# Poseidon2-BabyBear width-16 constants: confirmation + conformance (task summary)

> **Scope caveat (2026-07-19 finding).** These constants are confirmed against Plonky3
> `0.4.3-succinct` (Aere's OWN BabyBear + FRI STARK stack), NOT against SP1 6.1.0. SP1 6.1.0 is a
> **Hypercube** release over the **KoalaBear** field, so these BabyBear Poseidon2 constants are not
> SP1 6.1.0's constants, FRI and DEEP-ALI do not apply to SP1 6.1.0, and this work does not verify SP1
> 6.1.0 proofs. Replacing the SP1 BN254 Groth16 wrap is a separate ~22 to 32 person-week retarget.
> See `AERE-STARK-SP1-RECURSION-AIR-PORT-SPEC-SUMMARY.md`.

Date: 2026-07-19. Component (b) of the PQ STARK-verify precompile 0x0AE8.

## Outcome (headline)

- Constants: **CONFIRMED-FROM-SOURCE.**
- Conformance KAT: **PASSED** (3/3 real known-answer vectors reproduced byte-for-byte).
- Top-level 0x0AE8: **still fail-closed** (returns EMPTY for every input). DO NOT ACTIVATE banner kept.

## What the prior pass had wrong, and what was confirmed

The prior pass implemented the permutation STRUCTURE but used SHA-256 PLACEHOLDER round constants
(`AERE-PLACEHOLDER-NOT-PLONKY3`) and a textbook internal layer. Two things were confirmed/fixed:

1. The 141 round constants are now the real Plonky3 values (128 external + 13 internal), generated by
   `Xoroshiro128Plus::seed_from_u64(1)` via `new_from_rng_128` and extracted from the pinned crates.
2. The internal linear layer was WRONG (a genuine bug, the "two wrong copies agree" trap). The pinned
   `DiffusionMatrixBabyBear`, as a canonical map, is `M_I = R^{-1} * (J + diag(D))` with
   R^{-1} = 943718400 = (2^32)^{-1} mod p, i.e. `out[i] = R_INV*(sum + D[i]*state[i])`. The prior pass
   used `state[i]*D[i] + sum` (no R^{-1}), which is self-consistent but disagrees with the prover.
   This is the Montgomery-form subtlety the task flagged. Verified by recovering the exact 16x16
   canonical matrix from the library (off-diagonal = R^{-1}, diagonal = R^{-1}*(1+D[i])).

Also confirmed: ROUNDS_F=8, ROUNDS_P=13 (`poseidon2_round_numbers_128(16,7)`); M4 =
[[2,3,1,1],[1,2,3,1],[1,1,2,3],[3,1,1,2]] (recovered from `Poseidon2ExternalMatrixGeneral`); the
internal diagonal D = [p-2,1,2,4,...,8192,32768] (canonical). The x^7 S-box was already solid.

## Source (exact) and method

Pinned target: `p3-baby-bear` / `p3-poseidon2` crates.io `0.4.3-succinct` (checksums
`d69e6e9a...` / `52298637...`, matching `aerenew/.../Cargo.lock`). The numbers are authoritative
because the pinned crates were compiled and executed (cargo 1.97.0; the fresh build resolved the same
two checksums, byte-identical to the AERE pin). Corroborating source pages:
- https://docs.rs/crate/p3-baby-bear/0.4.3-succinct/source/src/poseidon2.rs (diagonal, RNG comment)
- https://docs.rs/crate/p3-monty-31/0.4.3-succinct/source/src/monty_31.rs (Standard sampling, new_monty)
- https://docs.rs/crate/p3-poseidon2/0.4.3-succinct/source/src/lib.rs (new_from_rng_128 order)
- https://github.com/Plonky3/Plonky3 poseidon2/src/{round_numbers.rs, external.rs}
- https://github.com/rust-random/rngs rand_xoshiro (SplitMix64 seed, next_u32 = next_u64>>32)

Full provenance + the KAT vectors: `aerenew/pqc-fork/pq-stark/spec-poseidon2-constants.md`.

## Conformance KAT (executed from the pinned library, reproduced by all references)

- zeros   [0;16]   -> [1787823396, 953829438, 89382455, ...]
- iota    [0..15]  -> [157639285, 1851003038, 1852457045, ...]
- testvec (p3 test) -> [512585766, 975869435, 1921378527, ...]

Results: `python test_poseidon2_babybear.py` -> PASS=47017 FAIL=0 (Python/Node/Java byte-identical,
3/3 conformance KATs); `java Poseidon2BabyBearSelfTest` -> PASS=13536 FAIL=0.

## Files changed

- `aerenew/pqc-fork/pq-stark/poseidon2_babybear_reference.py` / `.mjs` — real constants, R_INV
  internal layer, conformance KATs.
- `aerenew/pqc-fork/pq-stark/Poseidon2BabyBearSelfTest.java` — same; self-test PASS=13536.
- `aerenew/pqc-fork/pq-stark/test_poseidon2_babybear.py` — added conformance stage; honest status.
- `aerenew/pqc-fork/precompiles/Sp1StarkVerifierPrecompiledContract.java` — real constants, R_INV
  internal layer, `Poseidon2Bb.available = true`; decoupled challenger gate
  (`Challenger.spongePorted = false`) so the top level stays fail-closed.
- `aerenew/pqc-fork/pq-stark/README.md`, `aerenew/docs/AERE-STARK-VERIFIER-PORT-SPEC.md` — real status.
- New: `aerenew/pqc-fork/pq-stark/spec-poseidon2-constants.md` (provenance/citation doc).

## Fail-closed confirmation

`Poseidon2Bb.available = true` (permutation confirmed), but the duplex sponge is a separate un-ported
component: `Challenger.spongePorted = false` -> `checkProofOfWork` returns false and
`sampleQueryIndices` returns empty; `StarkConstraints.evaluateAtZeta` and `Fri.checkQuery` return
UNAVAILABLE. So `verify(...)` never reaches `return ACCEPT`; the precompile returns EMPTY for every
input. The DO NOT ACTIVATE banner is intact.