Zook : Protocol Wiring

[ocdbytes]

Summary

Adds the Zook zero-knowledge protocol (Construction 9.7) end-to-end, along with the supporting protocol and parameter-selection changes it needs. Added adaptive rate planning for optimised proving schedule.

Changes

• Zook protocol (protocols/zook/) : new module implementing the Construction 9.7 ZK flow: commit → per-round (sumcheck → code-switch → mask discharge) → basecase, closed out via FinalClaim.
• Code-switch : threads a mutable Claim { covector, sum } keeping μ == ⟨vector, covector⟩ across rounds; adds verify_for_implicit/CovectorUpdateParams for implicit covector accumulation.
• Mask proximity : per-mask discharge (mask_contribution_covectors) running the Construction 7.2 target check, with claims bound before γ.
• NTT : masks moved out of the engine: interleaved_encode is now a pure encoder over message ‖ mask slices (&[&[F]] → Buffer<F>); drops the Messages/masks API.
• Adaptive rate scheduling (params/) : new RateSchedule (Stepping/Capped/Adaptive) and a Pareto-knee planner (adaptive.rs) choosing per-round inverse rates under the security target.
• Buffer : adds wipe() (zeroize secret buffers) and into_vec() (zero-copy readback for in-place sumcheck/basecase folds).
• Mask Machinery : adds a proper mask discharge and generate machinery.

Zook protocol flow

flowchart TD
    A["commit(witness)<br/>→ CommittedWitness"] --> B["γ ← verifier<br/>(RLC challenge)"]
    B --> C["covector = Σ γ·formⱼ<br/>sum = Σ γ·evalⱼ"]
    C --> D{"CommittedState?"}

    D -->|Basecase-only| BC
    D -->|Round| L

    subgraph L["per round: reduce (message, covector, sum)"]
        direction TB
        R0["RoundMaskOracle::begin<br/>sample + commit sumcheck-mask tree"]
        R1["sumcheck.prove(message, covector, sum, blinding)<br/>→ opening (round challenges)"]
        R2["bind_code_switch_mask<br/>build cs_mask, commit, send mask_eval_sum<br/>reconcile sum → unmasked dot"]
        R3["extend covector for ZK mask region"]
        R4["code_switch.prove(message, irs_witness,<br/>Claim{covector, sum}, challenges, cs_mask)<br/>→ cs_witness"]
        R5["masker.finish<br/>prove both mask trees<br/>subtract cs_mask contribution from sum"]
        R6["message ← cs_witness.message<br/>irs_witness ← cs_witness.target_witness<br/>truncate covector"]
        R0 --> R1 --> R2 --> R3 --> R4 --> R5 --> R6
    end

    L -->|"loops over self.rounds()<br/>invariant: sum == ⟨message, covector⟩"| BC

    BC["basecase.prove(message, witness, covector, sum)"] --> F["FinalClaim<br/>verifier checks:<br/>scale · Σ rlcⱼ · formⱼ(eval_pt) == contribution"]

Loading

[codspeed-hq]

Merging this PR will not alter performance

✅ 10 untouched benchmarks
⏩ 22 skipped benchmarks¹

---

_{Comparing ocdbytes:aj/zk-whir-3-4 (3655bd0) with main (92652ca)}

Footnotes

1. 22 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[shreyas-londhe]

Thanks for the PR @ocdbytes. The protocol wiring looks correct, but prove/verify are Identity<F>-only, so base-field embedding doesn't run end to end yet.

commit is generic over the embedding (impl<M: Embedding + Default> ProtocolConfig<M>), so a base-field witness commits fine. But prove and verify are implemented only on ProtocolConfig<Identity<F>>, and there is no other impl. A base-field config can commit but has no prove method.

Reproduced by attempting to prove with Basefield<Field64_2> (Source = base prime field, Target = ext):

error[E0599]: no method named `prove` found for struct
  `ProtocolConfig<Basefield<Field64_2>>` in the current scope
  = note: the method was found for
          - `ProtocolConfig<Identity<F>>`

commit on that same config compiles; only prove fails. Every test uses TestEmbedding = Identity<TestField>, so nothing drives a base-to-ext embedding through prove/verify.

What's missing to close it:

1. Generalize prove/verify from impl ProtocolConfig<Identity<F>> to impl<M: Embedding>.
2. ProverRoundState<F>/VerifierRoundState<F> hold a single field. Round 0 needs IrsWitness<M::Source> (base) alongside message/covector/sum in M::Target (ext), then transitions to M::Target after the first code-switch.
3. ProtocolConfig<M> stores rounds: Vec<RoundConfig<M>>, one embedding for all rounds. A real base-to-ext chain needs round 0 as RoundConfig<M> and rounds 1..n as RoundConfig<Identity<M::Target>>.
4. The mask fold fold_chunks(irs_witness.masks, round_challenges) is single-field; round 0 folds base masks by ext challenges, so it needs an embedding-aware variant.

code_switch::prove/verify are already generic over M, and the IRS layer has a Basefield::<Field64_2> proptest, so the sub-protocols are ready. The gap is the top-level driver.

Did you mean base-field is supported at the commit/IRS layer, or is there a test driving it through prove/verify that I've missed?