Running the worker
The press is a Docker image with Foundry in it. What it needs, what it exposes, and how to run your own.
The worker is the auditor's machine. It is meant to be run by more than one auditor, and its source is published with the registry release.
What it does
POST /jobs with a repository, a ref, a GitHub token, and an address or bytecode. The worker then: resolves the commit, fetches the tree with submodules, compiles with Foundry, matches the runtime to the chain, runs the eight checks (the seventh on an anvil fork), writes the review, signs the seal with its key, stores it, and posts on X if all eight passed. The tree is deleted in every case.
What it needs
| Variable | Purpose |
|---|---|
WORKER_KEY |
Shared secret. POST /jobs requires it in the x-zkcheck-key header. The site holds the same value. |
AUDITOR_PK |
The auditor's signing key. Its address goes on every seal. |
ANTHROPIC_API_KEY |
For the review. Without it, seals are written with the review skipped. |
X_API_KEY, X_API_SECRET, X_ACCESS_TOKEN, X_ACCESS_SECRET, X_HANDLE |
For the post. Without them, no post. |
RH_RPC |
Robinhood Chain RPC. Defaults to the public one. |
SITE_URL |
For the links in posts. |
DB_PATH, WORK_DIR |
Where the SQLite file and the build trees live. On a volume. |
MAX_REVIEW_BYTES |
Source size limit for the review. Default 350 000. |
REVIEW_MODEL |
Default claude-opus-5. |
Running it
cd worker
pnpm install
WORKER_KEY=… AUDITOR_PK=0x… pnpm start # needs forge and anvil on PATH
Or the container, which installs Foundry:
docker build -t zkcheck-worker .
docker run -p 8080:8080 -v zkcheck:/data -e WORKER_KEY=… -e AUDITOR_PK=… zkcheck-worker
fly.toml deploys it on Fly with a 1 GB volume at /data. One machine with 2 GB of memory compiles most projects; a large Foundry project with via_ir may want 4 GB.
Concurrency
One job at a time. Jobs queue in memory and the queue is lost on restart; a job that was running is marked failed by its absence and can be resubmitted. Compiling two untrusted repositories at once on one small machine is a poor idea, and the queue is how the worker says so.
Safety of the build
The build runs with --offline, FOUNDRY_OFFLINE=true, no scripts, no tests, no ffi. The compiler is the only thing that executes, and it executes on source it does not run. The anvil fork for check 07 runs the deployed contract's code, which is public already.
Tests
pnpm test # fixtures: Clean passes, Rug fails six
pnpm tsx test/sim-live.ts # check 07 against a live token
Becoming an auditor
Run the worker with your own AUDITOR_PK. Your seals carry your address. When the registry exists, stake behind that address and your seals count. Until then, a seal from a second worker is a second opinion, which is already worth something.