aere-research/results/kat-results-air-quotient.json

{
  "component": "GENERIC AIR constraint evaluation + quotient-consistency check over BabyBear (port spec component (e), the GENERIC mechanism only)",
  "precompile": "0x0000000000000000000000000000000000000ae8",
  "scope": "port spec section 6; the GENERIC quotient-consistency check a p3-uni-stark verifier does AFTER the PCS opening (verifier.rs lines 90-141): given the out-of-domain trace openings at zeta (trace_local) and g*zeta (trace_next), the random challenge alpha, the quotient-chunk openings, and the trace-domain degree, fold the AIR constraints with alpha (Horner), reconstruct quotient(zeta) from the chunks + split-domain zps, compute Z_H(zeta) and the first/last/transition selectors, and check folded_constraints(zeta) == Z_H(zeta) * quotient(zeta), over F_{p^4}.",
  "validates": "CONFORMANCE: real p3-uni-stark 0.4.3-succinct proofs of two KNOWN example AIRs (the Fibonacci AIR from Plonky3's own tests/fib_air.rs, single quotient chunk; and a degree-3 multiply AIR matching tests/mul_air.rs, TWO quotient chunks, exercising the split-domain zps product) are ACCEPTED by the pinned library verifier; this reference reproduces the accept via the generic quotient identity and rejects three tamper variants (corrupted trace opening, wrong quotient chunk, wrong alpha); Python/Node/Java produce byte-identical reconstructed quotient(zeta) and folded_constraints(zeta).",
  "does_not_validate": "the SP1 RECURSION AIR itself (its specific multi-thousand-constraint set, interactions/permutation argument, public-value layout) and the verifying-key digest that commits to it. That is a large, program-specific, multi-week port needing the SP1 toolchain, and is NOT done here. The GENERIC mechanism working on a small example AIR does NOT mean the precompile can verify a real SP1 proof.",
  "top_level_verifier": "unchanged, still FAIL-CLOSED (returns EMPTY for every input). The generic quotient check is enabled ONLY for a supplied example AIR under this KAT; on the real path StarkConstraints.SP1_RECURSION_AIR_PORTED = false keeps evaluateAtZeta = UNAVAILABLE at stage 4 (before the query loop and before the single return ACCEPT), so computePrecompile returns EMPTY for a real SP1 proof and ACCEPT is unreachable. DO NOT ACTIVATE.",
  "confirmed_mechanism": {
    "constraint_fold": "VerifierConstraintFolder (p3-air folder.rs): acc = acc*alpha + constraint, in the AIR eval() emission order; when_first_row/when_transition/when_last_row multiply the constraint by the corresponding selector (p3-air air.rs).",
    "trace_domain": "TwoAdicMultiplicativeCoset { log_n = degree_bits, shift = 1 } (TwoAdicFriPcs::natural_domain_for_degree).",
    "selectors_at_zeta": "z_h = zeta^(2^degree_bits) - 1; is_first = z_h/(zeta-1); is_last = z_h/(zeta - g^-1); is_transition = zeta - g^-1; inv_zeroifier = z_h^-1 (p3-commit domain.rs selectors_at_point).",
    "quotient_domain": "create_disjoint_domain: log_n = degree_bits + log_quotient_degree, shift = trace.shift * Val::generator() = GENERATOR (= 31, CONFIRMED).",
    "chunk_domains": "split_domains(quotient_degree): chunk i has log_n = degree_bits, shift = GENERATOR * two_adic_generator(degree_bits+log_quotient_degree)^i.",
    "zps": "zps[i] = prod_{j!=i} zp_j(zeta) * zp_j(first_point_i)^-1, zp_D(pt) = (pt*shift^-1)^(2^log_n) - 1 (p3-commit zp_at_point).",
    "quotient_reconstruction": "quotient = sum_i zps[i] * sum_e monomial(e) * chunk[i][e], monomial(e) = x^e in F_{p^4} (verifier.rs lines 106-116).",
    "identity": "folded_constraints * inv_zeroifier == quotient  (i.e. folded_constraints(zeta) == Z_H(zeta) * quotient(zeta)); OodEvaluationMismatch otherwise (verifier.rs lines 137-141)."
  },
  "cross_language": [
    "java",
    "node",
    "python"
  ],
  "conformance": {
    "status": "CONFIRMED (real known-answer test PASSED: accept genuine + reject tampered)",
    "method": "pq-stark/airquotient-extractor (a Rust binary depending on the pinned p3-uni-stark / p3-air / p3-baby-bear / p3-commit 0.4.3-succinct crates; lockfile-pinned) ran p3_uni_stark::prove then p3_uni_stark::verify on the Fibonacci AIR (tests/fib_air.rs, n=8, pis=[0,1,21]) and a degree-3 multiply AIR (matching tests/mul_air.rs), asserted the library accepts, and emitted degree_bits / quotient_degree / trace openings / quotient-chunk openings / alpha (sample_ext) / zeta (sample) by replaying the exact verifier transcript prefix; its output is air_quotient_ground_truth.json.",
    "cases": [
      "fibonacci_n8",
      "mul_deg3_n16"
    ]
  },
  "pinned_conformance_target": {
    "revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
    "crates": [
      "p3-uni-stark",
      "p3-air",
      "p3-baby-bear",
      "p3-commit",
      "p3-fri",
      "p3-matrix"
    ],
    "source_traced": [
      "p3-uni-stark verifier.rs (quotient-consistency check)",
      "p3-commit domain.rs (selectors_at_point / zp_at_point / split_domains)",
      "p3-air folder.rs + air.rs (VerifierConstraintFolder Horner fold; when_* filters)"
    ]
  },
  "remaining": {
    "sp1_recursion_air": "[MEASURE] the SP1 recursion AIR (exact constraint set + interactions + public-value binding) and the vkey digest that commits to it; needs the SP1 toolchain and a real exported SP1 v6.1.0 inner proof. This is the large program-specific piece; ~3 to 4 person-weeks + audit (spec section 9).",
    "end_to_end_kat": "[MEASURE] an end-to-end ACCEPT/REJECT KAT on a real exported SP1 proof, which also needs the WireReader proof-body parser and the whole stack wired together."
  },
  "notes": [
    "CONFORMANCE: 2 p3-uni-stark 0.4.3-succinct proofs (Fibonacci + degree-3 mul AIR) accepted by the library; the generic quotient identity reproduces the accept and rejects 3 tamper variants each (trace opening, quotient chunk, alpha)",
    "cross-language implementations compared: java, node, python"
  ],
  "passed": 18,
  "failed": 0,
  "total": 18
}