chore(refactor): separate openvm-continuations from SDK (#1447)

A refactor to split the security critical recursion programs necessary
for the continuations framework outside of the SDK. The recursion
programs are now in a separate `openvm-continuations` crate.

I wanted to keep keygen together with the recursion programs, but that
was too difficult to separate because the proving key types are very
tied to the SDK, and also the requirement of a dummy proof ties keygen
to some prover implementation. This is not ideal and could be reworked
with more refactoring, which is out of scope for now.

No major logic was changed. Most files changed are import changes.
- The `static_verifier` module was split between `sdk/keygen` and
`continuations/verifier`, with some minor changes to remove dependence
on proving key in the verifier (which is weird for a verifier anyways).
- `ContinuationVmProof` is moved into `openvm-circuit` crate to remove a
dependency issue and also because it is core to the framework.

Author: jonathanpwang

.github/workflows/recursion.yml

@@ -41,3 +41,8 @@ jobs:
         working-directory: extensions/native/recursion
         run: |
           cargo nextest run --features parallel,static-verifier
+
+      - name: Run continuations verifier crate tests
+        working-directory: crates/continuations
+        run: |
+          cargo nextest run --no-tests=pass

Cargo.lock

@@ -25,6 +25,7 @@ members = [
     "crates/toolchain/macros",
     "crates/toolchain/platform",
     "crates/toolchain/tests",
+    "crates/continuations",
     "crates/vm",
     "extensions/rv32im/circuit",
     "extensions/rv32im/transpiler",
@@ -122,10 +123,11 @@ openvm-instructions-derive = { path = "crates/toolchain/instructions/derive", de
 openvm-macros-common = { path = "crates/toolchain/macros", default-features = false }
 openvm-platform = { path = "crates/toolchain/platform", default-features = false }
 openvm-transpiler = { path = "crates/toolchain/transpiler", default-features = false }
-openvm-circuit = { path = "crates/vm", default-features = false }
-openvm-circuit-derive = { path = "crates/vm/derive", default-features = false }
 openvm-toolchain-tests = { path = "crates/toolchain/tests", default-features = false }
 openvm-custom-insn = { path = "crates/toolchain/custom_insn", default-features = false }
+openvm-circuit = { path = "crates/vm", default-features = false }
+openvm-circuit-derive = { path = "crates/vm/derive", default-features = false }
+openvm-continuations = { path = "crates/continuations", default-features = false }
 
 # Extensions
 openvm-rv32im-circuit = { path = "extensions/rv32im/circuit", default-features = false }

Cargo.toml

@@ -10,7 +10,7 @@ use openvm_rv32im_transpiler::{
     Rv32ITranspilerExtension, Rv32IoTranspilerExtension, Rv32MTranspilerExtension,
 };
 use openvm_sdk::{
-    commit::commit_app_exe, keygen::RootVerifierProvingKey, prover::ContinuationProver, Sdk, StdIn,
+    commit::commit_app_exe, prover::ContinuationProver, DefaultStaticVerifierPvHandler, Sdk, StdIn,
 };
 use openvm_stark_sdk::bench::run_with_metric_collection;
 use openvm_transpiler::{transpiler::Transpiler, FromElf};
@@ -40,7 +40,7 @@ async fn main() -> Result<()> {
     let full_agg_pk = sdk.agg_keygen(
         agg_config,
         &halo2_params_reader,
-        None::<&RootVerifierProvingKey>,
+        &DefaultStaticVerifierPvHandler,
     )?;
     let elf = args.build_bench_program("fibonacci")?;
     let exe = VmExe::from_elf(

benchmarks/src/bin/fib_e2e.rs

@@ -11,8 +11,7 @@ use openvm_native_recursion::halo2::utils::CacheHalo2ParamsReader;
 use openvm_sdk::{
     config::AggConfig,
     fs::{write_agg_pk_to_file, write_evm_verifier_to_file},
-    keygen::RootVerifierProvingKey,
-    Sdk,
+    DefaultStaticVerifierPvHandler, Sdk,
 };
 
 use crate::default::{DEFAULT_AGG_PK_PATH, DEFAULT_PARAMS_DIR, DEFAULT_VERIFIER_PATH};
@@ -42,7 +41,7 @@ impl EvmProvingSetupCmd {
         let agg_config = AggConfig::default();
 
         println!("Generating proving key...");
-        let agg_pk = Sdk.agg_keygen(agg_config, &params_reader, None::<&RootVerifierProvingKey>)?;
+        let agg_pk = Sdk.agg_keygen(agg_config, &params_reader, &DefaultStaticVerifierPvHandler)?;
 
         println!("Generating verifier contract...");
         let verifier = Sdk.generate_snark_verifier_contract(&params_reader, &agg_pk)?;

crates/cli/src/commands/setup.rs

@@ -0,0 +1,25 @@
+[package]
+name = "openvm-continuations"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+repository.workspace = true
+license.workspace = true
+
+[dependencies]
+openvm-native-circuit = { workspace = true }
+openvm-native-compiler = { workspace = true }
+openvm-native-recursion = { workspace = true, features = ["static-verifier"] }
+openvm-stark-backend = { workspace = true }
+openvm-stark-sdk = { workspace = true }
+openvm-circuit = { workspace = true }
+
+derivative = { workspace = true }
+serde = { workspace = true }
+static_assertions.workspace = true
+
+[features]
+default = ["parallel"]
+parallel = ["openvm-circuit/parallel"]
+test-utils = ["openvm-circuit/test-utils"]

crates/continuations/Cargo.toml

@@ -0,0 +1,16 @@
+use openvm_native_recursion::types::InnerConfig;
+use openvm_stark_sdk::{
+    config::{
+        baby_bear_poseidon2::BabyBearPoseidon2Config,
+        baby_bear_poseidon2_root::BabyBearPoseidon2RootConfig,
+    },
+    p3_baby_bear::BabyBear,
+};
+
+pub mod static_verifier;
+pub mod verifier;
+
+pub type SC = BabyBearPoseidon2Config;
+pub type C = InnerConfig;
+pub type F = BabyBear;
+pub type RootSC = BabyBearPoseidon2RootConfig;

crates/continuations/src/lib.rs

@@ -0,0 +1,135 @@
+use openvm_circuit::arch::PROGRAM_CACHED_TRACE_INDEX;
+use openvm_native_compiler::prelude::*;
+use openvm_native_recursion::{
+    challenger::multi_field32::MultiField32ChallengerVariable,
+    config::outer::{new_from_outer_multi_vk, OuterConfig},
+    digest::DigestVariable,
+    fri::TwoAdicFriPcsVariable,
+    halo2::DslOperations,
+    stark::StarkVerifier,
+    utils::const_fri_config,
+    vars::StarkProofVariable,
+    witness::Witnessable,
+};
+use openvm_stark_backend::keygen::types::MultiStarkVerifyingKey;
+use openvm_stark_sdk::{
+    config::FriParameters, openvm_stark_backend::proof::Proof, p3_bn254_fr::Bn254Fr,
+};
+
+use crate::{
+    verifier::{
+        common::{
+            assert_single_segment_vm_exit_successfully_with_connector_air_id, types::SpecialAirIds,
+        },
+        root::types::RootVmVerifierPvs,
+        utils::compress_babybear_var_to_bn254,
+    },
+    RootSC,
+};
+/// Custom public values handler for static verifier.
+/// This trait implementation defines what the public values of the
+/// final EVM proof will be.
+pub trait StaticVerifierPvHandler {
+    /// Returns the number of public values, as [Bn254Fr] field elements.
+    fn handle_public_values(
+        &self,
+        builder: &mut Builder<OuterConfig>,
+        input: &StarkProofVariable<OuterConfig>,
+        special_air_ids: &SpecialAirIds,
+    ) -> usize;
+}
+
+pub struct DefaultStaticVerifierPvHandler;
+
+impl StaticVerifierPvHandler for DefaultStaticVerifierPvHandler {
+    fn handle_public_values(
+        &self,
+        builder: &mut Builder<OuterConfig>,
+        input: &StarkProofVariable<OuterConfig>,
+        special_air_ids: &SpecialAirIds,
+    ) -> usize {
+        let pv_air = builder.get(&input.per_air, special_air_ids.public_values_air_id);
+        let public_values: Vec<_> = pv_air
+            .public_values
+            .vec()
+            .into_iter()
+            .map(|x| builder.cast_felt_to_var(x))
+            .collect();
+        let pvs = RootVmVerifierPvs::from_flatten(public_values);
+        let exe_commit = compress_babybear_var_to_bn254(builder, pvs.exe_commit);
+        let leaf_commit = compress_babybear_var_to_bn254(builder, pvs.leaf_verifier_commit);
+        let num_public_values = 2 + pvs.public_values.len();
+        builder.static_commit_public_value(0, exe_commit);
+        builder.static_commit_public_value(1, leaf_commit);
+        for (i, x) in pvs.public_values.into_iter().enumerate() {
+            builder.static_commit_public_value(i + 2, x);
+        }
+        num_public_values
+    }
+}
+
+/// Config to generate static verifier DSL operations.
+pub struct StaticVerifierConfig {
+    pub root_verifier_fri_params: FriParameters,
+    pub special_air_ids: SpecialAirIds,
+    pub root_verifier_program_commit: [Bn254Fr; 1],
+}
+
+impl StaticVerifierConfig {
+    pub fn build_static_verifier_operations(
+        &self,
+        root_verifier_vk: &MultiStarkVerifyingKey<RootSC>,
+        proof: &Proof<RootSC>,
+        pv_handler: &impl StaticVerifierPvHandler,
+    ) -> DslOperations<OuterConfig> {
+        let mut builder = Builder::<OuterConfig>::default();
+        builder.flags.static_only = true;
+        let num_public_values = {
+            builder.cycle_tracker_start("VerifierProgram");
+            let input = proof.read(&mut builder);
+            self.verify_root_proof(&mut builder, root_verifier_vk, &input);
+
+            let num_public_values =
+                pv_handler.handle_public_values(&mut builder, &input, &self.special_air_ids);
+            builder.cycle_tracker_end("VerifierProgram");
+            num_public_values
+        };
+        DslOperations {
+            operations: builder.operations,
+            num_public_values,
+        }
+    }
+
+    /// `root_verifier_vk` is the verifying key of the root verifier STARK circuit.
+    /// `root_verifier_fri_params` are the FRI parameters used to prove the root
+    /// verifier STARK circuit.
+    fn verify_root_proof(
+        &self,
+        builder: &mut Builder<OuterConfig>,
+        root_verifier_vk: &MultiStarkVerifyingKey<RootSC>,
+        input: &StarkProofVariable<OuterConfig>,
+    ) {
+        let advice = new_from_outer_multi_vk(root_verifier_vk);
+        let pcs = TwoAdicFriPcsVariable {
+            config: const_fri_config(builder, &self.root_verifier_fri_params),
+        };
+        StarkVerifier::verify::<MultiField32ChallengerVariable<_>>(builder, &pcs, &advice, input);
+        {
+            // Program AIR is the only AIR with a cached trace. The cached trace index doesn't
+            // change after reordering.
+            let t_id = RVar::from(PROGRAM_CACHED_TRACE_INDEX);
+            let commit = builder.get(&input.commitments.main_trace, t_id);
+            let commit = if let DigestVariable::Var(commit_arr) = commit {
+                builder.get(&commit_arr, 0)
+            } else {
+                unreachable!()
+            };
+            builder.assert_var_eq(commit, self.root_verifier_program_commit[0]);
+        }
+        assert_single_segment_vm_exit_successfully_with_connector_air_id(
+            builder,
+            input,
+            self.special_air_ids.connector_air_id,
+        );
+    }
+}