perf(dory): cyclotomic GT exponentiation and GT multi-exponentiation - #2174

Drops challenge_short_scalar, challenge_bits_for_loss, the Dory loss
table and its burst test, and the exact dory-pcs pin. Curve verifier time
is not a priority, and #2174's Dory verifier optimizations more than
offset the cost.

…2110)

* feat(transcript)!: one sealed transcript over spongefish 0.8 states

Replaces the transcript stack (J1-J9) with its final form in one change.

- jolt-transcript: a sealed Transcript/FieldTranscript over spongefish
  ProverState/VerifierState. Absorbs are positional and word-aligned with
  no labels; sessions are 32-byte protocol tags and a SHAKE128 session id;
  bound digests are SHA3-256 (Keccak-256 behind `keccak256-digests`).
- Challenges: full-width BN254 scalars; Dory's group-scalar challenges are
  short, sized from their loss.
- Proof-of-work mechanism only (no protocol site uses it yet): one u64 nonce
  word, MAX_POW_BITS = 57, difficulty priced from the challenge-set size,
  and a sequential search through an owned `verifier_message_oracle`.
- Sumcheck, openings, Dory, HyperKZG, Akita, BlindFold, the verifier and
  prover, SDK, examples, jolt-eval and fuzz targets run on it.
- Akita grouped statements carry a role code for main's fused-increment
  group.
- FS inventories re-blessed; verifier fuzz bundles regenerated.

* chore(jolt-eval): drop rayon from jolt-transcript in the fuzz lockfile

* ci: fix the Rust workflow's duplicated run key

Merging main left the old jolt-sumcheck command under the new
"Test jolt-blindfold with its prover" step, so the step had two run keys
and GitHub rejected the whole workflow without running it. Also drop the
removed jolt-transcript parallel feature from the every-sponge test and
update the clippy comment that referred to it.

* docs(transcript): spec and book chapter for the sealed spongefish transcript

* style: import Ordering, Encoding and Transcript; allow hex "ba" in Rust

* docs(transcript): scope the Fiat-Shamir chapter by configuration and enforcement

* test: end the misaligned-access assert with a semicolon

* refactor(transcript)!: draw Dory's challenges full width

Drops challenge_short_scalar, challenge_bits_for_loss, the Dory loss
table and its burst test, and the exact dory-pcs pin. Curve verifier time
is not a priority, and #2174's Dory verifier optimizations more than
offset the cost.

* test: re-bless FS inventories and regenerate verifier fuzz bundles

* test(verifier): bump FIXTURE_MAGIC for the new proof format

Every transcript byte changes in this PR, but the cached verifier fixtures
kept JVCF0008, the value main writes, and cached fixtures load without an
acceptance check. JVCF0011 is unused by any branch (#2137 uses JVCF0010).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(field): check the Solinas word fold against big-integer reduction

The oracle was a test-only copy of the byte-at-a-time fold that the word
fold replaced. Compare with num-bigint `% p` instead, as
bn254_differential.rs does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style(verifier): drop a duplicated cfg on Stage8BatchEntry

Left behind when the LabelWithCount import was removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(sumcheck): delete the test-only CompressedRoundPoly wrapper

Production absorbs compressed rounds through append_compressed_round and
verifies them with CompressedSumcheckProof. The wrapper had no production
caller and carried its own compressed-round checks.

honest_prove_compressed and the compressed roundtrip now absorb through
append_compressed_round and verify a CompressedSumcheckProof against the
polynomial's evaluation. The tests that only exercised the wrapper are
removed, and the FS absorb inventory loses the wrapper's site.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(sumcheck)!: bind the committed output-claim count

The committed sumcheck's output-claim commitments were absorbed with no
count, so a public caller that accepted any count could move a commitment
across the message boundary without changing a challenge. Absorb the count
as a u64 word ahead of the commitments, as main's LabelWithCount did.

* test: regenerate verifier fuzz bundles

---------

Co-authored-by: Michael Zhu <mchl.zhu.96@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…ites (#2108)

* feat(transcript)!: one sealed transcript over spongefish 0.8 states

Replaces the transcript stack (J1-J9) with its final form in one change.

- jolt-transcript: a sealed Transcript/FieldTranscript over spongefish
  ProverState/VerifierState. Absorbs are positional and word-aligned with
  no labels; sessions are 32-byte protocol tags and a SHAKE128 session id;
  bound digests are SHA3-256 (Keccak-256 behind `keccak256-digests`).
- Challenges: full-width BN254 scalars; Dory's group-scalar challenges are
  short, sized from their loss.
- Proof-of-work mechanism only (no protocol site uses it yet): one u64 nonce
  word, MAX_POW_BITS = 57, difficulty priced from the challenge-set size,
  and a sequential search through an owned `verifier_message_oracle`.
- Sumcheck, openings, Dory, HyperKZG, Akita, BlindFold, the verifier and
  prover, SDK, examples, jolt-eval and fuzz targets run on it.
- Akita grouped statements carry a role code for main's fused-increment
  group.
- FS inventories re-blessed; verifier fuzz bundles regenerated.

* chore(jolt-eval): drop rayon from jolt-transcript in the fuzz lockfile

* feat(transcript): proof of work before short challenges at protocol sites

Grinds where a challenge set is too small for SECURITY_BITS on its own,
which today is only the 128-bit Akita field; BN254 sites cost 0 bits and
carry no nonces.

- Sumcheck rounds: each clear round is priced at its degree bound and its
  nonce rides in the clear proof. Committed (ZK) sumchecks and BlindFold
  carry none and require a challenge set wide enough to need none.
- Stage-level bursts (stage 1 tau, stages 1-7, stage-2 tau_high, Akita
  stage-8 selectors) share one flat loss, SITE_LOSS = 1023: 10 bits over
  the Akita field, about 4.5x the worst-case burst. Nonces live in
  `StagePowNonces`; a site the verifier skips must hold none.
- Verifier fuzz bundles regenerated.

* ci: fix the Rust workflow's duplicated run key

Merging main left the old jolt-sumcheck command under the new
"Test jolt-blindfold with its prover" step, so the step had two run keys
and GitHub rejected the whole workflow without running it. Also drop the
removed jolt-transcript parallel feature from the every-sponge test and
update the clippy comment that referred to it.

* docs(transcript): spec and book chapter for the sealed spongefish transcript

* docs(transcript): describe the proof-of-work sites

* style: import Ordering, Encoding and Transcript; allow hex "ba" in Rust

* style: import PowSite in stage 8

* docs(transcript): scope the Fiat-Shamir chapter by configuration and enforcement

* test: end the misaligned-access assert with a semicolon

* refactor(transcript)!: draw Dory's challenges full width

Drops challenge_short_scalar, challenge_bits_for_loss, the Dory loss
table and its burst test, and the exact dory-pcs pin. Curve verifier time
is not a priority, and #2174's Dory verifier optimizations more than
offset the cost.

* test: re-bless FS inventories and regenerate verifier fuzz bundles

* test(verifier): bump FIXTURE_MAGIC for the new proof format

Every transcript byte changes in this PR, but the cached verifier fixtures
kept JVCF0008, the value main writes, and cached fixtures load without an
acceptance check. JVCF0011 is unused by any branch (#2137 uses JVCF0010).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(field): check the Solinas word fold against big-integer reduction

The oracle was a test-only copy of the byte-at-a-time fold that the word
fold replaced. Compare with num-bigint `% p` instead, as
bn254_differential.rs does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style(verifier): drop a duplicated cfg on Stage8BatchEntry

Left behind when the LabelWithCount import was removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(sumcheck): delete the test-only CompressedRoundPoly wrapper

Production absorbs compressed rounds through append_compressed_round and
verifies them with CompressedSumcheckProof. The wrapper had no production
caller and carried its own compressed-round checks.

honest_prove_compressed and the compressed roundtrip now absorb through
append_compressed_round and verify a CompressedSumcheckProof against the
polynomial's evaluation. The tests that only exercised the wrapper are
removed, and the FS absorb inventory loses the wrapper's site.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: re-bless FS inventories and regenerate verifier fuzz bundles

* fix(sumcheck)!: bind the committed output-claim count

The committed sumcheck's output-claim commitments were absorbed with no
count, so a public caller that accepted any count could move a commitment
across the message boundary without changing a challenge. Absorb the count
as a u64 word ahead of the commitments, as main's LabelWithCount did.

* test: regenerate verifier fuzz bundles

* test: regenerate verifier fuzz bundles

---------

Co-authored-by: Michael Zhu <mchl.zhu.96@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…2111)

* feat(transcript)!: one sealed transcript over spongefish 0.8 states

Replaces the transcript stack (J1-J9) with its final form in one change.

- jolt-transcript: a sealed Transcript/FieldTranscript over spongefish
  ProverState/VerifierState. Absorbs are positional and word-aligned with
  no labels; sessions are 32-byte protocol tags and a SHAKE128 session id;
  bound digests are SHA3-256 (Keccak-256 behind `keccak256-digests`).
- Challenges: full-width BN254 scalars; Dory's group-scalar challenges are
  short, sized from their loss.
- Proof-of-work mechanism only (no protocol site uses it yet): one u64 nonce
  word, MAX_POW_BITS = 57, difficulty priced from the challenge-set size,
  and a sequential search through an owned `verifier_message_oracle`.
- Sumcheck, openings, Dory, HyperKZG, Akita, BlindFold, the verifier and
  prover, SDK, examples, jolt-eval and fuzz targets run on it.
- Akita grouped statements carry a role code for main's fused-increment
  group.
- FS inventories re-blessed; verifier fuzz bundles regenerated.

* chore(jolt-eval): drop rayon from jolt-transcript in the fuzz lockfile

* feat(akita): run Akita's opening inside Jolt's Fiat-Shamir sponge (J8)

Jolt's trace batch now runs Akita's argument on Jolt's own transcript
state instead of bridging to a standalone Akita session: Akita binds its
instance descriptor and writes its messages into Jolt's argument string,
and the verifier checks end-of-string once, after the opening.

- jolt-openings: GroupBatchOpening carries the grouped prove/verify
  entry points on the concrete spongefish states, with a PendingEof the
  verifier hands back for check_eof.
- jolt-akita: the trace batch calls batched_prove_embedded /
  batched_verify_embedded. append_verifier_setup, append_batch_statement
  and bridged_akita_session go away; Akita's descriptor binds the setup,
  schedule row and layout. A trace-batch proof that also carries a
  standalone backend proof is rejected. The generic BatchOpeningScheme
  and single-polynomial paths still run Akita standalone.
- Schedule catalogs regenerated for Akita's descriptor v6 (epoch 6).
- jolt-prover / jolt-verifier stage 8 pass the state through, and the
  FS inventories are re-blessed.

The Akita pin in Cargo.toml is a placeholder (Akita main) until
LayerZero-Labs/akita#254 lands; see the TODO there.

* chore(akita): pin Akita to #254's head 4fba41edb

The Akita stack merged main (#212, #213, #223), dropped an unused
dev-dependency, kept the transcript event log across fold previews and
regenerated its planner-cost snapshots. Akita's own schedule catalogs are
unchanged.

* ci: fix the Rust workflow's duplicated run key

Merging main left the old jolt-sumcheck command under the new
"Test jolt-blindfold with its prover" step, so the step had two run keys
and GitHub rejected the whole workflow without running it. Also drop the
removed jolt-transcript parallel feature from the every-sponge test and
update the clippy comment that referred to it.

* docs(transcript): spec and book chapter for the sealed spongefish transcript

* docs(transcript): Akita's opening runs in Jolt's sponge

* style: import Ordering, Encoding and Transcript; allow hex "ba" in Rust

* style: use the imported protocol_tag in Akita's batching tests

* docs(transcript): scope the Fiat-Shamir chapter by configuration and enforcement

* test: end the misaligned-access assert with a semicolon

* refactor(transcript)!: draw Dory's challenges full width

Drops challenge_short_scalar, challenge_bits_for_loss, the Dory loss
table and its burst test, and the exact dory-pcs pin. Curve verifier time
is not a priority, and #2174's Dory verifier optimizations more than
offset the cost.

* test: re-bless FS inventories and regenerate verifier fuzz bundles

* test(verifier): bump FIXTURE_MAGIC for the new proof format

Every transcript byte changes in this PR, but the cached verifier fixtures
kept JVCF0008, the value main writes, and cached fixtures load without an
acceptance check. JVCF0011 is unused by any branch (#2137 uses JVCF0010).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test(field): check the Solinas word fold against big-integer reduction

The oracle was a test-only copy of the byte-at-a-time fold that the word
fold replaced. Compare with num-bigint `% p` instead, as
bn254_differential.rs does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style(verifier): drop a duplicated cfg on Stage8BatchEntry

Left behind when the LabelWithCount import was removed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor(sumcheck): delete the test-only CompressedRoundPoly wrapper

Production absorbs compressed rounds through append_compressed_round and
verifies them with CompressedSumcheckProof. The wrapper had no production
caller and carried its own compressed-round checks.

honest_prove_compressed and the compressed roundtrip now absorb through
append_compressed_round and verify a CompressedSumcheckProof against the
polynomial's evaluation. The tests that only exercised the wrapper are
removed, and the FS absorb inventory loses the wrapper's site.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* test: re-bless FS inventories and regenerate verifier fuzz bundles

* fix(sumcheck)!: bind the committed output-claim count

The committed sumcheck's output-claim commitments were absorbed with no
count, so a public caller that accepted any count could move a commitment
across the message boundary without changing a challenge. Absorb the count
as a u64 word ahead of the commitments, as main's LabelWithCount did.

* test: regenerate verifier fuzz bundles

* test: regenerate verifier fuzz bundles

* test: regenerate verifier fuzz bundles

* chore(deps): pin Akita to the stack tip

* test(fuzz): regenerate zk verifier bundles on merged main

* chore(deps): pin Akita to the corrected stack tip

* chore(deps): pin Akita to the merged stack tip 9f8ad8a91

* fix(jolt-akita): pin the K=256 one-hot chunk size and regenerate schedules

Akita #258 switched DEFAULT_UNIT_ONEHOT_SOURCE_CHUNK_SIZE to 16.
JoltOneHotK256Direct inherited it through OneHot's committed_source_class,
so K=256 rows were priced for one hot position per 16 coefficients and the
backend rejected Jolt's K=256 sources. Declare the class explicitly, as the
K=16 policy already does, and regenerate every catalog at the new pin.

* test(jolt-verifier): regenerate fuzz bundles and the FS inventory

The clear bundles came from main under its transcript; regenerate them on
the merged tree. The inventory records the SetupPolicy argument now passed
to batched_verify_embedded.

* test(jolt-transcript): gate the whole-word absorb helper with its caller

append_values_matches_per_value_absorbs and the Encoding import were
compiled, unused, under feature sets without solinas and bn254.

* style(recursion): taplo-format the guest hash-inlines feature

* fix(akita): address review of the embedded Akita opening

- book: name the pinned Akita revision (8d5821f45), not 9f8ad8a91, which
  is not an ancestor of the pin; same for the policy-spec link.
- book: Akita's sparse ring challenges are drawn on Jolt's sponge, so
  "every challenge on Jolt's transcript is full width" is now scoped to
  Jolt's own draws.
- jolt-transcript: the `prover-grinding` comment said verifier builds
  leave `yolocrypto` off; every Akita build has it through akita-prover.
- profile: the trace batch's `backend_proof` is always empty, so the
  Akita size telemetry reported 0. Report the argument-string size and
  drop the callerless `AkitaBatchProof::unframed_payload_size`. Document
  that `backend_proof` is empty for the trace batch.
- recursion: `tamper-opening` flipped a byte of the empty `backend_proof`
  and panicked; it now flips the argument string's last byte, which is
  Akita's. Drop the guest's dead BLAKE2b jolt-transcript edge and the
  host's unused Keccak inline registration.
- jolt-verifier: `Stage8Output` is gated off the Akita build, where it had
  only a never-constructed variant. Document that the Akita stage-8
  `verify` and `GroupBatchOpening::verify_batch` return before acceptance.
- FS scanner: only `batched_verify_embedded` leaves the scanned crates.
  `verify_batch` calls between scanned crates and `check_eof` were
  recorded as absorb and challenge sites; re-bless drops those 10 entries.
- tests: `akita_schedule_selection_tampers_reject` covers the selection on
  the embedded path (flipped digests and other fixtures' valid rows);
  `proof.narg` joins the tamper manifest; the streamed-batch comment no
  longer claims the setup-mismatch cases reach Akita's descriptor.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Michael Zhu <mchl.zhu.96@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: sumchecker <241190306+sumchecker@users.noreply.github.com>
Co-authored-by: Markos Georghiades <mgeorghiades@a16z.com>