prover(conglomeration): implements the proof aggregation mechanism

prover/crypto/vortex/opening_prover.go

@@ -41,7 +41,6 @@ type OpeningProof struct {
 // functions and is motivated by the fact that this is simpler to construct in
 // our settings.
 func (params *Params) InitOpeningWithLC(committedSV []smartvectors.SmartVector, randomCoin field.Element) *OpeningProof {
-	proof := OpeningProof{}
 
 	if len(committedSV) == 0 {
 		utils.Panic("attempted to open an empty witness")
@@ -55,15 +54,48 @@ func (params *Params) InitOpeningWithLC(committedSV []smartvectors.SmartVector,
 		for i := range committedSV {
 			subTask = append(subTask, committedSV[i].SubVector(start, stop))
 		}
-		// Collect the result in the larger slice at the end
 
+		// Collect the result in the larger slice at the end
 		subResult := smartvectors.PolyEval(subTask, randomCoin)
 		subResult.WriteInSlice(linComb[start:stop])
 	})
 
 	linCombSV := smartvectors.NewRegular(linComb)
-	proof.LinearCombination = params.rsEncode(linCombSV, nil)
-	return &proof
+
+	return &OpeningProof{
+		LinearCombination: params.rsEncode(linCombSV, nil),
+	}
+}
+
+// InitOpeningFromAlreadyEncodedLC initiates the construction of a Vortex proof
+// by returning the encoding of the linear combinations of the committed
+// row-vectors contained in committedSV by the successive powers of randomCoin.
+//
+// The returned proof is partially assigned and must be completed using
+// [WithEntryList] to conclude the opening protocol.
+func (params *Params) InitOpeningFromAlreadyEncodedLC(rsCommittedSV EncodedMatrix, randomCoin field.Element) *OpeningProof {
+
+	if len(rsCommittedSV) == 0 {
+		utils.Panic("attempted to open an empty witness")
+	}
+
+	// Compute the linear combination
+	linComb := make([]field.Element, params.NumEncodedCols())
+
+	parallel.ExecuteChunky(len(linComb), func(start, stop int) {
+		subTask := make([]smartvectors.SmartVector, 0, len(rsCommittedSV))
+		for i := range rsCommittedSV {
+			subTask = append(subTask, rsCommittedSV[i].SubVector(start, stop))
+		}
+
+		// Collect the result in the larger slice at the end
+		subResult := smartvectors.PolyEval(subTask, randomCoin)
+		subResult.WriteInSlice(linComb[start:stop])
+	})
+
+	return &OpeningProof{
+		LinearCombination: smartvectors.NewRegular(linComb),
+	}
 }
 
 // Complete completes the proof adding the columns pointed by entryList

prover/protocol/column/status.go

@@ -55,7 +55,7 @@ const (
 	// protocol. Meaning that this is not part of the proof.
 	//
 	// Deprecated: we don't really use this to create public inputs.
-	PublicInput
+	_
 	// VerifyingKey indicates the column is defined offline during the definition
 	// of the protocol or the compilation and that the column is directly
 	// available to the verifier. It is preferable to avoid tagging large
@@ -82,8 +82,6 @@ func (s Status) String() string {
 		return "PROOF"
 	case Precomputed:
 		return "PRECOMPUTED"
-	case PublicInput:
-		return "PUBLIC_INPUT"
 	case VerifyingKey:
 		return "VERIFYING_KEY"
 	case VerifierDefined:
@@ -95,7 +93,7 @@ func (s Status) String() string {
 // IsPublic returns true if the column is visible to the verifier
 func (s Status) IsPublic() bool {
 	switch s {
-	case Proof, PublicInput, VerifyingKey, VerifierDefined:
+	case Proof, VerifyingKey, VerifierDefined:
 		return true
 	default:
 		return false

prover/protocol/column/store.go

@@ -49,6 +49,12 @@ type storedColumnInfo struct {
 	// FullRecursion. This field is only meaningfull for [Ignored] columns as
 	// they are excluded by default.
 	IncludeInProverFS bool
+	// ExcludeFromProverFS states the prover should not include the column in
+	// his FS transcript. This overrides [IncludeInProverFS], meaning that if
+	// [IncludeInProverFS] is true but ExcludeFromProverFS is true, the column
+	// will still be excluded from the transcript. This is used explicit FS
+	// compilation.
+	ExcludeFromProverFS bool
 }
 
 // AddToRound constructs a [Natural], registers it in the [Store] and returns
@@ -165,19 +171,6 @@ func (r *Store) AllKeysProof() []ifaces.ColID {
 	return res
 }
 
-// AllKeysPublicInput returns the list of the [PublicInput] column's ID ordered
-// by rounds and then by order ot insertion.
-func (r *Store) AllKeysPublicInput() []ifaces.ColID {
-	res := []ifaces.ColID{}
-
-	for round := 0; round < r.NumRounds(); round++ {
-		proof := r.AllKeysPublicInputAt(round)
-		res = append(res, proof...)
-	}
-
-	return res
-}
-
 // AllKeysCommitted returns the list of all the IDs of the all the [Committed]
 // columns ordered by rounds and then by IDs.
 func (r *Store) AllKeysCommitted() []ifaces.ColID {
@@ -227,22 +220,6 @@ func (r *Store) AllKeysProofAt(round int) []ifaces.ColID {
 	return res
 }
 
-// AllKeysPublicInputAt returns the list of all the prover messages in a given
-// round. The resulting slice is ordered by order of insertion.
-func (r *Store) AllKeysPublicInputAt(round int) []ifaces.ColID {
-	res := []ifaces.ColID{}
-	rnd := r.byRounds.MustGet(round)
-
-	for i, info := range rnd {
-		if info.Status != PublicInput {
-			continue
-		}
-		res = append(res, rnd[i].ID)
-	}
-
-	return res
-}
-
 // Returns the list of all the [Precomputed] columns' ID. The returned slice is
 // ordered by rounds and then by order of insertion.
 func (r *Store) AllPrecomputed() []ifaces.ColID {
@@ -442,10 +419,6 @@ func assertCorrectStatusTransition(old, new Status) {
 	// If it's ignored, it's ignored
 	case old == Ignored && new != Ignored:
 		forbiddenTransition = true
-	// You can't change the status of the public inputs because that would
-	// change the statement of the zkEVM.
-	case old == PublicInput && new != PublicInput:
-		forbiddenTransition = true
 	// It's a special status and cannot be changed.
 	case old == VerifierDefined && new != VerifierDefined:
 		forbiddenTransition = true
@@ -466,23 +439,46 @@ func (s *Store) IgnoreButKeepInProverTranscript(colName ifaces.ColID) {
 	in.IncludeInProverFS = true
 }
 
-// IsIgnoredAndNotKeptInTranscript indicates whether the column can be ignored
-// from the transcript and is used during the Fiat-Shamir randomness generation.
-func (s *Store) IsIgnoredAndNotKeptInTranscript(colName ifaces.ColID) bool {
+// ExcludeFromProverFS marks a column as excluded from the FS transcript but
+// without changing its status. This is used as part of the conglomeration
+// where the imported columns take part in a separate FS transcript from the
+// canonical of the host wizard.
+func (s *Store) ExcludeFromProverFS(colName ifaces.ColID) {
 	in := s.info(colName)
-	return in.Status == Ignored && !in.IncludeInProverFS
+	in.ExcludeFromProverFS = true
+}
+
+// isExcludedFromProverFS returns true if the passed column ID relates to a column
+// that does not take part in the FS transcript.
+func (in *storedColumnInfo) isExcludedFromProverFS() bool {
+
+	if in.ExcludeFromProverFS {
+		return true
+	}
+
+	if in.IncludeInProverFS {
+		return false
+	}
+
+	return true
+}
+
+// IsExplicitlyExcludedFromProverFS returns true if the passed column ID relates to
+// a column explicitly marked as excluded from the FS transcript.
+func (s *Store) IsExplicitlyExcludedFromProverFS(colName ifaces.ColID) bool {
+	info := s.info(colName)
+	return info.ExcludeFromProverFS
 }
 
-// AllKeysProofsOrIgnoredButKeptInProverTranscript returns the list of the
-// columns to be used as part of the FS transcript.
-func (s *Store) AllKeysProofsOrIgnoredButKeptInProverTranscript(round int) []ifaces.ColID {
+// AllKeysInProverTranscript returns the list of the columns to
+// be used as part of the FS transcript.
+func (s *Store) AllKeysInProverTranscript(round int) []ifaces.ColID {
 	res := []ifaces.ColID{}
 	rnd := s.byRounds.MustGet(round) // precomputed are always at round zero
 
 	for i, info := range rnd {
 
-		ok := (info.Status == Proof) || (info.Status == Ignored && info.IncludeInProverFS)
-		if !ok {
+		if info.isExcludedFromProverFS() {
 			continue
 		}
 

prover/protocol/column/verifiercol/from_alleged_ys.go

@@ -9,7 +9,7 @@ import (
 	"github.com/consensys/linea-monorepo/prover/protocol/ifaces"
 	"github.com/consensys/linea-monorepo/prover/protocol/query"
 	"github.com/consensys/linea-monorepo/prover/protocol/wizard"
-	"github.com/sirupsen/logrus"
+	"github.com/consensys/linea-monorepo/prover/utils"
 )
 
 // compile check to enforce the struct to belong to the corresponding interface
@@ -39,10 +39,9 @@ func NewFromYs(comp *wizard.CompiledIOP, q query.UnivariateEval, ranges []ifaces
 		nameMap[polName.GetColID()] = struct{}{}
 	}
 
-	// No make the explicit check
 	for _, rangeName := range ranges {
 		if _, ok := nameMap[rangeName]; !ok && !strings.Contains(string(rangeName), "SHADOW") {
-			logrus.Debugf("NewFromYs : %v is not part of the query %v. It will be zeroized", rangeName, q.QueryID)
+			utils.Panic("NewFromYs : %v is not part of the query %v", rangeName, q.QueryID)
 		}
 	}
 

prover/protocol/compiler/dummy/dummy.go

@@ -84,7 +84,7 @@ func Compile(comp *wizard.CompiledIOP) {
 		One step to be run at the end, by verifying every constraint
 		"a la mano"
 	*/
-	verifier := func(run *wizard.VerifierRuntime) error {
+	verifier := func(run wizard.Runtime) error {
 
 		logrus.Infof("started to run the dummy verifier")
 
@@ -137,6 +137,6 @@ func Compile(comp *wizard.CompiledIOP) {
 	}
 
 	logrus.Debugf("NB: The gnark circuit does not check the verifier of the dummy reduction\n")
-	comp.InsertVerifier(numRounds-1, verifier, func(frontend.API, *wizard.WizardVerifierCircuit) {})
+	comp.InsertVerifier(numRounds-1, verifier, func(frontend.API, wizard.GnarkRuntime) {})
 
 }

prover/protocol/compiler/fullrecursion/actions.go

@@ -73,11 +73,11 @@ func (c LocalOpeningAssignment) Run(run *wizard.ProverRuntime) {
 	}
 }
 
-func (c *ConsistencyCheck) Run(run *wizard.VerifierRuntime) error {
+func (c *ConsistencyCheck) Run(run wizard.Runtime) error {
 
 	var (
 		initialFsCirc = run.GetLocalPointEvalParams(c.LocalOpenings[0].ID).Y
-		initialFsRt   = run.FiatShamirHistory[c.FirstRound+1][0][0]
+		initialFsRt   = run.FsHistory()[c.FirstRound+1][0][0]
 		piCursor      = 2
 	)
 
@@ -131,11 +131,11 @@ func (c *ConsistencyCheck) Run(run *wizard.VerifierRuntime) error {
 	return nil
 }
 
-func (c *ConsistencyCheck) RunGnark(api frontend.API, run *wizard.WizardVerifierCircuit) {
+func (c *ConsistencyCheck) RunGnark(api frontend.API, run wizard.GnarkRuntime) {
 
 	var (
 		initialFsCirc = run.GetLocalPointEvalParams(c.LocalOpenings[0].ID).Y
-		initialFsRt   = run.FiatShamirHistory[c.FirstRound+1][0][0]
+		initialFsRt   = run.FsHistory()[c.FirstRound+1][0][0]
 		piCursor      = 2
 	)
 
@@ -187,15 +187,15 @@ func (c *ConsistencyCheck) IsSkipped() bool {
 	return c.isSkipped
 }
 
-func (r *ResetFsActions) Run(run *wizard.VerifierRuntime) error {
+func (r *ResetFsActions) Run(run wizard.Runtime) error {
 	finalFsCirc := run.GetLocalPointEvalParams(r.LocalOpenings[1].ID).Y
-	run.FS.SetState([]field.Element{finalFsCirc})
+	run.Fs().SetState([]field.Element{finalFsCirc})
 	return nil
 }
 
-func (r *ResetFsActions) RunGnark(api frontend.API, run *wizard.WizardVerifierCircuit) {
+func (r *ResetFsActions) RunGnark(api frontend.API, run wizard.GnarkRuntime) {
 	finalFsCirc := run.GetLocalPointEvalParams(r.LocalOpenings[1].ID).Y
-	run.FS.SetState([]frontend.Variable{finalFsCirc})
+	run.Fs().SetState([]frontend.Variable{finalFsCirc})
 }
 
 func (r *ResetFsActions) Skip() {

prover/protocol/compiler/fullrecursion/circuit.go

@@ -20,7 +20,7 @@ type gnarkCircuit struct {
 	X              frontend.Variable   `gnark:",public"`
 	Ys             []frontend.Variable `gnark:",public"`
 	Pubs           []frontend.Variable `gnark:",public"`
-	WizardVerifier *wizard.WizardVerifierCircuit
+	WizardVerifier wizard.GnarkRuntime
 	comp           *wizard.CompiledIOP `gnark:"-"`
 	ctx            *fullRecursionCtx   `gnark:"-"`
 	withoutGkr     bool                `gnark:"-"`
@@ -66,7 +66,7 @@ func allocateGnarkCircuit(comp *wizard.CompiledIOP, ctx *fullRecursionCtx) *gnar
 
 func (c *gnarkCircuit) Define(api frontend.API) error {
 
-	w := c.WizardVerifier
+	w := c.WizardVerifier.(*wizard.WizardVerifierCircuit)
 
 	if c.withoutGkr {
 		w.FS = fiatshamir.NewGnarkFiatShamir(api, nil)
@@ -116,7 +116,7 @@ func (c *gnarkCircuit) generateAllRandomCoins(api frontend.API) {
 
 	var (
 		ctx = c.ctx
-		w   = c.WizardVerifier
+		w   = c.WizardVerifier.(*wizard.WizardVerifierCircuit)
 	)
 
 	w.FS.SetState([]frontend.Variable{c.InitialFsState})
@@ -129,6 +129,11 @@ func (c *gnarkCircuit) generateAllRandomCoins(api frontend.API) {
 
 			toUpdateFS := ctx.Columns[currRound-1]
 			for _, msg := range toUpdateFS {
+
+				if c.comp.Columns.IsExplicitlyExcludedFromProverFS(msg.GetColID()) {
+					continue
+				}
+
 				val := w.GetColumn(msg.GetColID())
 				w.FS.UpdateVec(val)
 			}

prover/protocol/compiler/globalcs/evaluation.go

@@ -165,7 +165,7 @@ func (pa evaluationProver) Run(run *wizard.ProverRuntime) {
 }
 
 // Run evaluate the constraint and checks that
-func (ctx *evaluationVerifier) Run(run *wizard.VerifierRuntime) error {
+func (ctx *evaluationVerifier) Run(run wizard.Runtime) error {
 
 	var (
 		// Will be assigned to "X", the random point at which we check the constraint.
@@ -239,7 +239,7 @@ func (ctx *evaluationVerifier) Run(run *wizard.VerifierRuntime) error {
 }
 
 // Verifier step, evaluate the constraint and checks that
-func (ctx *evaluationVerifier) RunGnark(api frontend.API, c *wizard.WizardVerifierCircuit) {
+func (ctx *evaluationVerifier) RunGnark(api frontend.API, c wizard.GnarkRuntime) {
 
 	// Will be assigned to "X", the random point at which we check the constraint.
 	r := c.GetRandomCoinField(ctx.EvalCoin.Name)
@@ -299,7 +299,7 @@ func (ctx *evaluationVerifier) RunGnark(api frontend.API, c *wizard.WizardVerifi
 
 // recombineQuotientSharesEvaluation returns the evaluations of the quotients
 // on point r
-func (ctx evaluationVerifier) recombineQuotientSharesEvaluation(run *wizard.VerifierRuntime, r field.Element) ([]field.Element, error) {
+func (ctx evaluationVerifier) recombineQuotientSharesEvaluation(run wizard.Runtime, r field.Element) ([]field.Element, error) {
 
 	var (
 		// res stores the list of the recombined quotient evaluations for each
@@ -386,7 +386,7 @@ func (ctx evaluationVerifier) recombineQuotientSharesEvaluation(run *wizard.Veri
 
 // recombineQuotientSharesEvaluation returns the evaluations of the quotients
 // on point r
-func (ctx evaluationVerifier) recombineQuotientSharesEvaluationGnark(api frontend.API, run *wizard.WizardVerifierCircuit, r frontend.Variable) []frontend.Variable {
+func (ctx evaluationVerifier) recombineQuotientSharesEvaluationGnark(api frontend.API, run wizard.GnarkRuntime, r frontend.Variable) []frontend.Variable {
 
 	var (
 		// res stores the list of the recombined quotient evaluations for each

prover/protocol/compiler/grandproduct/compiler.go

@@ -101,7 +101,7 @@ type FinalProductCheck struct {
 }
 
 // Run implements the [wizard.VerifierAction]
-func (f *FinalProductCheck) Run(run *wizard.VerifierRuntime) error {
+func (f *FinalProductCheck) Run(run wizard.Runtime) error {
 
 	// zProd stores the product of the ending values of the zs as queried
 	// in the protocol via the local opening queries.
@@ -122,7 +122,7 @@ func (f *FinalProductCheck) Run(run *wizard.VerifierRuntime) error {
 }
 
 // RunGnark implements the [wizard.VerifierAction]
-func (f *FinalProductCheck) RunGnark(api frontend.API, run *wizard.WizardVerifierCircuit) {
+func (f *FinalProductCheck) RunGnark(api frontend.API, run wizard.GnarkRuntime) {
 
 	claimedProd := run.GetGrandProductParams(f.GrandProductID).Prod
 	// zProd stores the product of the ending values of the z columns