{
  "component": "FRI low-degree test / query verification over BabyBear (port spec component (d))",
  "precompile": "0x0000000000000000000000000000000000000ae8",
  "scope": "port spec section 5; the FRI verifier's FOLD + OPENING relations (verify_query / verify_challenges): arity-2 folding in F_{p^4}, per-layer MMCS openings against the commit-phase roots, down to a single constant equal to the committed final polynomial.",
  "validates": "CONFORMANCE: real FRI proofs emitted by the pinned Plonky3 p3-fri 0.4.3-succinct PROVER (and accepted by its own verifier) are re-verified byte-for-byte by this reference (accept), and four tamper variants are rejected (corrupted opened value, corrupted MMCS sibling digest, wrong fold challenge beta, non-matching final poly); Python/Node/Java produce byte-identical per-query folded values.",
  "does_not_validate": "the SP1 recursion-AIR constraint evaluation (component (e)), which supplies the reduced openings and is UN-PORTED. Within THIS FRI KAT the betas / query indices are supplied as inputs; deriving them in-circuit is component (f) (the duplex-sponge challenger), now CONFIRMED separately (test_challenger.py), whose derived betas/indices close the loop into this verify_query.",
  "top_level_verifier": "unchanged, still FAIL-CLOSED (returns EMPTY for every input). Even with the FRI fold+opening (d) and the challenger (f) confirmed, StarkConstraints.evaluateAtZeta=UNAVAILABLE (component (e)), so verify() never reaches ACCEPT and computePrecompile returns EMPTY. ACCEPT is unreachable. DO NOT ACTIVATE.",
  "confirmed_config": {
    "folding_arity": 2,
    "sibling_rule": "index_sibling = index ^ 1, index_pair = index >> 1 (p3-fri verifier.rs)",
    "num_fold_rounds": "log_max_height - log_blowup (final poly is a single F_{p^4} CONSTANT)",
    "log_max_height": "commit_phase_commits.len() + log_blowup",
    "commit_phase_mmcs": "ExtensionMmcs<Val,Challenge,ValMmcs> over the CONFIRMED FieldMerkleTreeMmcs (component (c)); a commit-phase leaf is a pair of F_{p^4} evals flattened to 8 BabyBear coords, hashed by the PaddingFreeSponge",
    "coset_point": "x = two_adic_generator(log_max_height)^reverse_bits_len(index, log_max_height), in F_{p^4}; the sibling point is -x (two_adic_generator(1))",
    "fold_relation": "folded = e0 + (beta - x0) * (e1 - e0) / (x1 - x0)  (linear interpolation through beta), plus reduced_openings[log_folded_height+1] injected before each fold",
    "final_poly_check": "every query's folded constant must equal proof.final_poly"
  },
  "confirmed_by_kat": [
    "CONFIRMED arity-2 fold (sibling=index^1, index_pair=index>>1) vs p3-fri verifier.rs",
    "CONFIRMED num_fold_rounds = log_max_height - log_blowup; final poly is a single F_{p^4} constant",
    "CONFIRMED reverse_bits_len index-to-coset-point mapping (x = g^rev(index))",
    "CONFIRMED two_adic_generator(bits) matches Plonky3 (the fold coset points are correct)",
    "CONFIRMED the F_{p^4} non-residue W = 11 is Plonky3's (the EF fold arithmetic reproduces the fold)",
    "CONFIRMED the ExtensionMmcs flatten (each F_{p^4} eval -> 4 base coords, pair -> 8) + base MMCS open"
  ],
  "cross_language": [
    "java",
    "node",
    "python"
  ],
  "conformance": {
    "status": "CONFIRMED (real known-answer test PASSED: accept genuine + reject tampered)",
    "method": "pq-stark/fri-extractor (a Rust binary depending on the pinned crates; lockfile checksums matched) ran p3_fri::prover::prove over known low-degree codewords with the seed_from_u64(1) Poseidon2, then p3_fri::verifier::{verify_shape_and_sample_challenges,verify_challenges} to confirm the library accepts; its output is fri_ground_truth.json",
    "cases": [
      "blowup1_h6_q4",
      "blowup2_h7_q5",
      "blowup1_h8_q6"
    ]
  },
  "pinned_conformance_target": {
    "revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
    "p3_fri_checksum": "5cbc4965ee488f3247867b7ec4bb005b8afa72cb0d461a4dcb1387ecab6426d5",
    "p3_challenger_checksum": "b6a908924d43e4cfb93fb41c8346cac211b70314385a9037e9241f5b7f3eaf77",
    "p3_dft_checksum": "be6408b10a2c27eb13a7d5580c546c2179a8dc7dbc10a990657311891f9b41c0",
    "p3_commit_checksum": "50acacc7219fce6c01db938f82c1b21b5e7133990b7fff861f91534aeb569419",
    "found_in": "aerenew/zk-circuits/*/Cargo.lock and aerenew/rollup-evm-validity/*/Cargo.lock"
  },
  "flags": [
    "[VERIFY]->CONFIRMED here: arity-2 fold, num_fold_rounds, reverse-bits mapping, two_adic_generator, W=11 (all exercised by the accept-KAT over the pinned p3-fri proof)",
    "[MEASURE] conformance against a REAL exported SP1 v6.1.0 inner proof's FRI section (needs the exported proof + the AIR reduced-openings, component (e))",
    "component (f) transcript binding is now CONFIRMED (Challenger.spongePorted=true; the derived betas/indices close the loop into this verify_query, see test_challenger.py). The top level stays fail-closed on the AIR (component (e), StarkConstraints=UNAVAILABLE)"
  ],
  "notes": [
    "CONFORMANCE: 3 FRI proofs from the pinned p3-fri 0.4.3-succinct prover accepted; 4 tamper variants each rejected (opening, MMCS proof, beta, final poly)",
    "cross-language implementations compared: java, node, python"
  ],
  "passed": 55,
  "failed": 0,
  "total": 55
}