 
 **Composed states** (`karst_state` and later) are byte-reproducible given the