[quangvdao]

Summary

This PR adds the two pieces a succinct LaBinius root needs before any sumcheck or commitment exists: a root setup whose matrix nobody chooses, and the root's acceptance condition restated as a digit alphabet, two clear integer range checks and one linear relation over the coefficient field. Both live in the existing opt-in crates akita-labinius-verifier and akita-labinius-prover, behind the off-by-default labinius feature. Tracking issue: #45.

It provides:

• AdmittedRootSetup::<F, D, M>::derive(profile, log_num_cells, log_fold_width, lambda_fold, seed): derives LabiniusRootShape from the profile, takes the certified rank from the width table, expands the trinomial matrix from an AkitaSetupSeed through the shared public prefix, and returns a BinaryClearSetup that cannot be built from a caller-supplied matrix. identity_bytes::<H>() gives a canonical, length-framed identity over every derivation input.
• LoweredRootLayout, LoweredPublic, the witness and image weights (dense and structured multilinear evaluation), check_lowered_clear, and the two decoded residuals a_row_residual and parity_row_residual, in the verifier crate.
• Witness construction in the prover crate: encode_witness (response digit table in the canonical TrinomialResponseLayout order), flatten_image, a_relation_quotients, parity_quotient_and_carry.

The modules take explicit field challenges (alpha, xi, gamma). They define no transcript, no sumcheck, no commitment to the digit table, no polynomial opening and no wire encoding. Nothing on the Akita proof path calls them.

Normative text: specs/labinius-setup-contract.md and specs/labinius-lowered-root.md.

Diff metadata

• Base: f1957d8bceb84edfefd156732f5cee121488267b (quang/labinius-stack)
• Head: f082ef4e968eeafbb9010559cab27677b37e22b1
• Commits: 9 (6 non-merge, 3 merges of the stack's own inputs)
• Files changed: 24
• Diff: 2873 insertions, 11 deletions

Why the base is not dev

This work needs both #198 (the clear opening it lowers) and #199 (the root profile, shape and digit encoding it reads), and neither is merged. quang/labinius-stack is the merge of their current heads and nothing else:

graph LR
  dev["dev 3d69096ea"] --> A["#198 clear opening 2396930e7"]
  dev --> B["#199 root params 991b67651"]
  A --> S["quang/labinius-stack f1957d8bc"]
  B --> S
  S --> P["this PR f082ef4e9"]

Loading

The diff shown here is therefore exactly this PR's surface. Once #198 and #199 land on dev, this PR should be retargeted to dev; the stack branch carries no change of its own and can then be deleted.

Motivation

#198 verifies a binary opening by sending the whole integer response and recomputing two ring equations. #199 fixes the ranges and table lengths a succinct root will commit. What was missing between them is the statement a sumcheck can reduce: which table entries are constrained, by which public weights, to which public constant, and which matrix the weights are computed from.

Two concrete gaps close here:

1. BinaryClearSetup::new accepts any matrix and does no SIS lookup. A root that claims binding needs a matrix derived from a public seed at the certified rank. AdmittedRootSetup is that construction, and it is the only way to obtain one.
2. The clear endpoint's two ring equations hold modulo a trinomial and, for parity, modulo 2. A sumcheck needs a single field equation. Lifting to unreduced polynomial rows with explicit quotients, evaluating at random points, and batching gives <W, K_W> + <Y, K_Y> = c_pub.

Change-surface overview

Area	Before	After
Root setup	explicit matrix only (BinaryClearSetup::new)	admitted.rs: seed-derived matrix at the certified rank, canonical identity
Lowered relation, verifier	none	lowered/{layout,public,weights,check}.rs
Lowered witness, prover	none	lowered/{witness,quotient,parity}.rs
akita-labinius-verifier deps	no akita-types edge	optional akita-types, enabled only by labinius
akita-labinius-prover deps	no akita-types edge	akita-types with default features off
Crate docs	"differential oracle, no SIS lookup"	states which constructor does SIS admission and which does not
docs/crate-graph.md	n/a	one row reworded, one edge added
Existing clear endpoint and its encodings	unchanged	unchanged
Schedule artifacts, SIS tables, planner, akita-pcs	unchanged	unchanged

Admitted setup

derive_trinomial_matrix expands exactly rows * columns * D field elements with derive_public_matrix_prefix::<F> and the caller's seed unchanged. Coefficient t of A[i, j] is the public element at (i * columns + j) * D + t, which is TrinomialASetupView::setup_address(i, j, t) with setup offset zero. The matrix is one view of the shared public prefix: a deployment may store the prefix once for this view and for ordinary Akita matrix views over the same field and seed. Each view is uniform under the expander's random-oracle assumption; no independence between views is claimed.

For an admitted root the matrix is n_A by m. The fold width C counts source columns and does not set the matrix's column count.

Identity bytes, in order: the domain string akita/labinius/admitted-root-setup/v1, the root profile's identity (which binds the certified width-table digest), log_num_cells, log_fold_width, lambda_fold, the admitted rank, the seed derivation tag, the 32 seed bytes, and the nested BinaryClearSetup identity, which binds the matrix-view digest. No second matrix digest is introduced.

The materialising API rejects, before expanding the seed: zero dimensions, zero or odd degree, more than 64 MiB for either the flat prefix or the matrix backing, and more than 64 KiB per ring element. These are host-resource limits, not limits of the numerical admission. The first profile at (log_num_cells, log_fold_width, lambda_fold) = (22, 8, 128) has rank 1, m = 4096, C = 256 and 2,654,208 matrix coefficients (40.5 MiB at 16 bytes each), and a test derives it in full. A shape can pass numerical admission and still exceed the budget: a test derives the shape at (32, 0, 128) and checks that AdmittedRootSetup::derive returns InvalidSetup for it without panicking.

Lowered relation

Write d = 162, Phi(Z) = Z^162 + Z^81 + 1, D = d*k, Phi_D for the commitment trinomial, P_c = D.next_power_of_two(), b for the digit width and dc for the digit count.

Tables. The response digit table uses the canonical layout

W[l + dc*(t + P_c*j)] = digit_l(u[j][t]),   u[j][t] = p[j][t] + off(t)

where p is the signed packing of the scalar response and off(t) is off at positive packing signs and off - 1 at negative signs, so both signs accept exactly the same scalar interval. The image table is Y[t + P_c*e] = images[e].coefficients()[t], padded to a power of two. Layout sizes are read from LabiniusRootEncoding, not recomputed.

Rows. Over the coefficient field,

sum_j A_ij(Y)*p_j(Y) - sum_col iota(Ch_col)(Y)*Y_(col,i)(Y) = Phi_D(Y)*QA_i(Y)

and over the integers,

sum_r B_r(Z)*V_r(Z) - sum_col U_col(Z)*Ch_col(Z) = Phi(Z)*Q(Z) + 2*K(Z).

QA_i has D - 1 coefficients; Q has 161 and K has 162, each checked in the clear against its enforced interval.

Batched relation. At explicit alpha, xi, gamma, with g = gamma^n_A, acceptance is

<W, K_W> + <Y, K_Y> = c_pub

together with the alphabet check on every table position and the two clear range checks. K_W, K_Y and c_pub are defined once in the spec. Weights are zero at coefficient tails t >= D and at image padding; every position is still alphabet-checked. There is no selector and no zero-tail acceptance check.

Structured evaluation. witness_weight_mle and image_weight_mle evaluate the multilinear extensions of K_W and K_Y at a point without building the dense vectors, using TrinomialASetupView::prepare for the matrix part and a product of block factors for the parity part. Tests compare them with the dense weights at random and at Boolean points.

Extension contract (docs/branches.md)

• All new code is in the two LaBinius crates, which exist only on dev, under #![cfg(feature = "labinius")].
• Two changed files also exist on main: Cargo.lock (two akita-types dependency edges for the LaBinius crates) and docs/crate-graph.md (one reworded row, one edge). Neither is compiled.
• With labinius off, the verifier crate has no akita-types edge at all (cargo tree -p akita-labinius-verifier --no-default-features --features transcript-blake2b --edges normal --depth 1 lists none); with it on, nothing is selected, since no proof-path code calls these functions.
• No existing schedule artifact, generated SIS table or estimator data file changes.
• Proof bytes against main: there is no affected configuration. No file on the setup, commitment, prover or verifier path changes, so no proof-byte comparison was run.

Security and verifier safety

What the code establishes, and what it leaves to the protocol that will use it:

• Stated, not proven here. The spec gives the per-challenge survival bounds a later protocol must account for: a false A row survives uniform alpha with probability at most (2D - 2)/|F| (1294/|F| at D = 648); a parity row false modulo P survives uniform xi with probability at most 322/|F|; batching by gamma adds at most n_A/|F|. If the parity row holds modulo P, the alphabet, the clear range checks and the admitted inequality H + 3*2^(e_Q-1) + 2*2^(e_K-1) < P force it to hold over the integers, hence modulo 2 and Phi.
• Ordering obligation. The setup and statement, the evaluation claim, the left expansion, the fold challenges and the image table (or a binding commitment to it) must be fixed before alpha and xi, together with W, QA, Q and K; all evaluated rows must be fixed before gamma. These helpers take challenges as arguments and cannot enforce this. Degenerate explicit challenges can hide false rows.
• Source binding is an obligation sketch, not a theorem. The spec records the intended extraction (two transcripts differing in one fold coordinate, comparison vector of norm at most eta_A = 4*Gamma_inf*Delta < P, SIS at the admitted rank) and lists what remains open.
• The admitted-root identity is not bound by the existing clear protocol. bind_statement binds the nested clear identity only. A caller that needs the profile, shape inputs and seed bound must absorb AdmittedRootSetup::identity_bytes itself. The root reduction that follows in the stack is specified to absorb it first; that code is not in this PR.
• No panics on malformed input. Rejected shapes, type mismatches, zero and odd degrees, empty dimensions and oversized extents return AkitaError::InvalidSetup; the setup tests run each case under catch_unwind and require Ok(Err(InvalidSetup)), so a panic fails the test. Extent products are checked before the seed is expanded.

Commit map

• 9da768dd1: seed-derived admitted root setup and identity.
• 22b6a3881: lowered root relation over the canonical response layout.
• 86e06910c: the layout reads table sizes from the admitted encoding; the admitted setup drives the lowered fixture.
• df21b0b92: the lowered-root spec names the encoding and the setup contract as its sources.
• 161943079: review fixes. The verifier's akita-types edge is gated on the feature, a test derives the first real setup shape, and the spec states what must be fixed before the challenges.
• f082ef4e9: the two crate-level doc comments name admitted, lowered, BinaryClearSetup::new and AdmittedRootSetup::derive as code spans instead of intra-doc links. Each crate is #![cfg(feature = "labinius")], so with the feature off those items do not exist and the CI Documentation job (-D warnings, extension off) failed on the first push of this PR with unresolved link to lowered.
• 33a604086, 692fc3921, 23afd6304: merges that bring the stack's inputs together.

Validation

All at head f082ef4e968eeafbb9010559cab27677b37e22b1, clean worktree, with PKGS = -p akita-labinius-verifier -p akita-labinius-prover:

• cargo test $PKGS --no-default-features --features labinius,transcript-blake2b: 45 passed (13 suites).
• cargo test $PKGS --no-default-features --features labinius,transcript-keccak: 45 passed (13 suites).
• cargo clippy $PKGS --all-targets --no-default-features --features labinius,transcript-blake2b -- -D warnings: no issues.
• cargo clippy $PKGS --all-targets --no-default-features --features transcript-blake2b -- -D warnings (extension off): no issues.
• cargo fmt --all --check, taplo fmt --check: clean.
• scripts/check-crate-deps.sh for akita-labinius-verifier, akita-labinius-prover, akita-verifier, akita-prover, akita-params: passed.
• scripts/check-rust-file-lines.sh --no-baseline, typos, ./scripts/check-doc-guardrails.sh, cargo machete --with-metadata: clean.
• No file under crates/ outside the two LaBinius crates differs from the base.
• cargo tree -p akita-labinius-prover -e features --no-default-features --features transcript-blake2b shows no labinius-* feature enabled with the extension off.
• git diff --check: clean.
• RUSTDOCFLAGS='-D warnings' cargo doc -q --release --no-deps $PKGS --no-default-features --features transcript-blake2b (extension off) and RUSTDOCFLAGS='-D warnings' cargo doc -q --no-deps $PKGS --no-default-features --features labinius,transcript-blake2b: both clean. The CI command documents the whole workspace; locally that stops in akita-algebra on an x86-only link on this ARM host before reaching these crates, so the two crates were documented on their own.

Tests added (25): 13 for the admitted setup in tests/admitted.rs, 7 in tests/lowered.rs, 1 in tests/lowered_oracle.rs, 4 in tests/lowered_tamper.rs. The oracle test recomputes every quotient and carry coefficient with an independent big-integer division and a schoolbook field product. The tamper tests include a mutation that keeps the A row satisfied and breaks parity.

Not run: the full workspace test pass, the three workspace Clippy configurations, schedule regeneration, portability, Jolt compatibility and fuzzing. The lowered relation is exercised at the small admitted geometry (4, 1, 128) for all three digit bases; the (22, 8, 128) shape is derived and checked for its dimensions only, not run through the relation.

Review

Two independent reviews at df21b0b92 (setup contract; lowered relation) both approved with minor findings. Three of the four are fixed in 161943079. The fourth is test coverage and is listed below.

Remaining work

For this surface:

1. Test coverage still missing: an in-alphabet digit mutation isolated at a negative-sign position (t = 4) for each base; malformed fold-challenge and wrong-left-expansion cases for LoweredPublic::new; a padding mutation pinning that arbitrary image tails are accepted.
2. No literal known-answer fixture for the identity bytes per transcript backend or for derived matrix coefficients; determinism and input-sensitivity are tested, exact values are not.
3. Cost at the first profile, before a full-size run is practical: a_relation_quotients is a schoolbook product (about 1.83e9 coefficient products), and witness_weight_mle scans all 2,654,208 matrix coefficients and materialises 4,194,304 field weights (about 64 MiB). Both are correct and slow; neither is on any proof path yet.

Under #45, next in the stack:

1. The root reduction: alphabet and relation sumcheck, Fiat-Shamir order and loss ledger, reducing a binary opening to one evaluation claim on W and one on Y.
2. A prepared NTT commit kernel for the binary source.
3. Wiring both claims into Akita commitments and openings, with caller catalog rows and dev-protocol schedule artifacts.

Reviewer map

1. specs/labinius-setup-contract.md, then crates/akita-labinius-verifier/src/admitted.rs
2. specs/labinius-lowered-root.md
3. crates/akita-labinius-verifier/src/lowered/layout.rs, public.rs, weights.rs, check.rs
4. crates/akita-labinius-prover/src/lowered/witness.rs, quotient.rs, parity.rs
5. crates/akita-labinius-prover/tests/lowered_oracle.rs and lowered_tamper.rs, then admitted.rs and lowered.rs

[github-actions]

Documentation blast radius (advisory)

These regions may need doc/spec/book updates based on changed paths.
This is not a merge gate. See docs/documentation.md.

Changed files in this PR: 24

workspace-crates

Workspace membership and public crate surface

Code paths touched:

• crates/akita-labinius-prover/Cargo.toml
• crates/akita-labinius-verifier/Cargo.toml

Consider updating:

• README.md
• docs/crate-graph.md
• book/src/how/architecture.md

---

Per-PR checklist: spec Status / acceptance criteria; book owning page; AGENTS.md if contracts changed; archive spec after fold.

[github-actions]

PCS Profile Benchmark

• Head: f082ef4
• Workflow run: run 37897785497 attempt 1
• Merge base: f1957d8 from the merge-base benchmarked on this runner.

13 of 13 profiles passed.

Times are medians of 3 measured runs after 1 discarded warmup run. Peak RSS is the largest measured value.

Each sample verifies the same proof first with the configured multi-threaded pool and then with one thread. Both timings reuse the same verifier setup.

Merge-base comparisons are available for 13 of 13 profiles. For matching profiles, the head and merge-base binaries ran interleaved on the same runner.

Benchmark shards

CI shard	Profiles
1-fp32-base	Fp32 dense nv30, direct setup check Fp32 one-hot nv34, direct setup check
2-fp64-base	Fp64 dense nv29, direct setup check Fp64 one-hot nv35, direct setup check
3-fp128-base	Fp128 dense nv28, direct setup check Fp128 one-hot nv36, direct setup check Fp128 one-hot nv36, recursive setup check
4-multi-group-direct	Fp128 multi-group (final nv34, 4 polys total), direct setup check
5-multi-group-recursive	Fp128 multi-group (final nv34, 4 polys total), recursive setup check
6-multi-group-recursive-w8r2	Fp128 multi-group W8R2 (final nv32, 4 polys total), recursive setup check
7-distributed	Fp128 one-hot nv32 W2R2, direct setup check Fp128 one-hot nv32 W4R2, direct setup check Fp128 one-hot nv32 W8R2, direct setup check

Public opening statements

Public opening statement	Profiles
Over Fp32, one committed 30 variable multilinear polynomial with 2^30 coefficients is opened at one 30 coordinate point.	Fp32 dense nv30, direct setup check
Over Fp32, one committed 34 variable multilinear polynomial with 2^34 coefficients is opened at one 34 coordinate point.	Fp32 one-hot nv34, direct setup check
Over Fp64, one committed 29 variable multilinear polynomial with 2^29 coefficients is opened at one 29 coordinate point.	Fp64 dense nv29, direct setup check
Over Fp64, one committed 35 variable multilinear polynomial with 2^35 coefficients is opened at one 35 coordinate point.	Fp64 one-hot nv35, direct setup check
Over Fp128, one committed 28 variable multilinear polynomial with 2^28 coefficients is opened at one 28 coordinate point.	Fp128 dense nv28, direct setup check
Over Fp128, one committed 36 variable multilinear polynomial with 2^36 coefficients is opened at one 36 coordinate point.	Fp128 one-hot nv36, direct setup check Fp128 one-hot nv36, recursive setup check
Over Fp128, 4 polynomials in 3 groups: one 16 variable polynomial at its own point, one 16 variable polynomial at its own point, and 2 34 variable polynomials at one shared point.	Fp128 multi-group (final nv34, 4 polys total), direct setup check Fp128 multi-group (final nv34, 4 polys total), recursive setup check
Over Fp128, 4 polynomials in 3 groups: one 16 variable polynomial at its own point, one 16 variable polynomial at its own point, and 2 32 variable polynomials at one shared point.	Fp128 multi-group W8R2 (final nv32, 4 polys total), recursive setup check
Over Fp128, one committed 32 variable multilinear polynomial with 2^32 coefficients is opened at one 32 coordinate point.	Fp128 one-hot nv32 W2R2, direct setup check Fp128 one-hot nv32 W4R2, direct setup check Fp128 one-hot nv32 W8R2, direct setup check

One-hot profiles generate deterministic witnesses with one 1 in every consecutive chunk of 256 coefficients. This witness shape is not a separate public claim.

Direct evaluates the public setup contribution during Stage 2. Recursive carries the same check through a Stage 3 setup-product sumcheck. Both modes execute the complete fold schedule and terminal verification.

The chunked profiles W2R2, W4R2, W8R2 divide the witness relation into the stated number of exact chunks for the first two fold levels.

Generated profiles may select different A, B, and D ring dimensions at different fold levels. The short profile names omit those dimensions.

Each sample generates deterministic witnesses and opening points, prepares setup, commits, proves, serializes the proof, checks its size, prepares verifier setup, and verifies the claimed openings. It does not test malformed proofs.

Phase time

Profile	Setup	Commit	Prove	Verify, multi-threaded	Verify, single-threaded
Fp32 dense nv30, direct setup check	0.023 s +0.5%	0.952 s -1.4%	1.040 s +0.7%	17.7 ms -7.9%	48.2 ms +0.8%
Fp32 one-hot nv34, direct setup check	0.028 s +1.8%	0.715 s +1.0%	1.125 s +0.0%	21.4 ms +5.6%	64.8 ms +0.1%
Fp64 dense nv29, direct setup check	0.042 s +1.8%	0.714 s +0.3%	0.793 s -0.2%	11.9 ms -1.2%	32.3 ms +0.0%
Fp64 one-hot nv35, direct setup check	0.064 s -0.3%	0.938 s -1.2%	0.952 s +0.1%	13.9 ms +3.1%	63.2 ms +0.0%
Fp128 dense nv28, direct setup check	0.060 s -0.1%	0.718 s +0.3%	0.860 s +2.2%	12.2 ms +2.4%	45.2 ms +0.2%
Fp128 one-hot nv36, direct setup check	0.168 s -0.1%	3.527 s +0.4%	1.795 s +0.7%	21.3 ms +4.3%	115.4 ms +0.0%
Fp128 one-hot nv36, recursive setup check	0.291 s +0.1%	3.486 s -0.2%	2.077 s +1.8%	17.4 ms -2.1%	50.4 ms +0.1%
Fp128 multi-group (final nv34, 4 polys total), direct setup check	0.165 s +0.0%	1.345 s -0.2%	0.874 s +4.2%	16.6 ms -2.6%	97.9 ms -0.1%
Fp128 multi-group (final nv34, 4 polys total), recursive setup check	0.570 s -0.4%	2.199 s +0.1%	1.400 s +0.4%	14.4 ms -2.8%	29.3 ms +0.1%
Fp128 multi-group W8R2 (final nv32, 4 polys total), recursive setup check	0.350 s -8.9%	0.963 s -0.0%	1.751 s +0.8%	24.5 ms +4.0%	61.7 ms -4.1%
Fp128 one-hot nv32 W2R2, direct setup check	0.054 s -0.0%	0.249 s -0.7%	0.522 s +1.4%	13.8 ms -1.8%	40.5 ms +0.6%
Fp128 one-hot nv32 W4R2, direct setup check	0.054 s -0.2%	0.249 s -0.2%	0.638 s +0.3%	15.1 ms -1.1%	46.1 ms +0.0%
Fp128 one-hot nv32 W8R2, direct setup check	0.053 s -0.9%	0.250 s -0.0%	0.844 s -1.4%	17.7 ms -2.8%	56.5 ms -0.3%

Proof size and protocol shape

Profile	Fold A/B/D schedule	Total proof	Terminal response	Terminal response planned maximum	Fold levels	Grinding retries
Fp32 dense nv30, direct setup check	2048/256/256 → 256/256/256 → 128/128/128	64,525 bytes +0.0%	38,585 bytes +0.0%	40,568 bytes +0.0%	7 +0.0%	None
Fp32 one-hot nv34, direct setup check	2048/256/256 → 256/256/256 → 128/128/128	65,487 bytes +0.0%	38,595 bytes +0.0%	40,568 bytes +0.0%	7 +0.0%	None
Fp64 dense nv29, direct setup check	2048/128/128 → 128/128/128	67,073 bytes +0.0%	40,955 bytes +0.0%	42,840 bytes +0.0%	7 +0.0%	None
Fp64 one-hot nv35, direct setup check	512/128/128 → 256/128/128 → 128/128/128	67,716 bytes +0.0%	40,964 bytes +0.0%	42,840 bytes +0.0%	7 +0.0%	None
Fp128 dense nv28, direct setup check	1024/64/64 → 64/64/64	69,109 bytes +0.0%	48,573 bytes +0.0%	50,919 bytes +0.0%	7 +0.0%	None
Fp128 one-hot nv36, direct setup check	512/64/64 → 64/64/64	69,762 bytes +0.0%	48,546 bytes +0.0%	50,919 bytes +0.0%	7 +0.0%	None
Fp128 one-hot nv36, recursive setup check	512/64/64 → 64/64/64	73,129 bytes +0.0%	48,507 bytes +0.0%	50,919 bytes +0.0%	8 +0.0%	None
Fp128 multi-group (final nv34, 4 polys total), direct setup check	256/64/64 → 64/64/64	69,623 bytes +0.0%	48,519 bytes +0.0%	50,919 bytes +0.0%	7 +0.0%	None
Fp128 multi-group (final nv34, 4 polys total), recursive setup check	512/128/128 → 64/64/64	86,037 bytes +0.0%	52,632 bytes +0.0%	54,927 bytes +0.0%	8 +0.0%	None
Fp128 multi-group W8R2 (final nv32, 4 polys total), recursive setup check	256/64/64 → 128/64/64 → 64/64/64	75,263 bytes +0.0%	48,539 bytes +0.0%	50,919 bytes +0.0%	8 +0.0%	None
Fp128 one-hot nv32 W2R2, direct setup check	512/64/64 → 128/64/64 → 64/64/64	69,525 bytes +0.0%	48,537 bytes +0.0%	50,919 bytes +0.0%	7 +0.0%	None
Fp128 one-hot nv32 W4R2, direct setup check	512/64/64 → 128/64/64 → 64/64/64	70,452 bytes +0.0%	48,508 bytes +0.0%	50,919 bytes +0.0%	7 +0.0%	None
Fp128 one-hot nv32 W8R2, direct setup check	512/64/64 → 128/64/64 → 64/64/64	71,915 bytes +0.0%	48,556 bytes +0.0%	50,919 bytes +0.0%	8 +0.0%	None

Grinding retries are rejected attempts at each fold, listed in measured-run order. Zero means the first sampled nonce was accepted.

Each multi-group profile has two precommitted nv16 singleton polynomials and two polynomials in the displayed final group.

Native proof accounting

Profile	Non-nonce proof	Nonce messages	Nonce maximum
Fp32 dense nv30, direct setup check	64,057 bytes +0.0%	468 bytes +0.0%	933 bytes +0.0%
Fp32 one-hot nv34, direct setup check	64,995 bytes +0.0%	492 bytes +0.0%	980 bytes +0.0%
Fp64 dense nv29, direct setup check	66,603 bytes +0.0%	470 bytes +0.0%	938 bytes +0.0%
Fp64 one-hot nv35, direct setup check	67,220 bytes +0.0%	496 bytes +0.0%	987 bytes +0.0%
Fp128 dense nv28, direct setup check	68,765 bytes +0.0%	344 bytes +0.0%	686 bytes +0.0%
Fp128 one-hot nv36, direct setup check	69,410 bytes +0.0%	352 bytes +0.0%	702 bytes +0.0%
Fp128 one-hot nv36, recursive setup check	72,699 bytes +0.0%	430 bytes +0.0%	853 bytes +0.0%
Fp128 multi-group (final nv34, 4 polys total), direct setup check	69,271 bytes +0.0%	352 bytes +0.0%	701 bytes +0.0%
Fp128 multi-group (final nv34, 4 polys total), recursive setup check	85,432 bytes +0.0%	605 bytes +0.0%	1,206 bytes +0.0%
Fp128 multi-group W8R2 (final nv32, 4 polys total), recursive setup check	74,763 bytes +0.0%	500 bytes +0.0%	994 bytes +0.0%
Fp128 one-hot nv32 W2R2, direct setup check	69,177 bytes +0.0%	348 bytes +0.0%	694 bytes +0.0%
Fp128 one-hot nv32 W4R2, direct setup check	70,076 bytes +0.0%	376 bytes +0.0%	746 bytes +0.0%
Fp128 one-hot nv32 W8R2, direct setup check	71,532 bytes +0.0%	383 bytes +0.0%	762 bytes +0.0%

Memory and setup size

Profile	Setup vector	Prepared NTT cache	Verifier NTT cache	Peak RSS
Fp32 dense nv30, direct setup check	22.0 MiB +0.0%	176.0 MiB +0.0%	0.9 MiB +0.0%	4562.1 MiB +0.0%
Fp32 one-hot nv34, direct setup check	32.0 MiB +0.0%	224.0 MiB +0.0%	3.0 MiB +0.0%	864.7 MiB +0.1%
Fp64 dense nv29, direct setup check	32.0 MiB +0.0%	306.0 MiB +0.0%	0.8 MiB +0.0%	4979.8 MiB -0.0%
Fp64 one-hot nv35, direct setup check	128.0 MiB +0.0%	684.0 MiB +0.0%	0.8 MiB +0.0%	1575.2 MiB -0.1%
Fp128 dense nv28, direct setup check	64.0 MiB +0.0%	513.0 MiB +0.0%	1.2 MiB +0.0%	5346.7 MiB -0.0%
Fp128 one-hot nv36, direct setup check	256.0 MiB +0.0%	1796.0 MiB +0.0%	3.2 MiB +0.0%	3287.0 MiB +0.1%
Fp128 one-hot nv36, recursive setup check	256.0 MiB +0.0%	1836.0 MiB +0.0%	1.2 MiB +0.0%	3592.4 MiB -0.0%
Fp128 multi-group (final nv34, 4 polys total), direct setup check	256.0 MiB +0.0%	1797.0 MiB +0.0%	3.2 MiB +0.0%	2831.4 MiB -0.0%
Fp128 multi-group (final nv34, 4 polys total), recursive setup check	256.0 MiB +0.0%	1893.0 MiB +0.0%	1.6 MiB +0.0%	3471.5 MiB -0.1%
Fp128 multi-group W8R2 (final nv32, 4 polys total), recursive setup check	128.0 MiB +0.0%	986.2 MiB +0.0%	1.2 MiB +0.0%	2083.1 MiB +0.1%
Fp128 one-hot nv32 W2R2, direct setup check	64.0 MiB +0.0%	485.0 MiB +0.0%	1.6 MiB +0.0%	858.3 MiB -0.4%
Fp128 one-hot nv32 W4R2, direct setup check	64.0 MiB +0.0%	485.0 MiB +0.0%	1.2 MiB +0.0%	890.7 MiB -0.1%
Fp128 one-hot nv32 W8R2, direct setup check	64.0 MiB +0.0%	485.0 MiB +0.0%	1.6 MiB +0.0%	972.4 MiB -0.4%

Deltas are shown only for profiles with a matching merge-base case. Negative is smaller or faster.

The uploaded report.md benchmark artifact contains the detailed fold schedule, proof-size breakdown, terminal response segments, and Golomb diagnostics.

[github-actions]

CI test timing

• Report generated: 2026-10-09T08:00:47Z.
• Source: 2c0af24 on quang/labinius-lowered-root.
• Workflow run: 37897785616.
• Main baseline: 401e797.

Run summary

Wall s	Main wall s	Main Δ	Ratio	Tests	Skipped	Failed	Status
744.0	838.0	-11.2%	0.89x	1952	0	0	ok

Wall time spans 2 parallel nextest slice shards.

Slowest tests

Rank	Duration s	Test
1	66.6	akita-planner::schedule_params::suffix_dp::chunk_ownership_tests::contracting_chunk_search_matches_unpruned_complete_objective
2	61.8	akita-planner::schedule_params::adaptive_search_tests::adaptive_frontier_matches_unpruned_traversal_and_hand_priced_role_optima
3	23.8	akita-planner::planner::totality_tests::contractive_winner_remains_selected
4	12.0	akita-planner::schedule_params::adaptive_search_tests::relation_cutover::bounded_suffix_dp_matches_unpruned_fixed_cutover_search
5	11.5	akita-pcs::akita_fp128_e2e::fp128_dense
6	10.9	akita-pcs::scheme::tests::cross_mode::proofs_cannot_replay_across_valid_quotient_and_reduced_schedules
7	10.8	akita-planner::schedule_params::adaptive_search_tests::production_suffix_selects_l2_with_the_typed_response_model
8	10.7	akita-planner::schedule_params::adaptive_search_tests::adaptive_nv36_minimizes_setup_envelope_before_first_direct_setup
9	8.9	akita-planner::planner::totality_tests::valid_small_grouped_root_has_a_schedule
10	8.3	akita-pcs::akita_fp128_e2e::heterogeneous::bounded_dense_roundtrip_over_u64_coefficients_at_every_catalog_size
11	7.6	akita-setup::tests::disk_persistence::combined_recursive_prefix_registry_persists_and_serves_each_family
12	7.3	akita-planner::planner::totality_tests::noncontractive_multi_chunk_root_can_beat_contractive_candidates
13	7.3	akita-planner::schedule_params::adaptive_search_tests::adaptive_search_applies_setup_budget_in_physical_fields
14	6.8	akita-pcs::transcript_hardening_proptest::stream_fuzzes_batch_shapes
15	6.4	akita-pcs::scheme::tests::onehot::selective_l2::selective_l2_proof_rejects_transcript_mutations
16	6.1	akita-planner::schedule_params::adaptive_search_tests::feasible_packing_dimension_ignores_infeasible_smaller_dimensions
17	5.3	akita-pcs::akita_small_field_e2e::fp32_dense
18	5.0	akita-pcs::akita_fp128_e2e::heterogeneous::combined_family_setup_matches_per_family_proofs
19	4.9	akita-sis-estimator::search_mode_parity::full_exhaustive_parallel_matches_certified_search_on_medium_subset
20	4.4	akita-pcs::transcript_hardening_proptest::seed_corpus_covers_nv_basis_and_batch_shapes

Regressions vs main

No per-test regressions above the threshold.

New slow tests

No new tests ≥30s vs main baseline.

[quangvdao]

/ai-review

[github-actions]

AI review attempt 1/3 reserved. Failed or incomplete attempts also count toward this PR's limit.

[github-actions]

Usefulness: benefit supported. The repository evidence supports both additions: AdmittedRootSetup combines existing shape admission with canonical seed expansion, while the lowered modules bridge the clear endpoints to an explicit field relation using existing encoding and setup-layout contracts. Differential, quotient, boundary and tamper tests provide useful regression coverage. The additions are feature-gated and leave existing proof-path behavior unchanged. Materialization and schoolbook-product costs are substantial but disclosed and proportionate to this reference-building-block scope; transcript integration and composition proofs remain explicitly separate work.

Recommended for approval: no unresolved findings in this automated review.

[quangvdao]

Superseded by #228, which carries the seed-derived root setup and the lowered root relation.

The earlier stack was re-cut into four pull requests: #226 (arithmetic), #227 (parameters), #228 (root reduction) and #229 (polynomial commitment). Closing without merging; the branch is left in place.