6cb0140fae
The public history carried kat/__pycache__/mlkem768_reference.cpython-314.pyc, a compiled Python artifact embedding the operator's absolute local path. Text secret scanners do not read compiled binaries, which is exactly how it slipped through, and removing it from the tip would have left it reachable through the old root commits. So this repository is republished from a single clean root. This root also carries, from the previously unpublished line of work: - corrected LICENSE year, LICENSING.md, VERIFY-POLICY.md, and CITATIONS-UNRESOLVED.md remeasured 2026-08-11 (101 paths, README aligned) - O-018: run_consensus_verification.py ran 19 of 29 models and reported PASS; it now runs all 29, and computemarket_smt.py gains resolveByTimeout / reclaimUnsettled cases plus a negative control - O-006: the word 'audited' removed from next to Bouncy Castle, twice, after a concurrent edit resurrected it - O-014: prior art named and dated - Algorand's native falcon_verify shipped about ten months before AERE's precompiles; the primacy claim is withdrawn where it was implied - bench/ scripts parametrized so they actually run for an outsider (the earlier textual sanitization left $STAGING unexpanded inside Python strings) - AIP-2/AIP-3 errata with measured figures, spec remeasurements at 2026-08-01, and the spec-zk-stack retractions (owner is an operational key, not the Foundation; 'maximally sound' withdrawn; aggregator V1 deprecated) The redacted bench-host environment files from the sanitized line are kept exactly as published; the unredacted local variants are not carried.
251 lines
14 KiB
Python
251 lines
14 KiB
Python
#!/usr/bin/env python3
|
|
# Test harness for the GENERIC AIR constraint / quotient-consistency check (port spec section 6,
|
|
# component (e)). Runs:
|
|
# 1. CONFORMANCE (the real gate): the ground-truth extractor (pq-stark/airquotient-extractor) ran the
|
|
# pinned Plonky3 p3-uni-stark 0.4.3-succinct PROVER + VERIFIER on two KNOWN example AIRs (the
|
|
# Fibonacci AIR from Plonky3's OWN tests/fib_air.rs, and a degree-3 multiply AIR matching
|
|
# tests/mul_air.rs) and confirmed the library ACCEPTS (so the identity folded_constraints(zeta) ==
|
|
# Z_H(zeta)*quotient(zeta) holds for the emitted alpha/zeta/openings). This reference reproduces the
|
|
# ACCEPT for every genuine case and REJECTS three tamper variants per case: a corrupted trace opening,
|
|
# a wrong quotient chunk, a wrong alpha.
|
|
# 2. a perm + generator sanity check tying the ground truth to the CONFIRMED Poseidon2 permutation
|
|
# (component (b)) and BabyBear's multiplicative generator (component (a)).
|
|
# 3. cross-language agreement: Python vs Node vs Java produce byte-identical reconstructed quotient(zeta)
|
|
# and folded_constraints(zeta) (three independent F_{p^4} implementations) and identical flags.
|
|
# Writes ../results/kat-results-air-quotient.json and exits non-zero on any failure.
|
|
#
|
|
# ============================ HONEST SCOPE (read first) ============================
|
|
# This confirms the GENERIC quotient-consistency MECHANISM (component (e)) for a SUPPLIED AIR constraint
|
|
# evaluator. It does NOT port the SP1 RECURSION AIR (its specific multi-thousand-constraint set,
|
|
# interactions, public-value layout) or the verifying-key digest that commits to it: that is a large,
|
|
# program-specific, multi-week piece needing the SP1 toolchain. So this passing GENERIC KAT does NOT let
|
|
# the precompile verify a real SP1 proof: the top-level 0x0AE8 STAYS FAIL-CLOSED for real proofs
|
|
# (StarkConstraints.SP1_RECURSION_AIR_PORTED = false keeps evaluateAtZeta = UNAVAILABLE on the real path;
|
|
# the generic check is exposed only for a supplied example AIR under this KAT). DO NOT ACTIVATE.
|
|
|
|
import json
|
|
import os
|
|
import subprocess
|
|
import sys
|
|
from shutil import which
|
|
|
|
HERE = os.path.dirname(os.path.abspath(__file__))
|
|
sys.path.insert(0, HERE)
|
|
|
|
import air_quotient_reference as R # noqa: E402
|
|
import mmcs_babybear_reference as M # noqa: E402
|
|
|
|
RESULTS = os.path.normpath(os.path.join(HERE, "..", "results", "kat-results-air-quotient.json"))
|
|
GROUND_TRUTH = os.path.join(HERE, "air_quotient_ground_truth.json")
|
|
|
|
_pass = 0
|
|
_fail = 0
|
|
_notes = []
|
|
|
|
|
|
def check(name, cond):
|
|
global _pass, _fail
|
|
if cond:
|
|
_pass += 1
|
|
else:
|
|
_fail += 1
|
|
print(f"FAIL {name}")
|
|
|
|
|
|
# ---- 1/2. conformance (accept genuine, reject tampered) + sanity -----------------------------------
|
|
def conformance():
|
|
gt = R.load_ground_truth()
|
|
check("sanity.perm_zeros", M.permute([0] * 16) == gt["perm_zeros"])
|
|
check("sanity.val_generator", gt["val_generator"] == R.F.GENERATOR)
|
|
for case in gt["cases"]:
|
|
check(f"library_accept.{case['name']}", case["library_accept"])
|
|
check(f"accept.{case['name']}", R.check_case(case))
|
|
check(f"reject.trace.{case['name']}", not R.check_case(case, "trace"))
|
|
check(f"reject.quotient.{case['name']}", not R.check_case(case, "quotient"))
|
|
check(f"reject.alpha.{case['name']}", not R.check_case(case, "alpha"))
|
|
_notes.append(f"CONFORMANCE: {len(gt['cases'])} p3-uni-stark 0.4.3-succinct proofs (Fibonacci + "
|
|
f"degree-3 mul AIR) accepted by the library; the generic quotient identity reproduces "
|
|
f"the accept and rejects 3 tamper variants each (trace opening, quotient chunk, alpha)")
|
|
|
|
|
|
# ---- 3. cross-language agreement (Python vs Node vs Java) -------------------------------------------
|
|
def canonicalize(v):
|
|
def ia(x):
|
|
return [int(e) for e in x]
|
|
|
|
return {
|
|
"valGenerator": int(v["valGenerator"]),
|
|
"cases": [
|
|
{
|
|
"name": c["name"],
|
|
"air": c["air"],
|
|
"degreeBits": int(c["degreeBits"]),
|
|
"quotientDegree": int(c["quotientDegree"]),
|
|
"quotient": ia(c["quotient"]),
|
|
"folded": ia(c["folded"]),
|
|
"invZeroifier": ia(c["invZeroifier"]),
|
|
"accept": bool(c["accept"]),
|
|
"rejectTrace": bool(c["rejectTrace"]),
|
|
"rejectQuotient": bool(c["rejectQuotient"]),
|
|
"rejectAlpha": bool(c["rejectAlpha"]),
|
|
}
|
|
for c in v["cases"]
|
|
],
|
|
}
|
|
|
|
|
|
def cross_language():
|
|
py = canonicalize(R.shared_vectors())
|
|
for c in py["cases"]:
|
|
check(f"py.accept.{c['name']}", c["accept"])
|
|
check(f"py.rejects.{c['name']}", c["rejectTrace"] and c["rejectQuotient"] and c["rejectAlpha"])
|
|
langs = {"python": py}
|
|
|
|
node = which("node")
|
|
if node:
|
|
try:
|
|
out = subprocess.run(
|
|
[node, os.path.join(HERE, "air_quotient_reference.mjs")],
|
|
capture_output=True, text=True, timeout=180, check=True,
|
|
).stdout.strip()
|
|
langs["node"] = canonicalize(json.loads(out))
|
|
except Exception as e: # noqa: BLE001
|
|
_notes.append(f"node cross-check unavailable: {e}")
|
|
else:
|
|
_notes.append("node not found on PATH; node cross-check skipped")
|
|
|
|
javac = which("javac")
|
|
java = which("java")
|
|
if javac and java:
|
|
try:
|
|
subprocess.run(
|
|
[javac, "-d", os.path.join(HERE, "out"), os.path.join(HERE, "AirQuotientSelfTest.java")],
|
|
capture_output=True, text=True, timeout=180, check=True,
|
|
)
|
|
out = subprocess.run(
|
|
[java, "-cp", os.path.join(HERE, "out"), "AirQuotientSelfTest", "--emit", GROUND_TRUTH],
|
|
capture_output=True, text=True, timeout=120, check=True,
|
|
).stdout.strip()
|
|
langs["java"] = canonicalize(json.loads(out))
|
|
except Exception as e: # noqa: BLE001
|
|
_notes.append(f"java cross-check unavailable: {e}")
|
|
else:
|
|
_notes.append("javac/java not found on PATH; java cross-check skipped")
|
|
|
|
for name, data in langs.items():
|
|
if name == "python":
|
|
continue
|
|
check(f"crosslang.{name}.agree", data == py)
|
|
_notes.append("cross-language implementations compared: " + ", ".join(sorted(langs)))
|
|
return sorted(langs)
|
|
|
|
|
|
def main():
|
|
conformance()
|
|
langs = cross_language()
|
|
|
|
report = {
|
|
"component": "GENERIC AIR constraint evaluation + quotient-consistency check over BabyBear "
|
|
"(port spec component (e), the GENERIC mechanism only)",
|
|
"precompile": "0x0000000000000000000000000000000000000ae8",
|
|
"scope": "port spec section 6; the GENERIC quotient-consistency check a p3-uni-stark verifier does "
|
|
"AFTER the PCS opening (verifier.rs lines 90-141): given the out-of-domain trace openings "
|
|
"at zeta (trace_local) and g*zeta (trace_next), the random challenge alpha, the "
|
|
"quotient-chunk openings, and the trace-domain degree, fold the AIR constraints with alpha "
|
|
"(Horner), reconstruct quotient(zeta) from the chunks + split-domain zps, compute Z_H(zeta) "
|
|
"and the first/last/transition selectors, and check "
|
|
"folded_constraints(zeta) == Z_H(zeta) * quotient(zeta), over F_{p^4}.",
|
|
"validates": "CONFORMANCE: real p3-uni-stark 0.4.3-succinct proofs of two KNOWN example AIRs (the "
|
|
"Fibonacci AIR from Plonky3's own tests/fib_air.rs, single quotient chunk; and a "
|
|
"degree-3 multiply AIR matching tests/mul_air.rs, TWO quotient chunks, exercising the "
|
|
"split-domain zps product) are ACCEPTED by the pinned library verifier; this reference "
|
|
"reproduces the accept via the generic quotient identity and rejects three tamper "
|
|
"variants (corrupted trace opening, wrong quotient chunk, wrong alpha); Python/Node/Java "
|
|
"produce byte-identical reconstructed quotient(zeta) and folded_constraints(zeta).",
|
|
"does_not_validate": "the SP1 RECURSION AIR itself (its specific multi-thousand-constraint set, "
|
|
"interactions/permutation argument, public-value layout) and the verifying-key "
|
|
"digest that commits to it. That is a large, program-specific, multi-week port "
|
|
"needing the SP1 toolchain, and is NOT done here. The GENERIC mechanism working "
|
|
"on a small example AIR does NOT mean the precompile can verify a real SP1 proof.",
|
|
"top_level_verifier": "unchanged, still FAIL-CLOSED (returns EMPTY for every input). The generic "
|
|
"quotient check is enabled ONLY for a supplied example AIR under this KAT; on "
|
|
"the real path StarkConstraints.SP1_RECURSION_AIR_PORTED = false keeps "
|
|
"evaluateAtZeta = UNAVAILABLE at stage 4 (before the query loop and before the "
|
|
"single return ACCEPT), so computePrecompile returns EMPTY for a real SP1 "
|
|
"proof and ACCEPT is unreachable. DO NOT ACTIVATE.",
|
|
"confirmed_mechanism": {
|
|
"constraint_fold": "VerifierConstraintFolder (p3-air folder.rs): acc = acc*alpha + constraint, "
|
|
"in the AIR eval() emission order; when_first_row/when_transition/when_last_row "
|
|
"multiply the constraint by the corresponding selector (p3-air air.rs).",
|
|
"trace_domain": "TwoAdicMultiplicativeCoset { log_n = degree_bits, shift = 1 } "
|
|
"(TwoAdicFriPcs::natural_domain_for_degree).",
|
|
"selectors_at_zeta": "z_h = zeta^(2^degree_bits) - 1; is_first = z_h/(zeta-1); "
|
|
"is_last = z_h/(zeta - g^-1); is_transition = zeta - g^-1; "
|
|
"inv_zeroifier = z_h^-1 (p3-commit domain.rs selectors_at_point).",
|
|
"quotient_domain": "create_disjoint_domain: log_n = degree_bits + log_quotient_degree, "
|
|
"shift = trace.shift * Val::generator() = GENERATOR (= 31, CONFIRMED).",
|
|
"chunk_domains": "split_domains(quotient_degree): chunk i has log_n = degree_bits, "
|
|
"shift = GENERATOR * two_adic_generator(degree_bits+log_quotient_degree)^i.",
|
|
"zps": "zps[i] = prod_{j!=i} zp_j(zeta) * zp_j(first_point_i)^-1, "
|
|
"zp_D(pt) = (pt*shift^-1)^(2^log_n) - 1 (p3-commit zp_at_point).",
|
|
"quotient_reconstruction": "quotient = sum_i zps[i] * sum_e monomial(e) * chunk[i][e], "
|
|
"monomial(e) = x^e in F_{p^4} (verifier.rs lines 106-116).",
|
|
"identity": "folded_constraints * inv_zeroifier == quotient "
|
|
"(i.e. folded_constraints(zeta) == Z_H(zeta) * quotient(zeta)); "
|
|
"OodEvaluationMismatch otherwise (verifier.rs lines 137-141).",
|
|
},
|
|
"cross_language": langs,
|
|
"conformance": {
|
|
"status": "CONFIRMED (real known-answer test PASSED: accept genuine + reject tampered)",
|
|
"method": "pq-stark/airquotient-extractor (a Rust binary depending on the pinned p3-uni-stark / "
|
|
"p3-air / p3-baby-bear / p3-commit 0.4.3-succinct crates; lockfile-pinned) ran "
|
|
"p3_uni_stark::prove then p3_uni_stark::verify on the Fibonacci AIR (tests/fib_air.rs, "
|
|
"n=8, pis=[0,1,21]) and a degree-3 multiply AIR (matching tests/mul_air.rs), asserted "
|
|
"the library accepts, and emitted degree_bits / quotient_degree / trace openings / "
|
|
"quotient-chunk openings / alpha (sample_ext) / zeta (sample) by replaying the exact "
|
|
"verifier transcript prefix; its output is air_quotient_ground_truth.json.",
|
|
"cases": [c["name"] for c in R.load_ground_truth()["cases"]],
|
|
},
|
|
"pinned_conformance_target": {
|
|
"revision": "Succinct Plonky3 fork, crates.io version 0.4.3-succinct",
|
|
"crates": ["p3-uni-stark", "p3-air", "p3-baby-bear", "p3-commit", "p3-fri", "p3-matrix"],
|
|
"source_traced": ["p3-uni-stark verifier.rs (quotient-consistency check)",
|
|
"p3-commit domain.rs (selectors_at_point / zp_at_point / split_domains)",
|
|
"p3-air folder.rs + air.rs (VerifierConstraintFolder Horner fold; when_* filters)"],
|
|
},
|
|
"remaining": {
|
|
"sp1_recursion_air": "[MEASURE] the SP1 recursion AIR (exact constraint set + interactions + "
|
|
"public-value binding) and the vkey digest that commits to it; needs the SP1 "
|
|
"toolchain and a real exported SP1 v6.1.0 inner proof. This is the large "
|
|
"program-specific piece; ~3 to 4 person-weeks + audit (spec section 9).",
|
|
"end_to_end_kat": "[MEASURE] an end-to-end ACCEPT/REJECT KAT on a real exported SP1 proof, which "
|
|
"also needs the WireReader proof-body parser and the whole stack wired together.",
|
|
},
|
|
"notes": _notes,
|
|
"passed": _pass,
|
|
"failed": _fail,
|
|
"total": _pass + _fail,
|
|
}
|
|
os.makedirs(os.path.dirname(RESULTS), exist_ok=True)
|
|
with open(RESULTS, "w") as f:
|
|
json.dump(report, f, indent=2)
|
|
|
|
print("\n=== GENERIC AIR quotient-consistency check KAT (component (e), generic mechanism) ===")
|
|
print(f"cross-language: {', '.join(langs)}")
|
|
for nnote in _notes:
|
|
print(f"note: {nnote}")
|
|
print(f"PASS={_pass} FAIL={_fail} TOTAL={_pass + _fail}")
|
|
print(f"results -> {RESULTS}")
|
|
if _fail != 0:
|
|
print("AIR_QUOTIENT_KAT_FAILED")
|
|
sys.exit(1)
|
|
print("CONFORMANCE of the GENERIC AIR quotient-consistency mechanism to Plonky3 p3-uni-stark: "
|
|
"CONFIRMED (real KAT PASSED vs p3-uni-stark 0.4.3-succinct; accept genuine + reject tampered).")
|
|
print("The SP1-recursion-specific AIR + vkey remain UN-PORTED [MEASURE]; the top level stays "
|
|
"FAIL-CLOSED for real SP1 proofs. DO NOT ACTIVATE.")
|
|
print("AIR_QUOTIENT_CONFORMANCE_OK")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|