aere-docs/AERE-STARK-MMCS-SUMMARY.md

STARK-verify port 0x0AE8, component (c): MMCS (FieldMerkleTreeMmcs) - IMPLEMENTED + CONFORMANCE-CONFIRMED

Scope caveat (2026-07-19 finding). This component is conformance-confirmed against Plonky3 0.4.3-succinct (Aere's OWN BabyBear + FRI STARK stack), NOT against SP1 6.1.0. SP1 6.1.0 is a Hypercube release (KoalaBear multilinear: BaseFold + Jagged + sumcheck-zerocheck + LogUp-GKR), so FRI and DEEP-ALI do not apply to it and this skeleton does not verify SP1 6.1.0 proofs. Replacing the SP1 BN254 Groth16 wrap is a separate ~22 to 32 person-week retarget. See AERE-STARK-SP1-RECURSION-AIR-PORT-SPEC-SUMMARY.md.

Date: 2026-07-19. Status: real known-answer test PASSES. Top-level precompile stays fail-closed.

What was done

Implemented and conformance-confirmed component (c) of the SP1/Plonky3 inner STARK-verify port: the Mixed Matrix Commitment Scheme (MMCS), i.e. Plonky3's FieldMerkleTreeMmcs, the Merkle-tree vector commitment that FRI (d) and the trace commitment are built on. Same rigorous ground-truth method that worked for Poseidon2: compiled and executed the exact pinned Plonky3 crates to emit authoritative reference vectors, then reproduced them byte-for-byte.

1. Confirmed the exact construction from the pinned crates

Read the source of the pinned 0.4.3-succinct crates (checksums matched the repo Cargo.lock): p3-merkle-tree (d5703d92...), p3-symmetric (9047ce85...), p3-commit (50acacc7...), p3-matrix (75c3f150...). The SP1 inner config is pinned VERBATIM in p3-merkle-tree's own mmcs.rs tests:

• leaf hasher = PaddingFreeSponge<Perm, WIDTH=16, RATE=8, OUT=8> (overwrite-mode, padding-free)
• 2-to-1 compr. = TruncatedPermutation<Perm, N=2, CHUNK=8, WIDTH=16> (permute(l||r)[0..8])
• MMCS = FieldMerkleTreeMmcs<Packing, Packing, MyHash, MyCompress, DIGEST_ELEMS=8> So a digest = 8 BabyBear elements (32 bytes). Leaf hash / node compression run on the CONFIRMED Poseidon2-BabyBear permutation (component (b)). Traced the tree build (first_digest_layer / compress_and_inject), open_batch, and verify_batch from source; documented the mixed-height rule (tallest-first, power-of-two padding with the zero digest, injection at the matching padded layer, index reduced by index >> (log_max_height - log2_ceil(height))) and the height property that makes the tree-build and verify grouping select the same set.

2. Ground-truth extractor (Rust, scratch dir only)

Wrote mmcs-extractor depending on the pinned crates, built the exact MyMmcs, and used the SAME deterministic permutation as the Poseidon2 confirmation (new_from_rng_128(seed_from_u64(1))). It commits to six known matrix batches and emits the root + an open_batch opening (opened rows + sibling path) for each, printing every field element as canonical u32, and asserts the library's OWN verify_batch accepts each. Its permute([0;16]) equals the confirmed Poseidon2 "zeros" vector, so the extractor's permutation is byte-identical to the reference's (guards the "two wrong copies" trap). Ran on this box; all six library verify_batch calls returned Ok.

The six cases exercise: single power-of-two height (8x2), single non-power-of-two height (6x2, padded, zero-digest padding), a column vector (8x1), and three mixed-height batches (8x2+4x3, 8x1+4x2+2x2, 5x2+3x1). One case (mixed_5x2_3x1) has a default (all-zero) sibling digest in its proof.

3. References + precompile wiring (matching the existing convention)

• pqc-fork/pq-stark/mmcs_babybear_reference.py (Python), .mjs (Node), MmcsBabyBearSelfTest.java (standalone Java): hash_iter (PaddingFreeSponge), compress2to1 (TruncatedPermutation), full mixed-height tree build + commit + open_batch + verify_batch, over the confirmed Poseidon2.
• pqc-fork/precompiles/Sp1StarkVerifierPrecompiledContract.java: new Mmcs static class (hashIter, compress2to1, mixed-height verifyBatch) wired behind the still-fail-closed top level; Mmcs.available = true. Referenced from Fri.checkQuery (still returns UNAVAILABLE). Compiles clean.
• pqc-fork/pq-stark/test_mmcs_babybear.py harness + ../results/kat-results-mmcs-babybear.json.
• pqc-fork/pq-stark/spec-mmcs-babybear.md provenance doc.
• Updated docs/AERE-STARK-VERIFIER-PORT-SPEC.md (section 4 -> CONFIRMED, status table, intro, files) and pqc-fork/pq-stark/README.md (new (c) section, layout, reproduce).

4. CONFORMANCE KAT: PASSED

python test_mmcs_babybear.py -> PASS=300 FAIL=0. CONFORMANCE 37/37 (perm sanity + 6 primitive hash/compress KATs + 6 MMCS cases: root + openings + proof + verify-accept + tamper-reject) reproduced EXACTLY from the pinned crates. Cross-language byte-identical across Python + Node + Java. Standalone java MmcsBabyBearSelfTest -> PASS=80 FAIL=0 (includes open-every-valid-leaf self-consistency). Poseidon2 regression (test_poseidon2_babybear.py) still PASS. No em-dashes / -- in prose docs.

Multi-matrix generalization

Handled beyond the single-matrix case: three genuine mixed-height batches (2 and 3 matrices) are in the KAT and pass, so the tallest-first grouping, power-of-two padding, and injection logic are exercised, not just documented.

Fail-closed confirmation (unchanged)

The top-level 0x0AE8 still verifies NOTHING and returns EMPTY for every input:

• StarkConstraints.evaluateAtZeta returns UNAVAILABLE (stage 4 -> UNAVAILABLE -> EMPTY).
• Challenger.spongePorted = false (absorb no-op; checkProofOfWork false; sampleQueryIndices empty).
• Fri.checkQuery returns UNAVAILABLE.
• computePrecompile returns VERIFIED only if verify(...) == ACCEPT; the single return ACCEPT line is unreachable. Mmcs.available = true flips NO top-level gate.
• DO NOT ACTIVATE banner intact.

Honesty caveat ([MEASURE] remaining)

Conformance is against the pinned crate library (KAT reproduced byte-for-byte). Matching a REAL exported SP1 v6.1.0 proof's actual commitment root (its specific trace / FRI matrices and heights) is a further [MEASURE] step needing an exported proof + the challenger; flagged honestly, not faked.

Scope boundary (unchanged)

On-chain ZK verifiers on Aere remain the classical BN254 Groth16 gateway until the whole STARK verifier is real, audited, and founder-activated. This is one more component of a multi-week port. Consensus on chain 2800 is unaffected (classical secp256k1 ECDSA QBFT).