From 6b2244fb2a92754d94d8fe8491f9b048b66f04a0 Mon Sep 17 00:00:00 2001
From: Ricardo Guilherme Schmidt <3esmit@gmail.com>
Date: Sun, 28 Jun 2026 18:41:49 -0300
Subject: [PATCH] build(guest): strip release symbols

Configure guest release profiles with debug = 0 and strip = "symbols" so deployed RISC Zero artifacts use stripped binaries.

Document that release-profile ImageIDs are canonical for testnet and mainnet deployments and dependent values must be refreshed.
---
 CLAUDE.md                                     | 10 ++++++++++
 programs/amm/methods/guest/Cargo.toml         |  4 ++++
 programs/ata/methods/guest/Cargo.toml         |  4 ++++
 programs/stablecoin/methods/guest/Cargo.toml  |  4 ++++
 programs/token/methods/guest/Cargo.toml       |  4 ++++
 programs/twap_oracle/methods/guest/Cargo.toml |  4 ++++
 6 files changed, 30 insertions(+)

diff --git a/CLAUDE.md b/CLAUDE.md
index 3d6ea9a..56cdc48 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -66,6 +66,16 @@ Generated IDL files live in `artifacts/`. CI checks that every program under `*/
 
 **Note:** `spel` and `wallet` may use different versions of the wallet package. If `spel --idl <IDL> <PROGRAM_FUNCTION> ...` fails, ensure `seq_poll_timeout_millis` is set in the wallet config at `~/.nssa/wallet`.
 
+For testnet and mainnet deployments, build guest binaries with the release profile in each guest manifest:
+
+```toml
+[profile.release]
+debug = 0
+strip = "symbols"
+```
+
+That profile is part of program identity. After every release build, inspect the binary and update every value that depends on the ImageID before submitting transactions: deployed program IDs, client/config files, PDA-derived account addresses, AMM `token_program_id` and `twap_oracle_program_id`, and ATA `token_program_id` inputs. Do not mix raw or old ImageIDs with release-profile binaries.
+
 ```bash
 # Deploy a program binary to the sequencer
 wallet deploy-program <path-to-binary>
diff --git a/programs/amm/methods/guest/Cargo.toml b/programs/amm/methods/guest/Cargo.toml
index a18d38e..d752f83 100644
--- a/programs/amm/methods/guest/Cargo.toml
+++ b/programs/amm/methods/guest/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2021"
 
 [workspace]
 
+[profile.release]
+debug = 0
+strip = "symbols"
+
 [lints.rust]
 rust_2018_idioms = { level = "deny", priority = -1 }
 # deny (not forbid) so a targeted per-item #[allow] remains possible if ever needed
diff --git a/programs/ata/methods/guest/Cargo.toml b/programs/ata/methods/guest/Cargo.toml
index ead1024..75ff792 100644
--- a/programs/ata/methods/guest/Cargo.toml
+++ b/programs/ata/methods/guest/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2021"
 
 [workspace]
 
+[profile.release]
+debug = 0
+strip = "symbols"
+
 [lints.rust]
 rust_2018_idioms = { level = "deny", priority = -1 }
 # deny (not forbid) so a targeted per-item #[allow] remains possible if ever needed
diff --git a/programs/stablecoin/methods/guest/Cargo.toml b/programs/stablecoin/methods/guest/Cargo.toml
index 4c39167..9b5fc5b 100644
--- a/programs/stablecoin/methods/guest/Cargo.toml
+++ b/programs/stablecoin/methods/guest/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2021"
 
 [workspace]
 
+[profile.release]
+debug = 0
+strip = "symbols"
+
 [[bin]]
 name = "stablecoin"
 path = "src/bin/stablecoin.rs"
diff --git a/programs/token/methods/guest/Cargo.toml b/programs/token/methods/guest/Cargo.toml
index b0ffffa..6a1b5ef 100644
--- a/programs/token/methods/guest/Cargo.toml
+++ b/programs/token/methods/guest/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2021"
 
 [workspace]
 
+[profile.release]
+debug = 0
+strip = "symbols"
+
 [lints.rust]
 rust_2018_idioms = { level = "deny", priority = -1 }
 # deny (not forbid) so a targeted per-item #[allow] remains possible if ever needed
diff --git a/programs/twap_oracle/methods/guest/Cargo.toml b/programs/twap_oracle/methods/guest/Cargo.toml
index 06f7c97..f7f645f 100644
--- a/programs/twap_oracle/methods/guest/Cargo.toml
+++ b/programs/twap_oracle/methods/guest/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2021"
 
 [workspace]
 
+[profile.release]
+debug = 0
+strip = "symbols"
+
 [[bin]]
 name = "twap_oracle"
 path = "src/bin/twap_oracle.rs"