mirror of
https://github.com/luxfi/p3q.git
synced 2026-10-30 15:22:47 +00:00
zooqueen
054b126a3e
The missing foundation for STARK-compressed quorum certificates: an AIR
proving/verification layer over the Goldilocks/FRI/SHA3 substrate, replacing
the prior toy single-polynomial prover.
- air.rs: the Air trait gains a constraint API — AirBuilder (local/next/
public/assert_zero), eval<AB> (required: forgetting constraints is a
COMPILE error, never a silent zero-constraint proof), num_public_inputs,
constraint_degree, BoundaryConstraint.
- prover.rs: a real DEEP-STARK prover — trace LDE, quotient C/Z_H on a
coset, OOD openings, DEEP composition codeword, FRI low-degree, per-query
trace+quotient Merkle openings, boundary openings. (Honest perf: naive
O(N^2) DFTs — must move to radix-2 FFT before batched SLH-DSA scale.)
- verifier.rs: boundary checks + the transition-constraint identity at OOD
(Q(ζ)·Z_H(ζ)==Σα·C) + DEEP/OOD binding per query + FRI. Rejects any trace
that violates the AIR.
- fri/{domain,engine}.rs, transcript.rs, proof.rs: coset DFT/iDFT, FRI fold
engine (cheating-final-poly + high-degree rejection), Fiat-Shamir.
- zchain: the 6 audit-gated identity circuits implement the new Air trait
with fail-closed eval (unimplemented! until the post-audit body lands).
Round-trip proven: a satisfying trace proves+verifies; a tampered trace is
rejected (FRI low-degree); shape mismatches fail closed. Workspace tests green.
STAGED NEXT (honestly not done): the Keccak-f[1600] AIR (the in-circuit SHAKE
gadget) and the SLH-DSA/ML-DSA verify circuit that composes it — that is what
turns this into a STARK proof of N independent FIPS-205/204 verifications.