feat: Add the last merged table to the public inputs of the hiding circuit

barretenberg/cpp/src/barretenberg/client_ivc/client_ivc.cpp

@@ -9,6 +9,7 @@
 #include "barretenberg/common/streams.hpp"
 #include "barretenberg/honk/proving_key_inspector.hpp"
 #include "barretenberg/serialize/msgpack_impl.hpp"
+#include "barretenberg/special_public_inputs/special_public_inputs.hpp"
 #include "barretenberg/ultra_honk/oink_prover.hpp"
 
 namespace bb {
@@ -202,6 +203,9 @@ void ClientIVC::complete_kernel_circuit_logic(ClientCircuit& circuit)
     // .., A_{i, n} (app)
     auto accumulation_recursive_transcript = std::make_shared<RecursiveTranscript>();
 
+    // Commitment to the previous state of the op_queue in the recursive verification
+    TableCommitments T_prev_commitments;
+
     // Instantiate stdlib verifier inputs from their native counterparts
     if (stdlib_verification_queue.empty()) {
         instantiate_stdlib_verification_queue(circuit);
@@ -219,14 +223,17 @@ void ClientIVC::complete_kernel_circuit_logic(ClientCircuit& circuit)
         // we can use `batch_mul` here to decrease the size of the `ECCOpQueue`, but must be cautious with FS security.
         points_accumulator.aggregate(pairing_points);
 
+        // Update commitment to the status of the op_queue
+        T_prev_commitments = merged_table_commitments;
+
         stdlib_verification_queue.pop_front();
 
         is_hiding_kernel = (verifier_input.type == QUEUE_TYPE::PG_FINAL);
     }
 
     // Set the kernel output data to be propagated via the public inputs
     if (is_hiding_kernel) {
-        HidingKernelIO hiding_output{ points_accumulator };
+        HidingKernelIO hiding_output{ points_accumulator, T_prev_commitments };
         hiding_output.set_public();
     } else {
         KernelIO kernel_output;
@@ -437,7 +444,7 @@ std::shared_ptr<ClientIVC::DeciderZKProvingKey> ClientIVC::construct_hiding_circ
         complete_hiding_circuit_logic(stdlib_proof, stdlib_vk_and_hash, builder);
     fold_output.accumulator = nullptr;
 
-    HidingKernelIO hiding_output{ pairing_points };
+    HidingKernelIO hiding_output{ pairing_points, merged_table_commitments };
     hiding_output.set_public();
 
     auto decider_pk = std::make_shared<DeciderZKProvingKey>(builder, TraceSettings(), bn254_commitment_key);
@@ -487,7 +494,7 @@ bool ClientIVC::verify(const Proof& proof, const VerificationKey& vk)
     std::shared_ptr<Goblin::Transcript> civc_verifier_transcript = std::make_shared<Goblin::Transcript>();
     // Verify the hiding circuit proof
     MegaZKVerifier verifier{ vk.mega, /*ipa_verification_key=*/{}, civc_verifier_transcript };
-    auto [mega_verified, _] = verifier.verify_proof(proof.mega_proof);
+    auto [mega_verified, T_prev_commitments] = verifier.verify_proof(proof.mega_proof);
     vinfo("Mega verified: ", mega_verified);
 
     // Extract the commitments to the subtable corresponding to the incoming circuit

barretenberg/cpp/src/barretenberg/client_ivc/client_ivc.hpp

@@ -75,7 +75,7 @@ class ClientIVC {
     using PairingPoints = stdlib::recursion::PairingPoints<ClientCircuit>;
     using PublicPairingPoints = stdlib::PublicInputComponent<PairingPoints>;
     using KernelIO = bb::stdlib::recursion::honk::KernelIO;
-    using HidingKernelIO = bb::stdlib::recursion::honk::HidingKernelIO;
+    using HidingKernelIO = bb::stdlib::recursion::honk::HidingKernelIO<ClientCircuit>;
     using AppIO = bb::stdlib::recursion::honk::AppIO;
     using StdlibProof = stdlib::Proof<ClientCircuit>;
     using StdlibFF = RecursiveFlavor::FF;

barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.cpp

@@ -271,7 +271,7 @@ void build_constraints(Builder& builder, AcirProgram& program, const ProgramMeta
         // If its an app circuit that has no recursion constraints, add default pairing points to public inputs.
         if (constraint_system.honk_recursion_constraints.empty() &&
             constraint_system.ivc_recursion_constraints.empty()) {
-            PairingPoints::add_default_to_public_inputs(builder);
+            stdlib::recursion::honk::AppIO::add_default(builder);
         }
     } else {
         HonkRecursionConstraintsOutput<Builder> honk_output =

barretenberg/cpp/src/barretenberg/dsl/acir_format/honk_recursion_constraint.cpp

@@ -18,6 +18,7 @@
 #include "barretenberg/stdlib/primitives/circuit_builders/circuit_builders_fwd.hpp"
 #include "barretenberg/stdlib/primitives/curves/bn254.hpp"
 #include "barretenberg/stdlib/proof/proof.hpp"
+#include "barretenberg/stdlib/special_public_inputs/special_public_inputs.hpp"
 #include "proof_surgeon.hpp"
 #include "recursion_constraint.hpp"
 
@@ -215,7 +216,7 @@ void create_dummy_vkey_and_proof(typename Flavor::CircuitBuilder& builder,
 template <typename Flavor>
 HonkRecursionConstraintOutput<typename Flavor::CircuitBuilder> create_honk_recursion_constraints(
     typename Flavor::CircuitBuilder& builder, const RecursionConstraint& input, bool has_valid_witness_assignments)
-    requires IsRecursiveFlavor<Flavor>
+    requires(IsRecursiveFlavor<Flavor> && IsUltraHonk<typename Flavor::NativeFlavor>)
 {
     using Builder = typename Flavor::CircuitBuilder;
     using RecursiveVerificationKey = Flavor::VerificationKey;
@@ -253,13 +254,14 @@ HonkRecursionConstraintOutput<typename Flavor::CircuitBuilder> create_honk_recur
     if (!has_valid_witness_assignments) {
         // In the constraint, the agg object public inputs are still contained in the proof. To get the 'raw' size of
         // the proof and public_inputs we subtract and add the corresponding amount from the respective sizes.
-        size_t size_of_proof_with_no_pub_inputs = input.proof.size() - bb::PAIRING_POINTS_SIZE;
-        if constexpr (HasIPAAccumulator<Flavor>) {
-            size_of_proof_with_no_pub_inputs -= bb::IPA_CLAIM_SIZE;
-        }
-        size_t total_num_public_inputs = input.public_inputs.size() + bb::PAIRING_POINTS_SIZE;
+        size_t size_of_proof_with_no_pub_inputs = input.proof.size();
+        size_t total_num_public_inputs = input.public_inputs.size();
         if constexpr (HasIPAAccumulator<Flavor>) {
-            total_num_public_inputs += bb::IPA_CLAIM_SIZE;
+            size_of_proof_with_no_pub_inputs -= RollupIO::PUBLIC_INPUTS_SIZE;
+            total_num_public_inputs += RollupIO::PUBLIC_INPUTS_SIZE;
+        } else {
+            size_of_proof_with_no_pub_inputs -= DefaultIO<Builder>::PUBLIC_INPUTS_SIZE;
+            total_num_public_inputs += DefaultIO<Builder>::PUBLIC_INPUTS_SIZE;
         }
 
         create_dummy_vkey_and_proof<Flavor>(

barretenberg/cpp/src/barretenberg/dsl/acir_format/honk_recursion_constraint.hpp

@@ -27,6 +27,6 @@ template <typename Flavor>
 create_honk_recursion_constraints(typename Flavor::CircuitBuilder& builder,
                                   const RecursionConstraint& input,
                                   bool has_valid_witness_assignments = false)
-    requires IsRecursiveFlavor<Flavor>;
+    requires(IsRecursiveFlavor<Flavor> && IsUltraHonk<typename Flavor::NativeFlavor>);
 
 } // namespace acir_format

barretenberg/cpp/src/barretenberg/dsl/acir_format/honk_recursion_constraint.test.cpp

@@ -1,6 +1,7 @@
 #include "honk_recursion_constraint.hpp"
 #include "acir_format.hpp"
 #include "acir_format_mocks.hpp"
+#include "barretenberg/special_public_inputs/special_public_inputs.hpp"
 #include "barretenberg/ultra_honk/decider_proving_key.hpp"
 #include "barretenberg/ultra_honk/ultra_prover.hpp"
 #include "barretenberg/ultra_honk/ultra_verifier.hpp"
@@ -173,14 +174,19 @@ template <typename RecursiveFlavor> class AcirHonkRecursionConstraint : public :
             std::vector<bb::fr> key_witnesses = verification_key->to_field_elements();
             fr key_hash_witness = verification_key->hash();
             std::vector<fr> proof_witnesses = inner_proof;
-            size_t num_public_inputs_to_extract = inner_circuit.num_public_inputs() - bb::PAIRING_POINTS_SIZE;
-            acir_format::PROOF_TYPE proof_type = acir_format::HONK;
-            if constexpr (HasIPAAccumulator<InnerFlavor>) {
-                num_public_inputs_to_extract -= IPA_CLAIM_SIZE;
-                proof_type = ROLLUP_HONK;
-            } else if constexpr (InnerFlavor::HasZK) {
-                proof_type = HONK_ZK;
-            }
+
+            // Compute the number of public inputs to extract (the ones from the circuit) and the proof type based on
+            // the Flavor
+            auto [num_public_inputs_to_extract, proof_type] = [&]() -> std::pair<size_t, acir_format::PROOF_TYPE> {
+                size_t num_public_inputs_to_extract = inner_circuit.num_public_inputs();
+                if constexpr (HasIPAAccumulator<InnerFlavor>) {
+                    return { num_public_inputs_to_extract - RollupIO::PUBLIC_INPUTS_SIZE, ROLLUP_HONK };
+                } else if constexpr (InnerFlavor::HasZK) {
+                    return { num_public_inputs_to_extract - DefaultIO::PUBLIC_INPUTS_SIZE, HONK_ZK };
+                } else {
+                    return { num_public_inputs_to_extract - DefaultIO::PUBLIC_INPUTS_SIZE, HONK };
+                }
+            }();
 
             auto [key_indices, key_hash_index, proof_indices, inner_public_inputs] =
                 ProofSurgeon::populate_recursion_witness_data(
@@ -216,14 +222,27 @@ template <typename RecursiveFlavor> class AcirHonkRecursionConstraint : public :
         AcirProgram program{ constraint_system, witness };
         BuilderType outer_circuit = create_circuit<BuilderType>(program, metadata);
 
+        // If BuilderType = Mega, then the proof of outer_circuit will be a Mega proof, and thus will be verified with
+        // a MegaVerifier = UltraVerifier<MegaFlavor>. By design, the MegaVerifier expects the public inputs to be the
+        // ones of the HidingKernel, so we mock the missing part: ecc_op_tables
+        if constexpr (IsMegaBuilder<BuilderType>) {
+            for (auto& commitment :
+                 stdlib::recursion::honk::HidingKernelIO<BuilderType>::default_ecc_op_tables(outer_circuit)) {
+                commitment.set_public();
+            }
+        }
+
         return outer_circuit;
     }
 
     bool verify_proof(const std::shared_ptr<OuterDeciderProvingKey>& proving_key,
                       const std::shared_ptr<OuterVerificationKey>& verification_key,
                       const HonkProof& proof)
     {
-        if constexpr (IsUltraHonk<OuterFlavor>) {
+        if constexpr (IsMegaFlavor<OuterFlavor>) {
+            OuterVerifier verifier(verification_key);
+            return std::get<0>(verifier.verify_proof(proof));
+        } else {
             if constexpr (HasIPAAccumulator<RecursiveFlavor>) {
                 VerifierCommitmentKey<curve::Grumpkin> ipa_verification_key(1 << CONST_ECCVM_LOG_N);
                 OuterVerifier verifier(verification_key, ipa_verification_key);
@@ -232,9 +251,6 @@ template <typename RecursiveFlavor> class AcirHonkRecursionConstraint : public :
                 OuterVerifier verifier(verification_key);
                 return verifier.verify_proof(proof);
             }
-        } else {
-            OuterVerifier verifier(verification_key);
-            return std::get<0>(verifier.verify_proof(proof));
         }
     }
 

barretenberg/cpp/src/barretenberg/ecc/curves/bn254/fq.hpp

@@ -16,6 +16,8 @@
 // NOLINTBEGIN(cppcoreguidelines-avoid-c-arrays)
 namespace bb {
 
+// TODO(https://github.com/AztecProtocol/barretenberg/issues/1478): Can we define this constant as part of the
+// parameters and make it avaiable via the interface of field<T>?
 // A point in Fq is represented with 4 public inputs
 static constexpr size_t FQ_PUBLIC_INPUT_SIZE = 4;
 

barretenberg/cpp/src/barretenberg/goblin/mock_circuits.hpp

@@ -19,6 +19,7 @@
 #include "barretenberg/stdlib/honk_verifier/ultra_recursive_verifier.hpp"
 #include "barretenberg/stdlib/primitives/curves/secp256k1.hpp"
 #include "barretenberg/stdlib/protogalaxy_verifier/protogalaxy_recursive_verifier.hpp"
+#include "barretenberg/stdlib/special_public_inputs/special_public_inputs.hpp"
 #include "barretenberg/stdlib_circuit_builders/mock_circuits.hpp"
 
 namespace bb {
@@ -69,7 +70,6 @@ class GoblinMockCircuits {
     using RecursiveVerifierAccumulator = std::shared_ptr<RecursiveDeciderVerificationKey>;
     using VerificationKey = Flavor::VerificationKey;
 
-    using PairingPoints = stdlib::recursion::PairingPoints<MegaBuilder>;
     static constexpr size_t NUM_WIRES = Flavor::NUM_WIRES;
 
     struct KernelInput {
@@ -104,7 +104,7 @@ class GoblinMockCircuits {
         // MegaHonk circuits (where we don't explicitly need to add goblin ops), in IVC merge proving happens prior to
         // folding where the absense of goblin ecc ops will result in zero commitments.
         MockCircuits::construct_goblin_ecc_op_circuit(builder);
-        PairingPoints::add_default_to_public_inputs(builder);
+        bb::stdlib::recursion::honk::AppIO::add_default(builder);
     }
 
     /**
@@ -142,7 +142,9 @@ class GoblinMockCircuits {
 
         add_some_ecc_op_gates(builder);
         MockCircuits::construct_arithmetic_circuit(builder);
-        PairingPoints::add_default_to_public_inputs(builder);
+        // Flavor = bb::MegaFlavor, so the public inputs should be that of the HidingKernelIO (UltraVerifier<MegaFlavor>
+        // expects the public inputs to be that of the HidingKernel)
+        bb::stdlib::recursion::honk::HidingKernelIO<MegaBuilder>::add_default(builder);
     }
 
     /**

barretenberg/cpp/src/barretenberg/goblin/mock_circuits_pinning.test.cpp

@@ -42,7 +42,7 @@ TEST_F(MegaMockCircuitsPinning, SmallTestStructuredCircuitSize)
 {
     Goblin goblin;
     MegaCircuitBuilder app_circuit{ goblin.op_queue };
-    GoblinMockCircuits::PairingPoints::add_default_to_public_inputs(app_circuit);
+    stdlib::recursion::honk::DefaultIO<MegaCircuitBuilder>::add_default(app_circuit);
     TraceSettings trace_settings{ SMALL_TEST_STRUCTURE };
     auto proving_key = std::make_shared<DeciderProvingKey>(app_circuit, trace_settings);
     EXPECT_EQ(proving_key->log_dyadic_size(), 18);
@@ -52,7 +52,7 @@ TEST_F(MegaMockCircuitsPinning, AztecStructuredCircuitSize)
 {
     Goblin goblin;
     MegaCircuitBuilder app_circuit{ goblin.op_queue };
-    GoblinMockCircuits::PairingPoints::add_default_to_public_inputs(app_circuit);
+    stdlib::recursion::honk::DefaultIO<MegaCircuitBuilder>::add_default(app_circuit);
     TraceSettings trace_settings{ AZTEC_TRACE_STRUCTURE };
     auto proving_key = std::make_shared<DeciderProvingKey>(app_circuit, trace_settings);
     EXPECT_EQ(proving_key->log_dyadic_size(), 18);

barretenberg/cpp/src/barretenberg/honk/execution_trace/mega_execution_trace.hpp

@@ -255,7 +255,7 @@ class MegaExecutionTraceBlocks : public MegaTraceBlockData<MegaTraceBlock> {
 static constexpr TraceStructure TINY_TEST_STRUCTURE{ .ecc_op = 18,
                                                      .busread = 3,
                                                      .lookup = 2,
-                                                     .pub_inputs = 20,
+                                                     .pub_inputs = 52, // Accomodate 4 + HidingKernelIO = 4 + 48
                                                      .arithmetic = 1 << 14,
                                                      .delta_range = 5,
                                                      .elliptic = 2,

barretenberg/cpp/src/barretenberg/special_public_inputs/special_public_inputs.hpp

@@ -41,6 +41,50 @@ class DefaultIO {
     }
 };
 
+/**
+ * @brief Manages the data that is propagated on the public inputs of of a hiding kernel circuit
+ */
+class HidingKernelIO {
+  public:
+    using FF = curve::BN254::ScalarField;
+    using G1 = curve::BN254::AffineElement;
+
+    // Number of columns that jointly constitute the op_queue, should be the same as the number of wires in the
+    // MegaCircuitBuilder
+    static constexpr size_t NUM_WIRES = 4;
+
+    // Number of bb::fr field elements used to represent a goblin element in the public inputs
+    // The element is of goblin type because the HidingKernel is always employed with a MegaBuilder
+    static constexpr size_t G1_PUBLIC_INPUTS_SIZE = FQ_PUBLIC_INPUT_SIZE * 2;
+    static constexpr size_t PUBLIC_INPUTS_SIZE = NUM_WIRES * G1_PUBLIC_INPUTS_SIZE + PAIRING_POINTS_SIZE;
+
+    PairingPoints pairing_inputs;
+    std::array<G1, NUM_WIRES> ecc_op_tables;
+
+    /**
+     * @brief Reconstructs the IO components from a public inputs array.
+     *
+     * @param public_inputs Public inputs array containing the serialized kernel public inputs.
+     */
+    void reconstruct_from_public(const std::vector<FF>& public_inputs)
+    {
+        // Assumes that the hiding-kernel-io public inputs are at the end of the public_inputs vector
+        uint32_t index = static_cast<uint32_t>(public_inputs.size() - PUBLIC_INPUTS_SIZE);
+
+        const std::span<const FF, PAIRING_POINTS_SIZE> pairing_inputs_limbs(public_inputs.data() + index,
+                                                                            PAIRING_POINTS_SIZE);
+        index += PAIRING_POINTS_SIZE;
+        pairing_inputs = PairingPoints::reconstruct_from_public(pairing_inputs_limbs);
+
+        for (auto& commitment : ecc_op_tables) {
+            const std::span<const FF, G1_PUBLIC_INPUTS_SIZE> ecc_op_table_limbs(public_inputs.data() + index,
+                                                                                G1_PUBLIC_INPUTS_SIZE);
+            commitment = G1::reconstruct_from_public(ecc_op_table_limbs);
+            index += G1_PUBLIC_INPUTS_SIZE;
+        }
+    }
+};
+
 /**
  * @brief The data that is propagated on the public inputs of a rollup circuit
  */

barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/ultra_recursive_verifier.cpp

@@ -90,10 +90,10 @@ UltraRecursiveVerifier_<Flavor>::Output UltraRecursiveVerifier_<Flavor>::verify_
         output.points_accumulator = inputs.pairing_inputs;
         output.ipa_claim = inputs.ipa_claim;
     } else if constexpr (IsMegaFlavor<Flavor>) {
-        DefaultIO<Builder> inputs; // will be HidingKernelIO
+        HidingKernelIO<Builder> inputs;
         inputs.reconstruct_from_public(public_inputs);
         output.points_accumulator = inputs.pairing_inputs;
-        // output.ecc_op_tables = inputs.ecc_op_tables;
+        output.ecc_op_tables = inputs.ecc_op_tables;
     } else {
         DefaultIO<Builder> inputs; // pairing points
         inputs.reconstruct_from_public(public_inputs);