Merge remote-tracking branch 'origin/next' into lw/out_hash_per_epoch

Author: LeilaWang

barretenberg/cpp/pil/vm2/bytecode/bc_retrieval.pil

@@ -54,7 +54,7 @@ pol commit current_class_id;
 // contract class members.
 // See barretenberg/cpp/src/barretenberg/vm2/common/aztec_types.hpp
 pol commit artifact_hash;
-pol commit private_function_root;
+pol commit private_functions_root;
 // Note that bytecode_id is used as public_bytecode_commitment!
 
 // current state
@@ -128,12 +128,12 @@ should_retrieve = sel * (1 - error);
 should_retrieve {
   current_class_id,
   artifact_hash,
-  private_function_root,
+  private_functions_root,
   /*public_bytecode_commitment=*/ bytecode_id
 } in class_id_derivation.sel {
   class_id_derivation.class_id,
   class_id_derivation.artifact_hash,
-  class_id_derivation.private_function_root,
+  class_id_derivation.private_functions_root,
   class_id_derivation.public_bytecode_commitment
 };
 
@@ -161,7 +161,7 @@ sel * (1 - instance_exists) * (current_class_id - 0) = 0;
 #[ARTIFACT_HASH_IS_ZERO_IF_ERROR]
 error * (artifact_hash - 0) = 0;
 #[PRIVATE_FUNCTION_ROOT_IS_ZERO_IF_ERROR]
-error * (private_function_root - 0) = 0;
+error * (private_functions_root - 0) = 0;
 #[BYTECODE_ID_IS_ZERO_IF_ERROR]
 error * (bytecode_id - 0) = 0;
 

barretenberg/cpp/pil/vm2/bytecode/class_id_derivation.pil

@@ -14,10 +14,10 @@ namespace class_id_derivation;
 
     // Members of Contract Class Id, looked up with bc_retrieval
     pol commit artifact_hash;
-    pol commit private_function_root;
+    pol commit private_functions_root;
     pol commit public_bytecode_commitment; // This is constrained via executions's lookup to instr_fetching, which looks up bc_decomposition <-> bc_hashing
     // The result of
-    // H(GENERATOR_INDEX__CONTRACT_LEAF, artifact_hash, private_function_root, public_bytecode_commitment)
+    // H(GENERATOR_INDEX__CONTRACT_LEAF, artifact_hash, private_functions_root, public_bytecode_commitment)
     pol commit class_id;
 
     // TODO: We need these temporarily while we dont allow for aliases in the lookup tuple.
@@ -28,7 +28,7 @@ namespace class_id_derivation;
 
     // Since the inputs to poseidon2 have to be chunks of 3, we need two lookups if we want to do this in a single row
     #[CLASS_ID_POSEIDON2_0]
-    sel { gen_index_contract_leaf, artifact_hash, private_function_root, class_id, const_two }
+    sel { gen_index_contract_leaf, artifact_hash, private_functions_root, class_id, const_two }
     in poseidon2_hash.start { poseidon2_hash.input_0, poseidon2_hash.input_1, poseidon2_hash.input_2, poseidon2_hash.output, poseidon2_hash.num_perm_rounds_rem };
 
     #[CLASS_ID_POSEIDON2_1]

barretenberg/cpp/scripts/test_chonk_standalone_vks_havent_changed.sh

@@ -13,7 +13,7 @@ cd ..
 # - Generate a hash for versioning: sha256sum bb-chonk-inputs.tar.gz
 # - Upload the compressed results: aws s3 cp bb-chonk-inputs.tar.gz s3://aztec-ci-artifacts/protocol/bb-chonk-inputs-[hash(0:8)].tar.gz
 # Note: In case of the "Test suite failed to run ... Unexpected token 'with' " error, need to run: docker pull aztecprotocol/build:3.0
-pinned_short_hash="79b094d8"
+pinned_short_hash="d99ed82f"
 pinned_chonk_inputs_url="https://aztec-ci-artifacts.s3.us-east-2.amazonaws.com/protocol/bb-chonk-inputs-${pinned_short_hash}.tar.gz"
 
 function compress_and_upload {

barretenberg/cpp/src/barretenberg/boomerang_value_detection/graph_description_merge_recursive_verifier.test.cpp

@@ -91,7 +91,10 @@ template <class RecursiveBuilder> class BoomerangRecursiveMergeVerifierTest : pu
         auto merge_transcript = std::make_shared<StdlibTranscript<RecursiveBuilder>>();
         RecursiveMergeVerifier verifier{ settings, merge_transcript };
         const stdlib::Proof<RecursiveBuilder> stdlib_merge_proof(outer_circuit, merge_proof);
-        [[maybe_unused]] auto [pairing_points, recursive_merged_table_commitments, degree_check_verified] =
+        [[maybe_unused]] auto [pairing_points,
+                               recursive_merged_table_commitments,
+                               degree_check_verified,
+                               concatenation_check_verified] =
             verifier.verify_proof(stdlib_merge_proof, recursive_merge_commitments);
 
         // Check for a failure flag in the recursive verifier circuit

barretenberg/cpp/src/barretenberg/chonk/chonk.test.cpp

@@ -316,7 +316,7 @@ HEAVY_TEST(ChonkKernelCapacity, MaxCapacityPassing)
 {
     bb::srs::init_file_crs_factory(bb::srs::bb_crs_path());
 
-    const size_t NUM_APP_CIRCUITS = 27;
+    const size_t NUM_APP_CIRCUITS = 31;
     auto [proof, vk] = ChonkTests::accumulate_and_prove_ivc(NUM_APP_CIRCUITS);
 
     bool verified = Chonk::verify(proof, vk);

barretenberg/cpp/src/barretenberg/chonk/mock_circuit_producer.hpp

@@ -167,6 +167,8 @@ class PrivateFunctionExecutionMockCircuitProducer {
     {
         const bool is_kernel = is_kernel_flags[circuit_counter++];
         const bool use_large_circuit = large_first_app && (circuit_counter == 1); // first circuit is size 2^19
+        // Check if this is one of the trailing kernels (reset, tail, hiding)
+        const bool is_trailing_kernel = (ivc.num_circuits_accumulated >= ivc.get_num_circuits() - NUM_TRAILING_KERNELS);
 
         ClientCircuit circuit{ ivc.goblin.op_queue };
         // if the number of gates is specified we just add a number of arithmetic gates
@@ -179,8 +181,12 @@ class PrivateFunctionExecutionMockCircuitProducer {
         } else {
             // If the number of gates is not specified we create a structured mock circuit
             if (is_kernel) {
-                GoblinMockCircuits::construct_mock_folding_kernel(circuit); // construct mock base logic
-                mock_databus.populate_kernel_databus(circuit);              // populate databus inputs/outputs
+                // For trailing kernels (reset, tail, hiding), skip the expensive mock kernel logic to match real Noir
+                // flows. These kernels are simpler and mainly contain the completion logic added by Chonk.
+                if (!is_trailing_kernel) {
+                    GoblinMockCircuits::construct_mock_folding_kernel(circuit); // construct mock base logic
+                }
+                mock_databus.populate_kernel_databus(circuit); // populate databus inputs/outputs
             } else {
                 GoblinMockCircuits::construct_mock_app_circuit(circuit, use_large_circuit); // construct mock app
                 mock_databus.populate_app_databus(circuit);                                 // populate databus outputs
@@ -214,9 +220,18 @@ class PrivateFunctionExecutionMockCircuitProducer {
                 }
             } else {
                 if (is_kernel) {
-                    BB_ASSERT_EQ(log2_dyadic_size,
-                                 18UL,
-                                 "There has been a change in the number of gates of a mock kernel circuit.");
+                    // Trailing kernels (reset, tail, hiding) are simpler than regular kernels
+                    if (is_trailing_kernel) {
+                        // Trailing kernels should be significantly smaller, with hiding kernel < 2^16
+                        BB_ASSERT_LTE(log2_dyadic_size,
+                                      16UL,
+                                      "Trailing kernel circuit size has exceeded expected bound (should be <= 2^16).");
+                        vinfo("Log number of gates in a trailing kernel circuit is: ", log2_dyadic_size);
+                    } else {
+                        BB_ASSERT_EQ(log2_dyadic_size,
+                                     18UL,
+                                     "There has been a change in the number of gates of a mock kernel circuit.");
+                    }
                 } else {
                     BB_ASSERT_EQ(log2_dyadic_size,
                                  use_large_circuit ? 19UL : 17UL,

barretenberg/cpp/src/barretenberg/constants.hpp

@@ -48,7 +48,7 @@ static constexpr uint32_t NUM_LIBRA_COMMITMENTS = 3;
 // extra evaluations
 static constexpr uint32_t NUM_SMALL_IPA_EVALUATIONS = 4;
 
-static constexpr uint32_t MERGE_PROOF_SIZE = 49; // used to ensure mock proofs are generated correctly
+static constexpr uint32_t MERGE_PROOF_SIZE = 42; // used to ensure mock proofs are generated correctly
 
 // There are 5 distinguished wires in ECCVM that have to be opened as univariates to establish the connection between
 // ECCVM and Translator

barretenberg/cpp/src/barretenberg/dsl/acir_format/ec_operations.cpp

@@ -66,17 +66,13 @@ void create_ec_add_constraint(Builder& builder, const EcAdd& input, bool has_val
     // Step 2.
     cycle_group_ct result = input1_point + input2_point;
 
-    if (!predicate.is_constant()) {
-        cycle_group_ct to_be_asserted_equal = cycle_group_ct::conditional_assign(predicate, input_result, result);
-        result.assert_equal(to_be_asserted_equal);
-    } else {
-        // The assert_equal method standardizes both points before comparing, so if either of them is the point at
-        // infinity, the coordinates will be assigned to be (0,0). This is OK as long as Noir developers do not use the
-        // coordinates of a point at infinity (otherwise input_result might be the point at infinity different from (0,
-        // 0, true), and the fact that assert_equal passes doesn't imply anything for the original coordinates of
-        // input_result).
-        result.assert_equal(input_result);
-    }
+    // The assert_equal method standardizes both points before comparing, so if either of them is the point at
+    // infinity, the coordinates will be assigned to be (0,0). This is OK as long as Noir developers do not use the
+    // coordinates of a point at infinity (otherwise input_result might be the point at infinity different from (0,
+    // 0, true), and the fact that assert_equal passes doesn't imply anything for the original coordinates of
+    // input_result).
+    cycle_group_ct to_be_asserted_equal = cycle_group_ct::conditional_assign(predicate, input_result, result);
+    result.assert_equal(to_be_asserted_equal);
 }
 
 template void create_ec_add_constraint<bb::UltraCircuitBuilder>(bb::UltraCircuitBuilder& builder,

barretenberg/cpp/src/barretenberg/dsl/acir_format/ec_operations.test.cpp

@@ -56,83 +56,47 @@ template <typename Builder_, InputConstancy Constancy> class EcOperationsTesting
         GrumpkinPoint result = input1 + input2;
         BB_ASSERT(result != GrumpkinPoint::one()); // Ensure that tampering works correctly
 
-        if constexpr (Constancy == InputConstancy::None) {
-            std::vector<uint32_t> input1_indices = add_to_witness_and_track_indices(witness_values, input1);
-            std::vector<uint32_t> input2_indices = add_to_witness_and_track_indices(witness_values, input2);
-            std::vector<uint32_t> result_indices = add_to_witness_and_track_indices(witness_values, result);
-
-            uint32_t predicate_index = static_cast<uint32_t>(witness_values.size());
-            witness_values.emplace_back(FF::one()); // predicate
-
-            ec_add_constraint = EcAdd{
-                .input1_x = WitnessOrConstant<FF>::from_index(input1_indices[0]),
-                .input1_y = WitnessOrConstant<FF>::from_index(input1_indices[1]),
-                .input1_infinite = WitnessOrConstant<FF>::from_index(input1_indices[2]),
-                .input2_x = WitnessOrConstant<FF>::from_index(input2_indices[0]),
-                .input2_y = WitnessOrConstant<FF>::from_index(input2_indices[1]),
-                .input2_infinite = WitnessOrConstant<FF>::from_index(input2_indices[2]),
-                .predicate = WitnessOrConstant<FF>::from_index(predicate_index),
-                .result_x = result_indices[0],
-                .result_y = result_indices[1],
-                .result_infinite = result_indices[2],
-            };
-        } else if constexpr (Constancy == InputConstancy::Input1) {
-            std::vector<uint32_t> input2_indices = add_to_witness_and_track_indices(witness_values, input2);
-            std::vector<uint32_t> result_indices = add_to_witness_and_track_indices(witness_values, result);
-
-            uint32_t predicate_index = static_cast<uint32_t>(witness_values.size());
-            witness_values.emplace_back(FF::one()); // predicate
-
-            ec_add_constraint = EcAdd{
-                .input1_x = WitnessOrConstant<FF>::from_constant(input1.x),
-                .input1_y = WitnessOrConstant<FF>::from_constant(input1.y),
-                .input1_infinite = WitnessOrConstant<FF>::from_constant(input1.is_point_at_infinity() ? FF(1) : FF(0)),
-                .input2_x = WitnessOrConstant<FF>::from_index(input2_indices[0]),
-                .input2_y = WitnessOrConstant<FF>::from_index(input2_indices[1]),
-                .input2_infinite = WitnessOrConstant<FF>::from_index(input2_indices[2]),
-                .predicate = WitnessOrConstant<FF>::from_index(predicate_index),
-                .result_x = result_indices[0],
-                .result_y = result_indices[1],
-                .result_infinite = result_indices[2],
-            };
-        } else if constexpr (Constancy == InputConstancy::Input2) {
-            std::vector<uint32_t> input1_indices = add_to_witness_and_track_indices(witness_values, input1);
-            std::vector<uint32_t> result_indices = add_to_witness_and_track_indices(witness_values, result);
-
-            uint32_t predicate_index = static_cast<uint32_t>(witness_values.size());
-            witness_values.emplace_back(FF::one()); // predicate
-
-            ec_add_constraint = EcAdd{
-                .input1_x = WitnessOrConstant<FF>::from_index(input1_indices[0]),
-                .input1_y = WitnessOrConstant<FF>::from_index(input1_indices[1]),
-                .input1_infinite = WitnessOrConstant<FF>::from_index(input1_indices[2]),
-                .input2_x = WitnessOrConstant<FF>::from_constant(input2.x),
-                .input2_y = WitnessOrConstant<FF>::from_constant(input2.y),
-                .input2_infinite = WitnessOrConstant<FF>::from_constant(input2.is_point_at_infinity() ? FF(1) : FF(0)),
-                .predicate = WitnessOrConstant<FF>::from_index(predicate_index),
-                .result_x = result_indices[0],
-                .result_y = result_indices[1],
-                .result_infinite = result_indices[2],
-            };
-        } else if constexpr (Constancy == InputConstancy::Both) {
-            std::vector<uint32_t> result_indices = add_to_witness_and_track_indices(witness_values, result);
-
-            uint32_t predicate_index = static_cast<uint32_t>(witness_values.size());
-            witness_values.emplace_back(FF::one()); // predicate
-
-            ec_add_constraint = EcAdd{
-                .input1_x = WitnessOrConstant<FF>::from_constant(input1.x),
-                .input1_y = WitnessOrConstant<FF>::from_constant(input1.y),
-                .input1_infinite = WitnessOrConstant<FF>::from_constant(input1.is_point_at_infinity() ? FF(1) : FF(0)),
-                .input2_x = WitnessOrConstant<FF>::from_constant(input2.x),
-                .input2_y = WitnessOrConstant<FF>::from_constant(input2.y),
-                .input2_infinite = WitnessOrConstant<FF>::from_constant(input2.is_point_at_infinity() ? FF(1) : FF(0)),
-                .predicate = WitnessOrConstant<FF>::from_index(predicate_index),
-                .result_x = result_indices[0],
-                .result_y = result_indices[1],
-                .result_infinite = result_indices[2],
-            };
-        }
+        // Helper to add a point: either as witness or constant
+        auto construct_point = [&](const GrumpkinPoint& point, bool as_constant) -> std::vector<WitnessOrConstant<FF>> {
+            if (as_constant) {
+                // Point is constant
+                return { WitnessOrConstant<FF>::from_constant(point.x),
+                         WitnessOrConstant<FF>::from_constant(point.y),
+                         WitnessOrConstant<FF>::from_constant(point.is_point_at_infinity() ? FF(1) : FF(0)) };
+            }
+            // Point is witness
+            std::vector<uint32_t> point_indices = add_to_witness_and_track_indices(witness_values, point);
+            return { WitnessOrConstant<FF>::from_index(point_indices[0]),
+                     WitnessOrConstant<FF>::from_index(point_indices[1]),
+                     WitnessOrConstant<FF>::from_index(point_indices[2]) };
+        };
+
+        // Determine which inputs are constants based on the Constancy template parameter
+        constexpr bool input1_is_constant = (Constancy == InputConstancy::Input1 || Constancy == InputConstancy::Both);
+        constexpr bool input2_is_constant = (Constancy == InputConstancy::Input2 || Constancy == InputConstancy::Both);
+
+        // Add inputs according to constancy template parameter
+        auto input1_fields = construct_point(input1, input1_is_constant);
+        auto input2_fields = construct_point(input2, input2_is_constant);
+
+        // Construct result and predicate as witnesses
+        std::vector<uint32_t> result_indices = add_to_witness_and_track_indices(witness_values, result);
+        uint32_t predicate_index = static_cast<uint32_t>(witness_values.size());
+        witness_values.emplace_back(FF::one()); // predicate
+
+        // Build the constraint
+        ec_add_constraint = EcAdd{
+            .input1_x = input1_fields[0],
+            .input1_y = input1_fields[1],
+            .input1_infinite = input1_fields[2],
+            .input2_x = input2_fields[0],
+            .input2_y = input2_fields[1],
+            .input2_infinite = input2_fields[2],
+            .predicate = WitnessOrConstant<FF>::from_index(predicate_index),
+            .result_x = result_indices[0],
+            .result_y = result_indices[1],
+            .result_infinite = result_indices[2],
+        };
     }
 
     static void override_witness(AcirConstraint& constraint,

barretenberg/cpp/src/barretenberg/dsl/acir_format/ecdsa_constraints.cpp

@@ -108,12 +108,8 @@ void create_ecdsa_verify_constraints(typename Curve::Builder& builder,
         stdlib::ecdsa_verify_signature<Builder, Curve, Fq, Fr, G1>(hashed_message, public_key, { r, s });
 
     // Step 5.
-    if (!input.predicate.is_constant) {
-        // Ensure the circuit is satisfied when predicate is witness false
-        signature_result.assert_equal(bool_ct::conditional_assign(predicate, result, signature_result));
-    } else {
-        signature_result.assert_equal(result);
-    }
+    // Ensure the circuit is satisfied when predicate is witness false
+    signature_result.assert_equal(bool_ct::conditional_assign(predicate, result, signature_result));
 }
 
 /**