[quangvdao]

Stacked, not mergeable yet.

• Base and stack. This is stacked on J7 (refactor(transcript): run Jolt on spongefish ProverState/VerifierState and delete the legacy facade #2110, 6cea4bc85). J7 was rebuilt on main, which now carries feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107 and J6, so J8 merges J7's new head instead of rebasing (4f61f4e6e, then a87225028 for J7 13e149195). The feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107 cherry-picks in this branch's history are superseded by main's squash of feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107. Dory keeps J7's label-based short challenges.
• Unmerged Akita pin. Akita is pinned to feat(transcript)!: run Akita inside a caller's transcript (protocol v9) LayerZero-Labs/akita#254 at c16468ac6, which keeps Akita at protocol v8 (one version bump per stack, counted from main). That commit is not merged; it is stacked on Optimize read-write memory commitments #253 and includes Optimize read-write memory commitments #253's head dac235470. After the Akita PRs merge, re-pin to the merged commit.

What this does

Akita's opening now runs inside Jolt's single Fiat-Shamir sponge, so each message is absorbed once. Before, Jolt absorbed Akita's setup and statement into its own transcript. It then started a second Akita transcript, which absorbed them again.

• Stage 0 (unchanged from main). For each Akita commitment, Jolt absorbs:

  • the commitment's metadata: label, flavor, layout digest, and the counts of variables, polynomials, one-hot K and coefficients;
  • the committed rows, length-prefixed.

  The wire is main's AkitaCommitment; this PR does not change it.

• Stage 8.

  • The prover calls Akita's batched_prove_embedded on Jolt's prover state.
  • The verifier calls batched_verify_embedded on Jolt's verifier state, which reads Akita's messages out of Jolt's argument string.
  • Akita absorbs, in order:
    1. its instance descriptor: algebra, setup seed and decomposition, the selected schedule row and its schedule, the grinding plan, and the opening layout;
    2. each commitment's digest;
    3. the points;
    4. the evaluations.

• Decoding. Before decoding a commitment's rows, the verifier runs feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107's shape_guard. The guard resolves the selected schedule row from the trusted catalog. It then checks the declared coefficient count and the byte length against that row's profile (outer_compression_plan().terminal_coefficients()). So a forged header cannot make the decoder allocate a payload-sized buffer.

• End of proof. verify ends with PCS::check_eof, which rejects trailing argument-string bytes. The trace batch's proof must carry an empty backend_proof, because Akita's argument now lives in Jolt's argument string.

The stage-8 API is a new trait, jolt_openings::GroupBatchOpening, with Sponge, PendingEof, prove_batch, verify_batch and check_eof.

Removed

• bridged_akita_session: the second Akita transcript and its session handshake.
• append_verifier_setup: setup dimensions, chunk profile, layout and catalog digest absorbed into Jolt's transcript.
• append_batch_statement and the bind_*_statement_transcripts helpers: the statement absorbed twice.

The standalone path

The generic BatchOpeningScheme path and the single-polynomial path still run Akita on a fresh Akita session. Only tests, benches and the ZK stub use them. The session label (standalone_session) binds what Akita's own descriptor does not:

• two challenges squeezed from the caller's transcript, which tie the opening to the caller's state;
• the commitment's layout digest and the setup's default layout digest;
• the trusted catalog's digest.

All parts have fixed lengths. The embedded stage-8 path does not use this label.

The regression in the earlier head, and the fix

The earlier head of this PR (933024d97) had three problems.

• Wire and decoding. It changed the commitment wire to carry the group's whole canonical bytes, profile included. Commitments grew from 166 to 510 bytes. It also deleted shape_guard, so Akita's self-describing decoder ran before any trusted-length check. A forged header could make the verifier reserve up to about 1 GiB before rejecting. That reaches the production verifier, at stage 8.
• Standalone path. Removing bridged_akita_session left the standalone session without the caller's transcript state and Jolt's layout and catalog digests. J7's catalog-replay and opening-layout tests caught this. The production verifier was not affected: it only uses the embedded path, where Akita's descriptor binds the selected row and the layout, and stage 0 binds the commitments.
• Weakened tests. Instead of fixing the cause, several tests were loosened:
  • the forged-metadata pin test was removed;
  • two FS replay tests were made to accept a rejection at stage 8;
  • the serde transport test lost its setup-prefix check.

The fix:

• Wire and guard. Main's commitment wire is back. The verifier runs feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107's shape_guard before decoding, on both the embedded and the standalone path.
• Standalone session. standalone_session binds the caller state and the digests.
• Tests. Every weakened test is restored to its base form. The FS replay harness now replays absorbed messages too (below), so the frozen verifier stays honest through stage 8, and frozen.output.is_ok() holds again.

Sizes

Bincode sizes of the two Akita fixture proofs. "main" is a16z/jolt main (5aa807b03). "#2107" is its head (adb9a79c8), which adds Akita #232's category-3 SIS policy. "J8" is this PR. J8's opening counts the 33-byte joint_opening_proof plus Akita's bytes in Jolt's argument string.

	main	#2107	J8	J8 − #2107
muldiv commitments	166	296	296	0
muldiv stages	11,677	11,677	11,942	+265
muldiv opening	65,321	74,946	74,935	−11
muldiv total	82,006	91,761	92,019	+258
advice commitments	166	296	296	0
advice stages	11,677	11,677	11,945	+268
advice opening	69,699	80,719	80,728	+9
advice total	86,582	97,862	98,143	+281

• Commitments. J8's commitments are the same size as feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107's. Main's commitment wire is unchanged. The growth from 166 to 296 bytes is in the committed rows, which are larger under misc: Allocation Optimizations #232's category-3 parameters.
• Openings. Within a few bytes of feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107. The opening growth from main (+9,625 muldiv, +11,020 advice) is all misc: Allocation Optimizations #232's category-3 SIS raise, which feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107 already carries; the embedding adds nothing. J8's joint_opening_proof keeps only the 33-byte schedule selection. Akita's 74,902 (muldiv) and 80,695 (advice) bytes now live in Jolt's argument string.
• Stages. The 265–268 extra bytes are J7's per-round proof-of-work nonces, which main and feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107 do not have yet. J8 changes no stage proof.

Can the verifier derive the commitment metadata?

Each field, and where the verifier could get it instead of reading it from the commitment:

• num_vars: from the opening point's length.
• poly_count: from the number of claims in the statement.
• one_hot_k: from the verifier setup.
• backend_coeff_len: from the trusted profile of the selected schedule row (outer_compression_plan).
• layout_digest: for the trace group, from setup.default_layout_digest. Advice and program commitments choose their layout when they are committed, so the verifier cannot derive their digest without a per-object source.

This PR does not change these fields.

Tests

Restored to base

• akita_forged_commitment_metadata_rejects_before_shape_backed_allocation (tests/pathologies.rs).
• The fs_attacks replay tests with frozen.output.is_ok().
• The serde-transport setup-prefix assertion (scheme.rs).
• J7's catalog-replay and direct-opening-layout tests, including both expect_errs.
• The preprocessing digest domains and goldens.

New

• akita_argument_string_tampers_reject. It checks that an appended argument-string byte gives NargNotConsumed, and that a flipped byte or a truncated string rejects.
• standalone_session_binds_jolt_metadata_and_the_caller_state. It checks that the session changes with the caller's transcript, either layout digest, and the flavor.
• The streamed trace-batch test now also checks that each of these rejects:
  • a verifier setup with a different max_num_vars, polynomial bound, default layout digest or one-hot K;
  • one appended argument byte;
  • a forged backend_coeff_len (rejected by the shape guard, with the message matched);
  • a proof that carries a non-empty backend_proof.
• Sponge agreement. Both embedded batch tests check that the prover's and verifier's sponges agree after the opening.

FS harness

• Script::absorb_bytes lets the test-only ScriptedTranscript substitute absorbed bytes. The audit harness records every absorbed message and replays it, so a frozen verifier's sponge matches the honest one.
• The FS scanner records the calls where Akita takes the transcript (batched_verify_embedded, verify_batch, check_eof).
• The inventories are re-blessed.

Test-diff audit

Every assertion removed, loosened or rewritten against J7 and main:

• setup_key_transcript_binds_backend_shape (removed). It checked that Jolt's transcript absorbed the backend setup shape, and append_verifier_setup is gone. Its replacements:
  • Embedded path. Akita's descriptor binds the setup seed and the selected schedule. The trace batch must match the setup's shape, layout digest and K exactly. The setup-mismatch loop in the streamed test pins each of these.
  • Standalone path. standalone_session binds the layout and catalog digests. max_num_vars and one-hot K are checked for exact equality.
• J7's squeeze-equality checks after verify (rewritten). These are back, with the squeeze taken just before check_eof.
• akita_field_inline_e2e: flip a backend_proof byte → flip an argument-string byte (rewritten). backend_proof is now always empty, and the new streamed check covers a non-empty one.
• Inventory entries for deleted functions (removed). The new hand-off entries replace them.
• The replay harness does not require every recorded absorb to be replayed. This is intentional: attack replays stop when the verifier rejects.
• feat(akita)!: NIST category 3 Module-SIS and 2^31 schedule coverage #2107's commits. Nothing removed or loosened. Counts re-blessed after the catalog regeneration.

Soundness re-check

A read-only review of this PR's diff found all seven questions sound:

1. The standalone path binds the caller state, the commitment, the layout and catalog digests, the point and the evaluations.
2. The embedded stage-8 path absorbs nothing beyond Akita's own statement. It rejects trailing bytes and a non-empty backend proof.
3. On both paths, every commitment is decoded only after the trusted-shape check. No new verifier-reachable panic or unbounded allocation.
4. Stage 0 is unchanged: one shared function, with fixed-width or length-prefixed parts.
5. The absorbed-byte substitution exists only under test-utils, and its identity encoding absorbs exactly the original message.
6. A catalog holds one row per layout and shape, so the selection is unambiguous.
7. Grinding is unchanged and stays per round.

Two notes:

• The bridge was one field element (about 127 bits). That allowed a caller-state collision in about 2^64 work. It is now two field elements.
• The standalone opening no longer absorbs the statement into the caller's transcript. The BatchOpeningScheme docs already leave binding the statement to the caller.

Validation

All on a Linux sandbox with CI's commands (cargo nextest run --cargo-profile ci); every run passed:

• -p jolt-transcript, and -p jolt-transcript --all-features
• -p jolt-akita, with and without field-inline
• -p jolt-verifier --test fs_attacks, with akita,fs-audit,prover-fixtures and with fs-audit,prover-fixtures
• -p jolt-verifier --test fs_obligations, with fs-audit and with fs-audit,akita
• -p jolt-verifier --features akita,prover-fixtures --test-threads 1 (84 tests)
• -p jolt-prover --features akita,prover-fixtures (40 tests)
• -p jolt-prover --features prover-fixtures,field-inline,akita, including akita_field_inline_e2e (37 tests)
• -p jolt-verifier --features field-inline,akita, and --features prover-fixtures,field-inline,akita --test-threads 1
• Dory: -p jolt-verifier --features prover-fixtures --test-threads 1 (140 tests)

Clippy passes for jolt-transcript (all features, and bn254,solinas,binary,prover-grinding), jolt-verifier and jolt-prover with akita,prover-fixtures, jolt-verifier with fs-audit,akita,prover-fixtures, and CI's field-inline crate set with -D warnings. cargo fmt, taplo fmt and check_style_invariants.py pass.

Final round at this head (ed90d31d7, Akita pin e9d85d1f7), all passing:

• cargo nextest run --cargo-profile ci -p jolt-akita (95 tests)
• -p jolt-verifier --test fs_obligations, with fs-audit and with fs-audit,akita
• --cargo-profile ci -p jolt-verifier --test fs_attacks --features akita,fs-audit,prover-fixtures
• cargo clippy -p jolt-verifier --all-targets --features akita,prover-fixtures, and cargo clippy -p jolt-akita --all-targets -- -D warnings

The runs above the final round were on the previous commit, which differs only in the Akita pin (062106ee3, before the merge of #253's head) and the re-blessed inventories.

Follow-ups

• Descriptor sub-digests are still Blake2b.
• feat(transcript)!: move the transcript onto jolt-transcript (protocol v8) LayerZero-Labs/akita#253 drops the field_sampling_is_certified setup check from transcript_binding.rs. That is Optimize read-write memory commitments #253's change, not this PR's.

🤖 Generated with Claude Code

[github-actions]

📏 PR diff

Note

Actual code changed: 615 lines

🟢 +310 added    🔴 −305 removed

Tests, docs, fixtures, and helper scripts excluded.

Category	🟢 Added	🔴 Removed
⌨️ Actual code	+310	−305
🧪 Tests	+303	−172
📚 Docs	+70	−37
📦 Fixtures	+67	−258
🔧 Helper scripts	0	0
Total diff	+750	−772

_{Every changed line is classified once.}