fix: Authenticate all frontier group members in the recursive verifier by samuelburnham · Pull Request #606 · argumentcomputer/ix

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnham · 2026-09-01T19:07:03Z

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption.

frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening.
frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings.

Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows.

Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

The in-circuit pruned-multiproof walk (mmcs_verify_multi / frontier_level) collapses queries that share a parent to a single lead node and hashes only the lead's rows via inject_maybe(ar, ...). Non-lead members' opened rows for the shorter (injected) matrices were still consumed in their own per-query FRI arithmetic (batch_views_at) but never authenticated against any commitment — the leaf hash covers only the tallest matrices, and shorter ones are bound solely through injection. A prover could therefore forge a non-lead member's shorter-matrix opening. Plonky3's reference verify_batch_pruned guards exactly this with InconsistentGroupOpening (and InconsistentDuplicateOpenings for equal-index queries); the port had neither. The prior per-query walk did not have the gap, so it was introduced with the direct multiproof consumption. - frontier_level: on a group merge, assert the lead and member agree on every not-yet-injected matrix (height <= next_lh) via select_rows_le + pointer equality. Transitive across pairwise merges, so the whole group is pinned; matches InconsistentGroupOpening. - frontier_merge: duplicate transcript indices must open the SAME full rows, not merely the same tallest-matrix leaf digest; matches InconsistentDuplicateOpenings. Pointer equality is admissible inside assert_eq! (equal pointers imply equal content; a spurious mismatch costs only completeness — see IxVM.Core). select_rows_le selects rows of matrices at height <= target, mirroring select_rows. Validated: the group-merge branch is genuinely reached by the factorial recursion proof (an always-false variant of the new assert fails the honest test), the honest proof still verifies with the real assert (completeness preserved), the existing tamper tests still reject, and the full lake test suite is green (2717 checks). aiur_multi_stark.rs regenerated; kernel executor unchanged.

Companion to multi-stark removing its unused per-query advice module. ix consumed native pruned multiproofs directly and referenced only advice::AdviceError, whose two arms (verification failed, serialization failed) were immediately string-formatted by the FFI. Replace it with a plain Result<Vec<u8>, String>: AiurSystem::proof_to_advice_bytes maps both failures to a message, and the FFI passes the string straight to LeanExcept::error_string. No behavior change; the Lean binding (Except String ByteArray) is unaffected. Bump the multi-stark pin to the advice-removed revision. Requires that multi-stark's ap/bump-p3-drop-advice be pushed first, exactly as with every other pin in this series.

samuelburnhamand others added 3 commits September 1, 2026 14:48

Bump multi-stark audit revision
e6d6f51