Efficient bytecode commitment with dory precommitted geometry#1344
Open
Efficient bytecode commitment with dory precommitted geometry#1344
Conversation
Use phase-specific stage6a/stage6b sumcheck params and proof wiring so zk transcript and constraints stay aligned after splitting stage6. This preserves the split design while fixing zk failures without introducing bytecode-commitment features. Made-with: Cursor Co-authored-by: Quang Dao <qvd@andrew.cmu.edu>
…rifier Adopt embedded-main Dory scheduling with shared precommitted claim-reduction plumbing so stage 6/8 can handle dominant precommitted contexts consistently in both zk and non-zk flows. Made-with: Cursor
Add committed bytecode/program-image claim-reduction and opening-flow updates so verifier-side checks stay consistent with staged precommitted claims. Extend SDK macro helpers for committed prover/verifier preprocessing and align guest/shared verifier preprocessing construction. Made-with: Cursor Co-authored-by: Quang Dao <qvd@andrew.cmu.edu>
… constraints Introduce committed program/bytecode helpers (`program.rs`, `bytecode/chunks.rs`) and wire bytecode/program-image claim reductions into the zk verifier constraint path. Also update Dory geometry/one-hot integration and related tests to keep committed-mode openings and challenge binding consistent. Co-authored-by: Quang Dao <qvd@andrew.cmu.edu>
Wire Stage 6a into global BlindFold stage verification so address-phase bridge constraints are enforced in ZK mode, and refactor Booleanity/BytecodeReadRaf into explicit address/cycle phase paths to remove legacy monolithic implementations and duplicated logic. Removed debugger artifacts from committed-mode Stage 8 opening handling, update wasm preprocessing wiring, and remove the obsolete fibonacci2 example workspace entries. Made-with: Cursor
RadNi
force-pushed
the
amir/bytecode-commitment-merged
branch
from
e1f40a4 to
95d0a6a
Compare
Move total-variable sizing into `JoltSharedPreprocessing` so prover and verifier use the same precommitted candidate and max-var calculations.
Document how precommitted polynomials fit into the shared Dory geometry, how the final opening point is derived across layouts, and why the precommitted variable permutation is needed to preserve low-to-high binding.
Add support for processing committed bytecode in various examples by introducing a command-line argument to specify the bytecode chunk. Minor bug fix for program-image in committed mode.
RadNi
force-pushed
the
amir/bytecode-commitment-merged
branch
from
b732431 to
a0ca612
Compare
Canonicalize odd/even Dory setup sizes that map to the same generator bucket so repeated proofs reuse a consistent setup instead of mixing cached prepared points from different URS files. Also stop full-mode preprocessing from sizing prover setups against committed bytecode and program-image dimensions.
RadNi
requested review from
0xAndoroid,
markosg04,
moodlezoup and
sagar-a16z
as code owners
0xAndoroid
reviewed
Mar 24, 2026
Comment on lines
+494
to
+504
| if debug_bytecode_reduction_enabled() { | ||
| tracing::info!( | ||
| "BytecodeClaimReduction cache cycle len={} bound_value={} bound_eq={} scale={} cycle_claim={} synced_cycle_claim={}", | ||
| self.value_poly.len(), | ||
| self.value_poly.get_bound_coeff(0), | ||
| self.eq_poly.get_bound_coeff(0), | ||
| self.scale, | ||
| c_mid, | ||
| synced_cycle_claim, | ||
| ); | ||
| } |
Collaborator
There was a problem hiding this comment.
Seems like there's still a lot of debugging leftovers in the PR
0xAndoroid
reviewed
Mar 24, 2026
Comment on lines
+18
to
+22
| let bytecode_chunk = std::env::args() | ||
| .skip_while(|arg| arg != "--committed-bytecode") | ||
| .nth(1) | ||
| .map(|arg| arg.parse().unwrap()); | ||
| #[cfg(any(feature = "nostd", feature = "std"))] |
Collaborator
There was a problem hiding this comment.
I think we shouldn't include this in every example. I'd prefer to have one new example with committed bytecode in fib.
Collaborator
Delete unused binary test files to clean up the repository.
…er evaluation path. Removed leftover debugging instruments. Updated wasm-pack installation URL.
Expose Dory opening-hint accessors and a preprocessing constructor that accepts precomputed generators. This lets jolt-cpp serialize Dory hints and reuse loaded prover setup without carrying ad hoc local patches in the submodule consumer. Made-with: Cursor
…ent-merged Made-with: Cursor
Required by the gen_inlines tool to pre-allocate Reg{40} before
generating inline sequences, matching INLINE::trace()'s rd=0
remapping at runtime.
Made-with: Cursor
…d output check When phase1_num_rounds < log_T, the input_claim for RafEvaluation and OutputCheck sumchecks is pre-scaled by 2^(phase3_cycle_rounds) to pre-compensate for the gap-round halvings. However, the raw polynomial evaluations computed from the witness data sum to the unscaled claim. This mismatch causes UniPoly reconstruction to produce an incorrect polynomial, failing the verifier's poly(0) + poly(1) == previous_claim check. Scale the raw evaluations by 2^(phase3_cycle_rounds) before polynomial reconstruction so they are consistent with the pre-scaled previous_claim. Made-with: Cursor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds committed-program support for bytecode and program-image openings throughout the zkVM flow. This allows prover to efficiently prove bytecode / program-image polynomials openings instead of verifier directly evaluating them which significantly reduces the recursion cycles.
The main changes are: