[ilyalesokhin-starkware]

The program's output is already a Blake2s digest stored across the output
memory cells. Instead of re-hashing those cells and exposing the hash as the
circuit output, guess the eight digest words, split them back into the output
cells (binding them to the public memory), and expose the words themselves.

The output cells' nine-bit limbs are still mixed into the channel as
blake2s(limbs) to match the Cairo prover (PublicData::mix_into).

Also generalize From<Blake2sHash> from HashValue<QM31> to a generic
HashValue<Value> so the guess path can reuse it.

Regenerates the multiverifier/recursion proof fixtures and updates the
cairo-verifier preprocessed-root and output-value regression constants.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

[cursor]

PR Summary

High Risk
Changes how public outputs are bound to memory and the verifier channel—core to proof correctness—even though limb hashing for mixing is preserved.

Overview
The Cairo verifier no longer treats the circuit’s public output as Blake2s(output memory limbs). It guesses the eight digest u32s, registers them with set_outputs in CairoStatement::new, and rebuilds the two output memory cells by decomposing those words into little-endian bits and regrouping into 9-bit limbs (word_to_le_bits / output_limbs_from_hash) so the public logup still ties them to proven memory.

claims_to_mix still mixes blake2s(limbs) into the channel (Cairo prover compatibility) but no longer defines the circuit’s public outputs there. The old split-based limb reconstruction and related imports are removed.

Multiverifier privacy fixture constants PRIVACY_CAIRO_VERIFIER_OUTPUT_VALUES and PRIVACY_CAIRO_VERIFIER_PREPROCESSED_ROOT are updated for the new circuit shape.

^{Reviewed by Cursor Bugbot for commit a7d2570. Bugbot is set up for automated code reviews on this repo. Configure here.}

[reviewable-StarkWare]

This change is 

[ilyalesokhin-starkware]

• cairo_verifier: Output the program's digest words directly #649 👈 (View in Graphite)
• cairo_verifier: Pass program output as a Blake2s hash #636
• test(multiverifier): add backward compatibility test #627
• refactor(multiverifier): move shared test fixtures to test_utils #626
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[Gali-StarkWare]

@Gali-StarkWare reviewed 6 files and all commit messages, and made 2 comments.
Reviewable status: 6 of 7 files reviewed, 2 unresolved discussions (waiting on ilyalesokhin-starkware and yuvalsw).

---

crates/cairo_verifier/src/statement.rs line 402 at r3 (raw file):

        let n_components = components.len();
        let output_hash = output_hash.guess(context);
        context.set_outputs(&output_hash.iter().map(|word| *word.get()).collect_vec());

Where did we do context.set_output(output_hash) before (for the hash of the limbs)?

---

crates/cairo_verifier/src/statement.rs line 505 at r3 (raw file):

        let n_output_bytes = 4 * output_limb_vars.len();
        let output_limb_words = to_padded_u32_words(context, output_limb_vars);
        let output_hash = blake2s_u32s(context, output_limb_words, n_output_bytes);

I think we have a const for it. Just a suggestion

Suggestion:

        // Mix the outputs as 9-bit limbs into the channel.
        let output_limb_vars = outputs.iter().flatten().map(|limb| *limb.get()).collect_vec();
        let output_limb_words = to_padded_u32_words(context, output_limb_vars);
        let n_output_bytes = BYTES_IN_WORD * output_limb_words.len();
        let output_hash = blake2s_u32s(context, output_limb_words, n_output_bytes);

[ilyalesokhin-starkware]

crates/cairo_verifier/src/statement.rs line 402 at r3 (raw file):

Previously, Gali-StarkWare wrote…

Where did we do context.set_output(output_hash) before (for the hash of the limbs)?

in claims_to_mix.

[ilyalesokhin-starkware]

crates/cairo_verifier/src/statement.rs line 505 at r3 (raw file):

Previously, Gali-StarkWare wrote…

I think we have a const for it. Just a suggestion

We use 4 in other places

stwo-circuits/crates/stark_verifier/src/channel.rs

Line 102 in efa5e7c

let n_bytes = 4 * message.len();

N_U8S_PER_U32 is the closest that I could find

[Gali-StarkWare]

@Gali-StarkWare made 1 comment.
Reviewable status: 6 of 7 files reviewed, 3 unresolved discussions (waiting on ilyalesokhin-starkware and yuvalsw).

---

crates/cairo_verifier/src/statement.rs line 347 at r3 (raw file):

/// Splits the digest `hash` into its [`N_OUTPUTS`] `u128` halves, each decomposed into
/// nine-bit limbs (little-endian).

You wrote N_OUTPUTS and then halves, it reads a bit weird

Code quote:

/// Splits the digest `hash` into its [`N_OUTPUTS`] `u128` halves, each decomposed into
/// nine-bit limbs (little-endian).

[Gali-StarkWare]

@Gali-StarkWare reviewed 1 file.
Reviewable status: all files reviewed, 3 unresolved discussions (waiting on ilyalesokhin-starkware and yuvalsw).

[Gali-StarkWare]

@Gali-StarkWare made 1 comment and resolved 2 discussions.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on ilyalesokhin-starkware and yuvalsw).

---

crates/cairo_verifier/src/statement.rs line 402 at r3 (raw file):

Previously, ilyalesokhin-starkware wrote…

in claims_to_mix.

Oh right

[Gali-StarkWare]

@Gali-StarkWare made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on ilyalesokhin-starkware and yuvalsw).

[ilyalesokhin-starkware]

crates/cairo_verifier/src/statement.rs line 347 at r3 (raw file):

Previously, Gali-StarkWare wrote…

You wrote N_OUTPUTS and then halves, it reads a bit weird

done

[Gali-StarkWare]

@Gali-StarkWare reviewed 1 file and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on yuvalsw).