refactor(stark): share what the multilinear path needs - #997
Draft
ColoCarletti wants to merge 1 commit into
Draft
ColoCarletti wants to merge 1 commit into
ColoCarletti wants to merge 1 commit into
Conversation
… here Five changes to shared code, none of which move a univariate proof. **The grind moves to `crypto`.** Both provers do the same proof-of-work search, and only one of them could reach it while it lived in `stark`. The algorithm, the prefix and the validity predicate come over unchanged; `stark::grinding` re-exports what it used to define, and the device dispatch counter moves with it, so `gpu_lde::gpu_grind_calls` now reads the counter where the dispatch happens. **A preprocessed commitment is computed when someone asks for it.** It used to be computed whether or not anything read it. On the univariate path something always does — the verifier compares it against the proof's root — but the multilinear one has no separate root and checks the columns instead, so on that path nobody ever asks, and on a real program the ones that are not compiled-in constants are an LDE and a Merkle tree each, two dozen times over. `with_preprocessed` keeps its meaning and its signature. **The AIR says three things it already knew.** `bus_interactions()` and `max_constraint_degree()` were computed inside `composition_poly_degree_bound`; they are now methods, and that function calls them. `precomputed_columns()` is new and defaults to empty: it is what replaces comparing a root, and what generates it is the same work that recomputing the commitment costs. The five preprocessed tables supply it through `with_preprocessed_columns`, extracted from the `compute_*_commitment` that already built those columns to hash them. **Two passes go wide.** `Table::columns` transposes one column per worker, and `in_place_bit_reverse_permute` takes the row-major path it already had for a power-of-two length. A permutation is a permutation and a transpose is a transpose: same values, same places. What was checked, and what could not be: every **preprocessed** commitment root of a continuation proof is identical to what the parent produces, which is the part this touches — the deferred commitment and the extracted columns. The trace roots cannot be compared across runs at all, on this commit or on its parent: six tables lay their deduplicated rows out in `HashMap` order, so two runs of the same binary already disagree on twenty of seventy-nine roots. 557 tests in the prover — main's number — 51 in crypto, 223 in stark, 182 in math.
ColoCarletti
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rearranges code both provers use so a second one can reach it. No new
behaviour, no new callers.
grindingmoves fromstarktocrypto, unchanged. It lived where onlyone prover could reach it;
stark::grindingre-exports what it defined,and the GPU dispatch counter moves with it.
the univariate path something always asks, so nothing changes but when.
AIRgainsbus_interactions()andmax_constraint_degree()— both werealready computed inside
composition_poly_degree_bound, which now callsthem — and
precomputed_columns(), which the five preprocessed tablessupply from the code that already built those columns to hash them.
Table::columnsandin_place_bit_reverse_permutego parallel. Samevalues, same places.
Checked: every preprocessed commitment root of a continuation proof is
byte-identical to main's, across all tables of all epochs.