Quotient matrix

[gabriel-barrett]

Commit quotient slices as one matrix per circuit

Changes how the quotient polynomial is committed: instead of one matrix per
degree-n chunk on the split sub-cosets, each circuit's quotient is sliced by
coefficients — Q(X) = Σᵢ X^{i·n}·cᵢ(X), each cᵢ of degree < n — and
all q slices are committed as a single q·D-column matrix on the trace
domain, opened once at ζ.

Motivation

The opening phase's dominant costs are per-matrix and width-independent:
barycentric evaluation, the (p(x) − y)/(x − ζ) reduction that feeds FRI, and
per-query row extraction each walk the full LDE height once per matrix,
regardless of how many columns the matrix has. Under the old layout a circuit
contributed q quotient matrices, so raising the quotient degree multiplied
exactly the work these passes do. Profiling an Aiur-scale system (~500
circuits, quotient degree 4) showed the per-matrix passes were ~80% of
fri_open, scaling linearly with quotient matrix count — while the committed
area barely changed.

The same disease affected the commit side (one LDE/Merkle pipeline invocation
per tiny D-column chunk) and even the proof size: every matrix in a query's
batch opening carries its own length-prefixed vector, ~8 bytes × matrices ×
queries of pure framing.

The change

Prover (prove_multiple_claims): after the constraint sweep produces the
quotient's evaluations on the size-q·n coset, interpolate once (coset iDFT),
slice the coefficient vector into q degree-< n polynomials, and evaluate
the sliced n × q·D matrix back onto the trace domain (one size-n DFT).
The evaluation sweep itself — the expensive part — is untouched; the added
transform work is on q·D columns and is negligible. Requires a
TwoAdicField bound on the prover's Val, which every FRI-based
configuration satisfies.

Opening round: the quotient round now has exactly one entry per active
circuit (same shape as stages 1 and 2), instead of q chunk entries per
circuit.

Verifier: the sub-domain Lagrange recombination — the zps products of
vanishing polynomials over the split cosets — collapses to a power series:

Q(ζ) = Σᵢ ζ^{i·n} · cᵢ(ζ)

with each cᵢ(ζ) read from column-slices of the one wide matrix. This is
both cheaper natively and substantially simpler to port to a recursive
verifier. Shape checks change accordingly (one opened row of q·D values per
circuit at the single point ζ).

Soundness is unchanged: each slice is individually degree-bound < n by FRI
(same bound as before), the recombination identity is exact, and the layout
is bound into the transcript through the commitment.

Breaking changes

• Commitment layout, transcript, and proof shape change: proofs from earlier
  versions no longer verify. The quotient round of Proof::quotient_opened_values
  now carries one entry per active circuit (a q·D-value row at ζ).
• Downstream verifiers (including recursive ones) must switch the quotient
  recombination from the sub-domain zps formula to the ζ^{i·n} power
  series.

Testing

The full test suite passes on top of the change (lookup systems, sparse
activation, high-degree circuits, adversarial/tamper tests, serialization
round-trip), and it is exercised end to end downstream by the Ix/Aiur proving
suites (70 prove/verify cases plus BLAKE3/SHA-256 circuits and IxVM kernel
checks).

[gabriel-barrett]

!benchmark