apollo_starknet_os_program,blockifier: bump cairo-lang to 0.14.3a3 and regen OS hash

[Yoni-Starkware]

What

Bump the cairo-lang Python package 0.14.3a2 → 0.14.3a3 and regenerate the resulting OS-program-hash regression fixtures.

Changes

• cairo-lang version bump (0.14.3a2 → 0.14.3a3):
  • scripts/requirements.txt, scripts/requirements-gen.txt
  • crates/starknet_transaction_prover/Dockerfile (CAIRO_LANG_VERSION)
  • apollo_infra_utils EXPECTED_CAIRO0_VERSION
• OS program hash changed by the new compiler — regenerated:
  • program_hash.json: os → 0x6ca9b5d…, virtual_os → 0x3407278…
  • virtual_os_test.rs bytecode lengths: OS 16367, virtual-OS 11426
  • versioned_constants_diff_regression/0.14.2_0.14.3.txt
• Reduced allowed_virtual_os_program_hashes in the 0.14.3 versioned constants to only the new virtual-OS hash (removed the two prior entries):
  • blockifier_versioned_constants_0_14_3.json
  • constants.cairo (ALLOWED_VIRTUAL_OS_PROGRAM_HASHES_LEN = 1)
  • execution_constraints.cairo (static_assert …LEN == 1, single-term is_program_hash_allowed)

Verified

Clean-build, stable across consecutive runs:

• apollo_starknet_os_program — all tests (program hashes, bytecode lengths, constants.cairo, formatting)
• blockifier::test_vc_diffs_regression
• apollo_infra_utils cairo0 version-consistency (requirements ↔ EXPECTED_CAIRO0_VERSION)

Pending

The proof-flow fixtures (apollo_integration_tests/resources/proof_flow/) bake the old virtual-OS hash and require prover regeneration (generate_proof_fixtures, nightly + stwo_proving). Regeneration is running; this PR will be updated with the new fixtures.

🤖 Generated with Claude Code

[cursor]

PR Summary

High Risk
Changes OS and virtual-OS program hashes and which client proofs the chain accepts—proofs using prior virtual-OS hashes will fail validation after deployment.

Overview
Bumps cairo-lang from 0.14.3a2 to 0.14.3a3 across Python requirements, the tx-prover Dockerfile, and EXPECTED_CAIRO0_VERSION, then refreshes all artifacts tied to recompiling the Starknet OS with that compiler.

OS / virtual OS identity updates: program_hash.json gets new os and virtual_os hashes; bytecode length expectations in virtual_os_test.rs move to 16367 / 11426; integration proof_facts.json now embeds the new virtual-OS program hash.

Client-side proving allowlist is narrowed: allowed_virtual_os_program_hashes in 0.14.3 versioned constants, Cairo constants.cairo, and is_program_hash_allowed in execution_constraints.cairo drop the two legacy hashes and only accept 0x3407278… (length 1). The 0.14.2→0.14.3 versioned-constants diff regression file is updated accordingly.

^{Reviewed by Cursor Bugbot for commit c831685. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[github-actions]

Artifacts upload workflows:

• Started at 2026-06-10T19:07:37Z
• Started at 2026-06-10T19:40:08Z

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit c831685. Configure here.}

[Yoni-Starkware]

@Yoni-Starkware resolved 1 discussion.
Reviewable status: 0 of 12 files reviewed, all discussions resolved (waiting on AvivYossef-starkware, dorimedini-starkware, and einat-starkware).

[einat-starkware]

@einat-starkware reviewed 12 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on AvivYossef-starkware and dorimedini-starkware).