folding goblin ultra instances

barretenberg/cpp/src/barretenberg/flavor/goblin_ultra_recursive.hpp

@@ -46,7 +46,8 @@ template <typename BuilderType> class GoblinUltraRecursive_ {
     using FF = typename Curve::ScalarField;
     using Commitment = typename Curve::Element;
     using CommitmentHandle = typename Curve::Element;
-    using NativeVerificationKey = flavor::GoblinUltra::VerificationKey;
+    using NativeFlavor = flavor::GoblinUltra;
+    using NativeVerificationKey = NativeFlavor::VerificationKey;
 
     // Note(luke): Eventually this may not be needed at all
     using VerifierCommitmentKey = pcs::VerifierCommitmentKey<Curve>;

barretenberg/cpp/src/barretenberg/flavor/ultra_recursive.hpp

@@ -54,7 +54,8 @@ template <typename BuilderType> class UltraRecursive_ {
     using Commitment = typename Curve::Element;
     using CommitmentHandle = typename Curve::Element;
     using FF = typename Curve::ScalarField;
-    using NativeVerificationKey = flavor::Ultra::VerificationKey;
+    using NativeFlavor = flavor::Ultra;
+    using NativeVerificationKey = NativeFlavor::VerificationKey;
 
     // Note(luke): Eventually this may not be needed at all
     using VerifierCommitmentKey = pcs::VerifierCommitmentKey<Curve>;
@@ -416,6 +417,44 @@ template <typename BuilderType> class UltraRecursive_ {
                 this->z_lookup = commitments.z_lookup;
             }
         }
+
+        VerifierCommitments(const std::shared_ptr<VerificationKey>& verification_key,
+                            const WitnessCommitments& witness_commitments)
+        {
+            this->q_m = verification_key->q_m;
+            this->q_l = verification_key->q_l;
+            this->q_r = verification_key->q_r;
+            this->q_o = verification_key->q_o;
+            this->q_4 = verification_key->q_4;
+            this->q_c = verification_key->q_c;
+            this->q_arith = verification_key->q_arith;
+            this->q_sort = verification_key->q_sort;
+            this->q_elliptic = verification_key->q_elliptic;
+            this->q_aux = verification_key->q_aux;
+            this->q_lookup = verification_key->q_lookup;
+            this->sigma_1 = verification_key->sigma_1;
+            this->sigma_2 = verification_key->sigma_2;
+            this->sigma_3 = verification_key->sigma_3;
+            this->sigma_4 = verification_key->sigma_4;
+            this->id_1 = verification_key->id_1;
+            this->id_2 = verification_key->id_2;
+            this->id_3 = verification_key->id_3;
+            this->id_4 = verification_key->id_4;
+            this->table_1 = verification_key->table_1;
+            this->table_2 = verification_key->table_2;
+            this->table_3 = verification_key->table_3;
+            this->table_4 = verification_key->table_4;
+            this->lagrange_first = verification_key->lagrange_first;
+            this->lagrange_last = verification_key->lagrange_last;
+
+            this->w_l = witness_commitments.w_l;
+            this->w_r = witness_commitments.w_r;
+            this->w_o = witness_commitments.w_o;
+            this->sorted_accum = witness_commitments.sorted_accum;
+            this->w_4 = witness_commitments.w_4;
+            this->z_perm = witness_commitments.z_perm;
+            this->z_lookup = witness_commitments.z_lookup;
+        }
     };
 
     using Transcript = bb::stdlib::recursion::honk::Transcript<CircuitBuilder>;

barretenberg/cpp/src/barretenberg/protogalaxy/decider_verifier.cpp

@@ -103,7 +103,6 @@ template <typename Flavor> bool DeciderVerifier_<Flavor>::verify_proof(const hon
                                             transcript);
 
     auto verified = pcs_verification_key->pairing_check(pairing_points[0], pairing_points[1]);
-
     return sumcheck_verified.value() && verified;
 }
 

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_prover.cpp

@@ -34,6 +34,27 @@ void ProtoGalaxyProver_<ProverInstances>::finalise_and_send_instance(std::shared
         transcript->send_to_verifier(domain_separator + "_" + wire_labels[idx], wire_comms[idx]);
     }
 
+    if constexpr (IsGoblinFlavor<Flavor>) {
+        // Commit to Goblin ECC op wires
+        witness_commitments.ecc_op_wire_1 = commitment_key->commit(instance->proving_key->ecc_op_wire_1);
+        witness_commitments.ecc_op_wire_2 = commitment_key->commit(instance->proving_key->ecc_op_wire_2);
+        witness_commitments.ecc_op_wire_3 = commitment_key->commit(instance->proving_key->ecc_op_wire_3);
+        witness_commitments.ecc_op_wire_4 = commitment_key->commit(instance->proving_key->ecc_op_wire_4);
+
+        auto op_wire_comms = instance->witness_commitments.get_ecc_op_wires();
+        auto labels = commitment_labels.get_ecc_op_wires();
+        for (size_t idx = 0; idx < Flavor::NUM_WIRES; ++idx) {
+            transcript->send_to_verifier(domain_separator + "_" + labels[idx], op_wire_comms[idx]);
+        }
+        // Commit to DataBus columns
+        witness_commitments.calldata = commitment_key->commit(instance->proving_key->calldata);
+        witness_commitments.calldata_read_counts = commitment_key->commit(instance->proving_key->calldata_read_counts);
+        transcript->send_to_verifier(domain_separator + "_" + commitment_labels.calldata,
+                                     instance->witness_commitments.calldata);
+        transcript->send_to_verifier(domain_separator + "_" + commitment_labels.calldata_read_counts,
+                                     instance->witness_commitments.calldata_read_counts);
+    }
+
     auto eta = transcript->get_challenge(domain_separator + "_eta");
     instance->compute_sorted_accumulator_polynomials(eta);
 
@@ -47,6 +68,16 @@ void ProtoGalaxyProver_<ProverInstances>::finalise_and_send_instance(std::shared
     transcript->send_to_verifier(domain_separator + "_" + commitment_labels.w_4, witness_commitments.w_4);
 
     auto [beta, gamma] = transcript->get_challenges(domain_separator + "_beta", domain_separator + "_gamma");
+
+    if constexpr (IsGoblinFlavor<Flavor>) {
+        // Compute and commit to the logderivative inverse used in DataBus
+        instance->compute_logderivative_inverse(beta, gamma);
+        instance->witness_commitments.lookup_inverses =
+            commitment_key->commit(instance->prover_polynomials.lookup_inverses);
+        transcript->send_to_verifier(domain_separator + "_" + commitment_labels.lookup_inverses,
+                                     instance->witness_commitments.lookup_inverses);
+    }
+
     instance->compute_grand_product_polynomials(beta, gamma);
 
     witness_commitments.z_perm = commitment_key->commit(instance->prover_polynomials.z_perm);
@@ -150,6 +181,8 @@ std::shared_ptr<typename ProverInstances::Instance> ProtoGalaxyProver_<ProverIns
     FF& challenge,
     const FF& compressed_perturbator)
 {
+    static_cast<void>(challenge);
+
     auto combiner_quotient_at_challenge = combiner_quotient.evaluate(challenge);
 
     // Given the challenge \gamma, compute Z(\gamma) and {L_0(\gamma),L_1(\gamma)}
@@ -274,22 +307,20 @@ FoldingResult<typename ProverInstances::Flavor> ProtoGalaxyProver_<ProverInstanc
 {
     prepare_for_folding();
     FF delta = transcript->get_challenge("delta");
-
     auto accumulator = get_accumulator();
     auto deltas = compute_round_challenge_pows(accumulator->log_instance_size, delta);
-
     auto perturbator = compute_perturbator(accumulator, deltas);
     for (size_t idx = 0; idx <= accumulator->log_instance_size; idx++) {
         transcript->send_to_verifier("perturbator_" + std::to_string(idx), perturbator[idx]);
     }
+
     auto perturbator_challenge = transcript->get_challenge("perturbator_challenge");
     instances.next_gate_challenges =
         update_gate_challenges(perturbator_challenge, accumulator->gate_challenges, deltas);
     combine_relation_parameters(instances);
     combine_alpha(instances);
     auto pow_polynomial = PowPolynomial<FF>(instances.next_gate_challenges);
     auto combiner = compute_combiner(instances, pow_polynomial);
-
     auto compressed_perturbator = perturbator.evaluate(perturbator_challenge);
     auto combiner_quotient = compute_combiner_quotient(compressed_perturbator, combiner);
 
@@ -303,7 +334,6 @@ FoldingResult<typename ProverInstances::Flavor> ProtoGalaxyProver_<ProverInstanc
         compute_next_accumulator(instances, combiner_quotient, combiner_challenge, compressed_perturbator);
     res.folding_data = transcript->proof_data;
     res.accumulator = next_accumulator;
-
     return res;
 }
 

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_prover.hpp

@@ -127,16 +127,23 @@ template <class ProverInstances_> class ProtoGalaxyProver_ {
     std::shared_ptr<Instance> get_accumulator() { return instances[0]; }
 
     /**
-     * @brief Compute the values of the full Honk relation at each row in the execution trace, f_i(ω) in the
-     * ProtoGalaxy paper, given the evaluations of all the prover polynomials and α (the parameter that helps establish
-     * each subrelation is independently valid in Honk - from the Plonk paper, DO NOT confuse with α in ProtoGalaxy),
+     * @brief Compute the values of the full Honk relation at each row in the execution trace, representing f_i(ω) in
+     * the ProtoGalaxy paper, given the evaluations of all the prover polynomials and \vec{α} (the batching challenges
+     * that help establishing each subrelation is independently valid in Honk - from the Plonk paper, DO NOT confuse
+     * with α in ProtoGalaxy).
+     *
+     * @details When folding GoblinUltra instances, one of the relations is linearly dependent. We define such relations
+     * as acting on the entire execution trace and hence requiring to be accumulated separately as we iterate over each
+     * row. At the end of the function, the linearly dependent contribution is accumulated at index 0 representing the
+     * sum f_0(ω) + α_j*g(ω) where f_0 represents the full honk evaluation at row 0, g(ω) is the linearly dependent
+     * subrelation and α_j is its corresponding batching challenge.
      */
     static std::vector<FF> compute_full_honk_evaluations(const ProverPolynomials& instance_polynomials,
                                                          const RelationSeparator& alpha,
                                                          const RelationParameters<FF>& relation_parameters)
     {
         auto instance_size = instance_polynomials.get_polynomial_size();
-
+        FF linearly_dependent_contribution = FF(0);
         std::vector<FF> full_honk_evaluations(instance_size);
         for (size_t row = 0; row < instance_size; row++) {
             auto row_evaluations = instance_polynomials.get_row(row);
@@ -150,16 +157,21 @@ template <class ProverInstances_> class ProtoGalaxyProver_ {
 
             auto output = FF(0);
             auto running_challenge = FF(1);
-            Utils::scale_and_batch_elements(relation_evaluations, alpha, running_challenge, output);
+
+            // Sum relation evaluations, batched by their corresponding relation separator challenge, to get the value
+            // of the full honk relation at a specific row
+            Utils::scale_and_batch_elements_without_linear_contributions(
+                relation_evaluations, alpha, running_challenge, output, linearly_dependent_contribution);
 
             full_honk_evaluations[row] = output;
         }
+        full_honk_evaluations[0] += linearly_dependent_contribution;
         return full_honk_evaluations;
     }
 
     /**
      * @brief  Recursively compute the parent nodes of each level in there, starting from the leaves. Note that at each
-     * level, the resulting parent nodes will be polynomials of degree (level + 1) because we multiply by an additional
+     * level, the resulting parent nodes will be polynomials of degree (level+1) because we multiply by an additional.
      * factor of X.
      */
     static std::vector<FF> construct_coefficients_tree(const std::vector<FF>& betas,
@@ -308,6 +320,7 @@ template <class ProverInstances_> class ProtoGalaxyProver_ {
 
                 // Accumulate the i-th row's univariate contribution. Note that the relation parameters passed to this
                 // function have already been folded
+                // This will not add pow stuff to relation dependent stuff
                 accumulate_relation_univariates(
                     thread_univariate_accumulators[thread_idx],
                     extended_univariates[thread_idx],
@@ -323,6 +336,7 @@ template <class ProverInstances_> class ProtoGalaxyProver_ {
         // Batch the univariate contributions from each sub-relation to obtain the round univariate
         return batch_over_relations(univariate_accumulators, instances.alphas);
     }
+
     static ExtendedUnivariateWithRandomization batch_over_relations(TupleOfTuplesOfUnivariates& univariate_accumulators,
                                                                     const CombinedRelationSeparator& alpha)
     {
@@ -331,7 +345,7 @@ template <class ProverInstances_> class ProtoGalaxyProver_ {
         auto result = std::get<0>(std::get<0>(univariate_accumulators))
                           .template extend_to<ProverInstances::BATCHED_EXTENDED_LENGTH>();
         size_t idx = 0;
-        auto scale_and_sum = [&]<size_t outer_idx, size_t>(auto& element) {
+        auto scale_and_sum = [&]<size_t outer_idx, size_t inner_idx>(auto& element) {
             auto extended = element.template extend_to<ProverInstances::BATCHED_EXTENDED_LENGTH>();
             extended *= alpha[idx];
             result += extended;

barretenberg/cpp/src/barretenberg/protogalaxy/protogalaxy_verifier.cpp

@@ -87,6 +87,22 @@ void ProtoGalaxyVerifier_<VerifierInstances>::receive_and_finalise_instance(cons
     witness_commitments.w_r = transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.w_r);
     witness_commitments.w_o = transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.w_o);
 
+    if constexpr (IsGoblinFlavor<Flavor>) {
+        // Get  commitments to the ECC wire polynomials
+        witness_commitments.ecc_op_wire_1 =
+            transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.ecc_op_wire_1);
+        witness_commitments.ecc_op_wire_2 =
+            transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.ecc_op_wire_2);
+        witness_commitments.ecc_op_wire_3 =
+            transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.ecc_op_wire_3);
+        witness_commitments.ecc_op_wire_4 =
+            transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.ecc_op_wire_4);
+        witness_commitments.calldata =
+            transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.calldata);
+        witness_commitments.calldata_read_counts =
+            transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.calldata_read_counts);
+    }
+
     // Get challenge for sorted list batching and wire four memory records commitment
     auto eta = transcript->get_challenge(domain_separator + "_eta");
     witness_commitments.sorted_accum =
@@ -95,6 +111,13 @@ void ProtoGalaxyVerifier_<VerifierInstances>::receive_and_finalise_instance(cons
 
     // Get permutation challenges and commitment to permutation and lookup grand products
     auto [beta, gamma] = transcript->get_challenges(domain_separator + "_beta", domain_separator + "_gamma");
+
+    // If Goblin (i.e. using DataBus) receive commitments to log-deriv inverses polynomial
+    if constexpr (IsGoblinFlavor<Flavor>) {
+        witness_commitments.lookup_inverses = transcript->template receive_from_prover<Commitment>(
+            domain_separator + "_" + commitment_labels.lookup_inverses);
+    }
+
     witness_commitments.z_perm =
         transcript->template receive_from_prover<Commitment>(domain_separator + "_" + labels.z_perm);
     witness_commitments.z_lookup =