[zkfriendly]

Summary

Closes #493

Add joint WHIR opening for ProveKit’s two-stage witnesses.

The prover and verifier call WHIR’s prove_pair and verify_pair directly.

How it works

After the Spartan sumcheck, each matrix claim has contributions from both witness stages.

For witnesses $w_1,w_2$ and coefficient vectors $L_1,L_2$, combine those contributions:

$$ \mu = \langle w_1,L_1\rangle + \langle w_2,L_2\rangle. $$

Split matrix columns at the original witness boundary, then pad each block to the same size.

Represent the combined form with a selector coordinate:

$$ L(s,x) = (1-s)L_1(x) + sL_2(x). $$

The selector chooses the first block at $s=0$ and the second block at $s=1$.

Apply this construction to A, B, and C. WHIR opens the combined claims against the two existing commitments and returns one shared evaluation point.

Implementation

• Represent joint forms as two branches, without allocating a separate concatenated coefficient vector.
• Compute combined matrix claims directly from the existing witness buffers.
• Check those bindings and complete WHIR verification with FinalClaim::verify.
• Emit one combined SPARK column query, including the selector coordinate.
• Validate commitment counts, witness dimensions, and joint-opening parameters.

The Spartan blinding commitment retains its separate opening.

Tests

Tests cover:

• Readable examples, including $3 \times 4 = 12$ and $20 + 146 = 166$.
• Rejection of incorrect public inputs, stage challenges, and malformed proofs.
• Combined SPARK queries and proof verification.
• Opening-mode serialization, transcript binding, and single-stage compatibility.

Arkworks compatibility

Both joint-opening branches now use Arkworks 0.6 and the matching published Spongefish dependencies.
The temporary Arkworks 0.5 configuration is removed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs-provekit-org	Ready	Preview	Oct 19, 2026 7:45am UTC

[github-actions]

CSP benchmarks

Metric	Value
Workflow status	[PASS] success
Commit	e45d6cf21179
Run	#39218076779
Circuits benchmarked	21
Iterations averaged per circuit	3

Prover time, peak RSS, peak heap, and verifier time are arithmetic means across the iterations. Peak heap comes from the largest peak memory entry in provekit-cli prove's tracing output; peak RSS is reported by /usr/bin/time -v (max-resident-set-size).

Each metric cell shows the current value followed by the percentage delta against the latest successful main run #39217449505. (new) marks circuits absent from the baseline.

Results

Circuit	Constraints	Witnesses	Prover time	Peak RSS	Peak heap	Verifier time	Proof size	PKP size
ecdsa_p256	143,321 (±0.0%)	258,215 (±0.0%)	1.42 s (-5.6%)	268 MB (+13.1%)	232 MB (+18.0%)	100 ms (-9.1%)	440 KB (-38.1%)	831 KB (±0.0%)
keccak_1024	788,814 (±0.0%)	1,490,812 (±0.0%)	3.94 s (-7.2%)	1.05 GB (+15.5%)	1.05 GB (+18.9%)	447 ms (-5.6%)	493 KB (-36.0%)	6.01 MB (±0.0%)
keccak_128	157,522 (±0.0%)	304,529 (±0.0%)	973 ms (-8.2%)	280 MB (+11.2%)	248 MB (+18.2%)	117 ms (-10.2%)	442 KB (-40.3%)	1.24 MB (±0.0%)
keccak_2048	1,507,374 (±0.0%)	2,840,532 (±0.0%)	7.69 s (-7.0%)	1.98 GB (+13.4%)	2.07 GB (+18.7%)	860 ms (-2.3%)	547 KB (-39.5%)	12.15 MB (±0.0%)
keccak_256	247,782 (±0.0%)	474,010 (±0.0%)	1.15 s (-7.8%)	332 MB (+10.3%)	304 MB (+18.1%)	160 ms (-7.7%)	450 KB (-36.8%)	1.89 MB (±0.0%)
keccak_512	428,126 (±0.0%)	812,944 (±0.0%)	2.08 s (-6.6%)	584 MB (+10.9%)	558 MB (+18.4%)	257 ms (-4.9%)	476 KB (-37.0%)	3.25 MB (±0.0%)
poseidon2_12	479 (±0.0%)	563 (±0.0%)	40 ms (-7.6%)	13.99 MB (+2.1%)	4.17 MB (±0.0%)	10 ms (±0.0%)	227 KB (+0.5%)	437 KB (±0.0%)
poseidon2_16	556 (±0.0%)	719 (±0.0%)	40 ms (-14.3%)	14.49 MB (+0.9%)	4.33 MB (+0.1%)	10 ms (±0.0%)	226 KB (+0.1%)	530 KB (±0.0%)
poseidon2_2	231 (±0.0%)	278 (±0.0%)	40 ms (±0.0%)	13.15 MB (+2.2%)	3.44 MB (±0.0%)	10 ms (±0.0%)	226 KB (-0.4%)	108 KB (±0.0%)
poseidon2_4	529 (±0.0%)	535 (±0.0%)	30 ms (±0.0%)	13.48 MB (+1.2%)	3.63 MB (±0.0%)	10 ms (±0.0%)	227 KB (-0.3%)	31.93 KB (±0.0%)
poseidon2_8	363 (±0.0%)	423 (±0.0%)	43 ms (+8.2%)	13.81 MB (+2.2%)	4.08 MB (±0.0%)	10 ms (±0.0%)	222 KB (-2.2%)	365 KB (±0.0%)
poseidon_12	504 (±0.0%)	524 (±0.0%)	40 ms (±0.0%)	14.23 MB (+1.2%)	4.27 MB (±0.0%)	10 ms (±0.0%)	228 KB (+0.8%)	569 KB (±0.0%)
poseidon_16	609 (±0.0%)	633 (±0.0%)	50 ms (±0.0%)	15.10 MB (+1.7%)	4.93 MB (±0.0%)	10 ms (-24.8%)	227 KB (-0.2%)	717 KB (±0.0%)
poseidon_2	240 (±0.0%)	249 (±0.0%)	30 ms (-9.9%)	13.03 MB (+0.6%)	3.40 MB (±0.0%)	10 ms (±0.0%)	222 KB (-1.7%)	59.38 KB (±0.0%)
poseidon_4	297 (±0.0%)	309 (±0.0%)	40 ms (±0.0%)	14.00 MB (+1.3%)	4.02 MB (±0.0%)	10 ms (±0.0%)	223 KB (-1.5%)	333 KB (±0.0%)
poseidon_8	402 (±0.0%)	418 (±0.0%)	40 ms (±0.0%)	14.15 MB (+1.3%)	4.15 MB (±0.0%)	10 ms (±0.0%)	228 KB (+0.6%)	448 KB (±0.0%)
sha256_1024	196,913 (±0.0%)	339,721 (±0.0%)	1.06 s (-8.9%)	323 MB (+17.0%)	286 MB (+17.2%)	170 ms (-10.5%)	452 KB (-39.2%)	1.83 MB (-2.7%)
sha256_128	46,371 (±0.0%)	80,931 (±0.0%)	270 ms (-13.8%)	86.84 MB (+15.8%)	67.81 MB (+17.5%)	50 ms (-16.7%)	389 KB (-35.8%)	498 KB (-0.7%)
sha256_2048	345,372 (±0.0%)	612,681 (±0.0%)	2.06 s (-6.9%)	567 MB (+13.1%)	535 MB (+17.4%)	310 ms (-6.1%)	472 KB (-39.3%)	3.04 MB (-1.4%)
sha256_256	67,877 (±0.0%)	117,901 (±0.0%)	443 ms (-11.3%)	142 MB (+11.6%)	120 MB (+17.8%)	70 ms (-12.5%)	402 KB (-35.9%)	694 KB (-0.7%)
sha256_512	110,889 (±0.0%)	191,841 (±0.0%)	570 ms (-8.6%)	174 MB (+13.9%)	153 MB (+16.8%)	100 ms (-9.1%)	405 KB (-35.7%)	1.09 MB (+0.2%)

[shreyas-londhe]

LGTM