Skip to content

feat: Mavros main and sound Mavros public-input binding - #507

Open
BornPsych wants to merge 20 commits into
mainfrom
ys/ark06-mavros-main
Open

BornPsych wants to merge 20 commits into
mainfrom
ys/ark06-mavros-main

Conversation

@BornPsych

@BornPsych BornPsych commented Oct 12, 2026 •

Copy link
Copy Markdown
Collaborator
  • Pins Mavros to main (a4f2a3d), which includes Add a versioned r1cs.bin artifact carrying a witness manifest reilabs/mavros#414. Its r1cs.bin carries a versioned header, a witness manifest and a digest over the R1CS and manifest. A legacy bincode r1cs.bin is rejected with a hint to recompile at the pinned revision.
  • Mavros writes public parameters first and computes the return at the tail of the algebraic section. A column map built from the manifest brings the return forward so public inputs occupy witness[1..=n], and the prover applies the same permutation to the witness and to the AD derivatives (skipped when the map is the identity).
  • The circuit computes its return; a return entry in Prover.toml is optional and, when present, checked against the computed value, as nargo does. The return guard Mavros used to emit is gone.
  • The Mavros digest is the Fiat-Shamir session id. Prover, scheme and verifier keys carry it, and a verifier holding a different digest, or none, rejects an honest proof. WhirR1CSVerifier gains verify_with_session; verify delegates to it with no session. Prover, scheme and verifier formats move to 3.1.
  • Build the SPARK matrix from the scheme R1CS for both frontends, so --r1cs is no longer needed for SPARK with the Mavros compiler.
  • Parity tooling. scripts/mavros_parity.sh runs circuits through both frontends and compares public inputs, prove time and proof size. A scheduled workflow (Monday and Thursday, plus dispatch) runs it over every binary example with inputs, building the Mavros CLI on stable at the pinned revision.

Mavros is still not the primary compiler. A follow-up PR will make Mavros primary and the Noir R1CS path secondary, and once Mavros has a stable release the other backend will be removed.

@vercel

vercel Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
docs-provekit-org Ready Ready Preview Oct 22, 2026 5:19pm UTC

Request Review

@github-actions

github-actions Bot commented Oct 12, 2026 •

Copy link
Copy Markdown

CSP benchmarks

Metric Value
Workflow status [PASS] success
Commit 52c3a9bdad5b
Run #39821527970
Circuits benchmarked 21
Iterations averaged per circuit 3

Prover time, peak RSS, peak heap, and verifier time are arithmetic means across the iterations. Peak heap comes from the largest peak memory entry in provekit-cli prove's tracing output; peak RSS is reported by /usr/bin/time -v (max-resident-set-size).

Each metric cell shows the current value followed by the percentage delta against the latest successful main run #39801198448. (new) marks circuits absent from the baseline.

Results
Circuit Constraints Witnesses Prover time Peak RSS Peak heap Verifier time Proof size PKP size
ecdsa_p256 143,321 (±0.0%) 258,215 (±0.0%) 1.40 s (±0.0%) 268 MB (-0.1%) 232 MB (±0.0%) 100 ms (±0.0%) 448 KB (+1.9%) 831 KB (±0.0%)
keccak_1024 788,814 (±0.0%) 1,490,812 (±0.0%) 3.94 s (+0.4%) 1.05 GB (±0.0%) 1.05 GB (±0.0%) 450 ms (±0.0%) 485 KB (-1.3%) 6.01 MB (±0.0%)
keccak_128 157,522 (±0.0%) 304,529 (±0.0%) 970 ms (-1.0%) 282 MB (+0.8%) 248 MB (±0.0%) 120 ms (±0.0%) 445 KB (-0.3%) 1.24 MB (±0.0%)
keccak_2048 1,507,374 (±0.0%) 2,840,532 (±0.0%) 7.69 s (+0.1%) 1.98 GB (±0.0%) 2.07 GB (±0.0%) 857 ms (-1.5%) 547 KB (+1.9%) 12.15 MB (±0.0%)
keccak_256 247,782 (±0.0%) 474,010 (±0.0%) 1.14 s (-0.6%) 335 MB (-0.1%) 304 MB (±0.0%) 153 ms (-2.2%) 446 KB (-0.4%) 1.89 MB (±0.0%)
keccak_512 428,126 (±0.0%) 812,944 (±0.0%) 2.07 s (-0.2%) 584 MB (-0.1%) 558 MB (±0.0%) 257 ms (±0.0%) 469 KB (-0.3%) 3.25 MB (±0.0%)
poseidon2_12 479 (±0.0%) 563 (±0.0%) 40 ms (±0.0%) 13.53 MB (-2.7%) 4.17 MB (±0.0%) 10 ms (±0.0%) 228 KB (+0.3%) 437 KB (±0.0%)
poseidon2_16 556 (±0.0%) 719 (±0.0%) 40 ms (±0.0%) 14.25 MB (-2.0%) 4.33 MB (+0.1%) 10 ms (±0.0%) 224 KB (+0.8%) 530 KB (±0.0%)
poseidon2_2 231 (±0.0%) 278 (±0.0%) 40 ms (±0.0%) 12.75 MB (-2.5%) 3.44 MB (±0.0%) 10 ms (±0.0%) 224 KB (+0.5%) 108 KB (±0.0%)
poseidon2_4 529 (±0.0%) 535 (±0.0%) 30 ms (±0.0%) 13.15 MB (-2.7%) 3.63 MB (±0.0%) 10 ms (±0.0%) 226 KB (+2.0%) 31.93 KB (±0.0%)
poseidon2_8 363 (±0.0%) 423 (±0.0%) 40 ms (±0.0%) 13.31 MB (-3.3%) 4.08 MB (±0.0%) 10 ms (±0.0%) 232 KB (+1.9%) 365 KB (±0.0%)
poseidon_12 504 (±0.0%) 524 (±0.0%) 40 ms (±0.0%) 13.91 MB (-1.7%) 4.27 MB (±0.0%) 10 ms (±0.0%) 227 KB (-2.4%) 569 KB (±0.0%)
poseidon_16 609 (±0.0%) 633 (±0.0%) 50 ms (±0.0%) 14.68 MB (-2.3%) 4.94 MB (+0.1%) 10 ms (±0.0%) 226 KB (+0.2%) 717 KB (±0.0%)
poseidon_2 240 (±0.0%) 249 (±0.0%) 33 ms (+11.0%) 12.81 MB (-2.0%) 3.40 MB (±0.0%) 10 ms (±0.0%) 226 KB (+0.1%) 59.38 KB (±0.0%)
poseidon_4 297 (±0.0%) 309 (±0.0%) 40 ms (±0.0%) 13.74 MB (-2.3%) 4.02 MB (±0.0%) 10 ms (±0.0%) 227 KB (+1.0%) 333 KB (±0.0%)
poseidon_8 402 (±0.0%) 418 (±0.0%) 40 ms (±0.0%) 13.73 MB (-2.5%) 4.15 MB (±0.0%) 10 ms (±0.0%) 226 KB (+0.3%) 448 KB (±0.0%)
sha256_1024 196,913 (±0.0%) 339,721 (±0.0%) 1.06 s (+0.9%) 318 MB (-0.9%) 286 MB (±0.0%) 170 ms (±0.0%) 456 KB (+0.7%) 1.83 MB (-4.3%)
sha256_128 46,371 (±0.0%) 80,931 (±0.0%) 270 ms (±0.0%) 85.01 MB (-2.3%) 67.81 MB (±0.0%) 50 ms (±0.0%) 388 KB (±0.0%) 495 KB (+0.1%)
sha256_2048 345,372 (±0.0%) 612,681 (±0.0%) 2.06 s (+0.5%) 567 MB (-0.1%) 535 MB (±0.0%) 303 ms (+1.1%) 459 KB (-2.2%) 3.09 MB (+0.8%)
sha256_256 67,877 (±0.0%) 117,901 (±0.0%) 443 ms (-0.8%) 141 MB (-1.6%) 120 MB (±0.0%) 70 ms (±0.0%) 404 KB (-0.4%) 693 KB (-1.4%)
sha256_512 110,889 (±0.0%) 191,841 (±0.0%) 567 ms (±0.0%) 175 MB (+0.9%) 153 MB (±0.0%) 100 ms (±0.0%) 404 KB (-0.9%) 1.08 MB (+2.2%)

@BornPsych BornPsych changed the title feat: arkworks 0.6, Mavros main and sound Mavros public-input binding feat: Mavros main and sound Mavros public-input binding Oct 14, 2026
@BornPsych
BornPsych force-pushed the ys/ark06-mavros-main branch from 1dc088c to 27ba3c6 Compare October 19, 2026 10:45
@BornPsych
BornPsych marked this pull request as ready for review October 19, 2026 12:47
@BornPsych
BornPsych added this pull request to stack #516 October 21, 2026 07:15
…ey layout

MavrosProver now serializes the column map and WitnessLayout gained the
guard and return fields, so keys written before this branch no longer
parse. Bump the minor so a stale .pkp or .nps is rejected with a version
error instead of a deserialization failure, as #457 did for the previous
MavrosSchemeData change. Verifier files are unchanged.

diff --git a/provekit/common/src/file/binary_format.rs b/provekit/common/src/file/binary_format.rs
index 3e36b19..68589d9 100644
--- a/provekit/common/src/file/binary_format.rs
+++ b/provekit/common/src/file/binary_format.rs
@@ -18,13 +18,13 @@ pub const XZ_MAGIC: [u8; 6] = [0xfd, 0x37, 0x7a, 0x58, 0x5a, 0x00];
 // ---------------------------------------------------------------------------

 pub const PROVER_FORMAT: [u8; 8] = *b"PrvKitPr";
-pub const PROVER_VERSION: (u16, u16) = (2, 0);
+pub const PROVER_VERSION: (u16, u16) = (2, 1);

 pub const VERIFIER_FORMAT: [u8; 8] = *b"PrvKitVr";
 pub const VERIFIER_VERSION: (u16, u16) = (2, 1);

 pub const NOIR_PROOF_SCHEME_FORMAT: [u8; 8] = *b"NrProScm";
-pub const NOIR_PROOF_SCHEME_VERSION: (u16, u16) = (2, 0);
+pub const NOIR_PROOF_SCHEME_VERSION: (u16, u16) = (2, 1);

 pub const NOIR_PROOF_FORMAT: [u8; 8] = *b"NPSProof";
 pub const NOIR_PROOF_VERSION: (u16, u16) = (2, 0);

pub const VERIFIER_FORMAT: [u8; 8] = *b"PrvKitVr";
pub const VERIFIER_VERSION: (u16, u16) = (3, 0);
pub const VERIFIER_VERSION: (u16, u16) = (3, 1);

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should these be major version bumps?
A 3.0 reader accepts 3.1 files, and postcard silently ignores the appended fields. For the verifier, that means dropping mavros_digest and using a zero session instead of rejecting the incompatible key.

We should bump the major versions and document that existing keys need regeneration.

.verify(&proof.whir_r1cs_proof, &proof.public_inputs, &self.r1cs)?;
.verify_with_session(
&proof.whir_r1cs_proof,
&proof.public_inputs,

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This predates the PR, but could we check
proof.public_inputs.len() == self.r1cs.num_public_inputs before verification?
A modified prover can omit the public return, and the unchanged trusted verifier still accepts the proof. Binding the manifest digest does not enforce its expected public-input count.

This branch was successfully deployed

1 active deployment
Preview — 137cf91e Deployed Oct 22, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants