{
  "component": "Poseidon2 permutation over BabyBear, width 16 (port spec component (b))",
  "precompile": "0x0000000000000000000000000000000000000ae8",
  "scope": "port spec section 3; the hash Plonky3/SP1 uses for Merkle/MMCS compression and the Fiat-Shamir duplex challenger",
  "validates": "SELF-CONSISTENCY + CONFORMANCE: x^7 is a bijection (7 = smallest coprime degree, proven); the permutation is deterministic and a genuine bijection (inverse round-trip, no collisions); M4 is MDS and the external/internal linear layers are invertible; Python/Node/Java produce byte-identical outputs; AND the permutation reproduces real known-answer vectors from the pinned p3-baby-bear / p3-poseidon2 0.4.3-succinct crates (the 'two wrong copies agree' trap is closed).",
  "does_not_validate": "the FULL STARK verifier. Only component (b) (the Poseidon2 permutation) is confirmed. The duplex-sponge challenger, FRI folding/consistency, MMCS/Merkle openings, and the SP1 recursion-AIR are un-ported.",
  "top_level_verifier": "unchanged, still fail-closed (returns EMPTY for every input). Poseidon2Bb.available is now true (the permutation is confirmed), but the challenger/FRI/AIR are still un-ported (Challenger.spongePorted=false, StarkConstraints=UNAVAILABLE), so the top level still returns EMPTY.",
  "constants": {
    "P": 2013265921,
    "r_inv": 943718400,
    "width": 16,
    "sbox_degree": 7,
    "rounds_f": 8,
    "rounds_p": 13,
    "internal_diag_m1_16": [
      2013265919,
      1,
      2,
      4,
      8,
      16,
      32,
      64,
      128,
      256,
      512,
      1024,
      2048,
      4096,
      8192,
      32768
    ],
    "internal_layer_form": "M_I = R_INV * (J + diag(D)), R_INV = 943718400 (Montgomery artifact)",
    "m4": [
      2,
      3,
      1,
      1,
      1,
      2,
      3,
      1,
      1,
      1,
      2,
      3,
      3,
      1,
      1,
      2
    ],
    "round_constants": "141 CONFIRMED constants (128 external + 13 internal) from Xoroshiro128Plus::seed_from_u64(1) via new_from_rng_128"
  },
  "cross_language": [
    "java",
    "node",
    "python"
  ],
  "conformance": {
    "status": "CONFIRMED (real known-answer test PASSED)",
    "method": "the exact pinned crates were executed via cargo (lockfile checksums matched) to emit constants + 3 permutation vectors; this reference reproduces all 3 exactly",
    "vectors": [
      "zeros",
      "iota",
      "testvec"
    ]
  },
  "pinned_conformance_target": {
    "revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
    "p3_poseidon2_checksum": "522986377b2164c5f94f2dae88e0e0a3d169cc6239202ef4aeb4322d60feffd0",
    "p3_baby_bear_checksum": "d69e6e9af4eaaaa60f7bb9f0e0f73ebcbaefe7e00974d97ad0fa542d6a4f0890",
    "found_in": "aerenew/zk-circuits/*/Cargo.lock and aerenew/rollup-evm-validity/*/Cargo.lock"
  },
  "confirmed": [
    "CONFIRMED round constants: 128 external + 13 internal from seed_from_u64(1) / new_from_rng_128",
    "CONFIRMED ROUNDS_F=8, ROUNDS_P=13 (poseidon2_round_numbers_128(16, 7))",
    "CONFIRMED M4 = [[2,3,1,1],[1,2,3,1],[1,1,2,3],[3,1,1,2]] (recovered from Poseidon2ExternalMatrixGeneral)",
    "CONFIRMED INTERNAL_DIAG_M1_16 (canonical) and the R^{-1}*(J+diag(D)) internal-layer form (Montgomery artifact, recovered exactly from DiffusionMatrixBabyBear's 16x16 canonical matrix)",
    "CONFORMANCE KAT PASSED against p3-baby-bear / p3-poseidon2 0.4.3-succinct (checksums matched)"
  ],
  "flags": [
    "[VERIFY] the SP1 v6.1.0 Merkle/MMCS compression convention (padding/rate, which 8 lanes) for compress2to1 (component (c)) is not yet pinned"
  ],
  "notes": [
    "S-box x^7 CONFIRMED: 7 is the smallest d>1 with gcd(d, p-1)=1 (p-1 = 2^27*3*5), so x^7 is a bijection on F_p",
    "permutation is a bijection: inverse round-trips on 3000 random states + fixed set; 3000 distinct outputs, 0 collisions",
    "M4 is MDS (all 69 square submatrices nonsingular); external layer M_E and internal layer M_I = R^{-1}*(J + diag(D)) are invertible over F_p (both CONFIRMED vs p3)",
    "CONFORMANCE: 3/3 known-answer vectors from p3-baby-bear/p3-poseidon2 0.4.3-succinct reproduced exactly (zeros, iota [0..15], testvec)",
    "cross-language implementations compared: java, node, python"
  ],
  "passed": 47017,
  "failed": 0,
  "total": 47017
}