Repository navigation
Conversation
Store the seed-derived root matrix as pages of 512 ring elements (`RootMatrix`), derived one SHAKE page at a time by the new `derive_public_matrix_page`, so setup never materializes the full field prefix. `BinaryClearSetup::matrix()` becomes `matrix_element(row, column)` plus a coefficient iterator, and the matrix digest streams through `matrix_digest_iter` with the same 4096-residue absorption boundaries. `PreparedLimbCommitMatrix` stores its transforms in row-aligned pages of 512 entries. The tiled commit loop from #230 reads each eight-element batch of a row as one slice of one page. Proof bytes, setup digests and commitments are unchanged. Ported from Alberto Centelles's Aerie+ Akita patch (a16z/aerie-private 8770c0f1); the row-aligned limb pages and the tile accessor are new. Co-authored-by: Alberto Centelles <centelles.alberto@gmail.com>
`commit_digits` and `digit_source` commit the four-bit image and response digits as a `SignedBlockPoly::i8` instead of widening each digit to a base-field element. Digits above 15 and non-power-of-two lengths are rejected. A differential test checks that the complete proofs match the dense representation in all three opening modes for both families. Ported from Alberto Centelles's Aerie+ Akita patch (a16z/aerie-private 8770c0f1). Co-authored-by: Alberto Centelles <centelles.alberto@gmail.com>
Documentation blast radius (advisory)These regions may need doc/spec/book updates based on changed paths. Changed files in this PR: 21 No blast-radius regions matched. If this PR changes user-visible behavior, consider whether |
PCS Profile Benchmark
13 of 13 profiles passed. Times are medians of Each sample verifies the same proof first with the configured multi-threaded pool and then with one thread. Both timings reuse the same verifier setup. Merge-base comparisons are available for Benchmark shards
Public opening statements
One-hot profiles generate deterministic witnesses with one Direct evaluates the public setup contribution during Stage 2. Recursive carries the same check through a Stage 3 setup-product sumcheck. Both modes execute the complete fold schedule and terminal verification. The chunked profiles Generated profiles may select different A, B, and D ring dimensions at different fold levels. The short profile names omit those dimensions. Each sample generates deterministic witnesses and opening points, prepares setup, commits, proves, serializes the proof, checks its size, prepares verifier setup, and verifies the claimed openings. It does not test malformed proofs. Phase time
Proof size and protocol shape
Grinding retries are rejected attempts at each fold, listed in measured-run order. Zero means the first sampled nonce was accepted. Each multi-group profile has two precommitted nv16 singleton polynomials and two polynomials in the displayed final group. Native proof accounting
Memory and setup size
Deltas are shown only for profiles with a matching merge-base case. Negative is smaller or faster. The uploaded |
CI test timing
Run summary
Wall time spans 2 parallel nextest slice shards. Slowest tests
Regressions vs main
New slow testsNo new tests ≥30s vs main baseline. |
Stacked on #229 (
quang/labinius-pcs).This PR ports two refactors that produce identical proofs from Alberto Centelles's Aerie+ Akita patch (@Acentelles, a16z/aerie-private
8770c0f1,experiments/aerie-akita-labinius-dense/akita-base.patch). Alberto wrote the original change; both commits carry hisCo-authored-bytrailer. His frontend seam, wire34 accessors and catalog rows are not included. They come in later PRs, and his rank-2.aksrows are invalid under #229's 169-bit parameters.1. Paged root matrix
RootMatrix(akita-labinius-verifier/src/matrix.rs) stores the root matrix as pages of 512 ring elements.AdmittedRootSetup::derivebuilds it one SHAKE page at a time with the newakita_types::proof::derive_public_matrix_page, so setup no longer materializes the full field prefix. Each page stays under the existingMAX_MATRIX_BYTESandMAX_PREFIX_BYTEScaps.BinaryClearSetup::matrix()is replaced by:matrix_element(row, column);matrix_coefficients();matrix_bytes(),matrix_page_count()andmatrix_maximum_page_bytes().All callers are rewritten:
commitment.rs,lowered/weights.rs,lowered/a_remainders.rs, the limb setup, the benches and the tests.channel::matrix_digest_iterstreams the matrix digest with the same 4096-residue absorption boundaries.PreparedLimbCommitMatrixstores its transforms in pages.matrix_ntt()is replaced bymatrix_ntt_element(row, element).Change from Alberto's version. His patch predates #230, which moved the limb commit loop into
limb_commit_kernel/workspace.rsand reads an eight-element tile of each row as one slice. Here the limb pages are row-aligned: every row starts a new page of at most 512 entries, and 512 is a multiple ofELEMENT_BATCH, so a tile never spans two pages. A privatematrix_ntt_tile(row, start, end)returns the tile. A new test,rows_wider_than_one_matrix_page_match_the_integer_definition, runs rank 3 at width 520 against the integer definition.2. Packed Y/W digits
commit_digitsanddigit_source(akita-labinius-pcs/src/prover.rs) commit the four-bit image and response digits asSignedBlockPoly::i8instead of widening each digit to aP::Base. Digits above 15 and lengths that are not a power of two are rejected.prover/digit_source_tests.rschecks:The prover-memory paragraph in
specs/labinius-pcs.mdis updated to match.Memory at the (22, 8) sample geometry
Heap measured with a counting global allocator, Binary mode, parallel, blake2b, M4 Max. Each phase is reported relative to the heap at its start. The probe was a scratch test and is not committed.
Prover::new)CommittedWhere the savings come from:
Validation (focused)
Run on the final code, which equals this head except for the spec paragraph:
cargo test --profile ci-test -p akita-labinius-verifier -p akita-labinius-prover --features labinius,parallel,transcript-blake2b: all pass, includingshipped_mode_and_field_pair_proof_bytes_are_pinnedand the new paging tests (paged_setup_has_dense_identity_and_offsets,paged_coefficients_match_dense_at_every_boundary,paged_and_dense_caps_are_not_relaxed,streamed_digest_preserves_frozen_absorption_boundaries,prepared_pages_preserve_first_last_and_boundary_elements).akita-labinius-pcs(labinius,parallel,transcript-blake2b):binary_proof_bytes_are_pinned_for_both_familiesand the fourdigit_source_testspass.cargo fmt --check,scripts/check-rust-file-lines.sh,typosandcheck-doc-guardrails.shpass.🤖 Generated with Claude Code