pub_inputs support

[ashpect]

Support for public_witness opening

[Copilot]

Pull request overview

This PR adds support for public witness opening in the WHIR R1CS proof system. The implementation introduces a new PublicInputs struct to handle public values, updates both the prover and verifier to compute and verify public input hashes, and modifies the witness scheduling to ensure public inputs are correctly ordered in the witness commitment.

Key Changes:

• Introduced PublicInputs struct with SHA-256 hashing for commitment
• Modified prover and verifier to handle public weights and verify public input consistency
• Updated witness scheduling to place public inputs in w1 (pre-challenge) layer with proper ordering

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 22 comments.

Show a summary per file

File	Description
provekit/common/src/witness/mod.rs	Adds PublicInputs struct with hashing and serialization support
provekit/common/src/utils/serde_ark_vec.rs	New module for serializing vectors of field elements
provekit/common/src/utils/mod.rs	Exports new serde_ark_vec module
provekit/common/src/utils/sumcheck.rs	Adds add_public_inputs() method to IO pattern for public input hash and randomness
provekit/common/src/whir_r1cs.rs	Updates constraint counts and IO pattern to include public weights verification
provekit/common/src/noir_proof_scheme.rs	Adds public_inputs field to NoirProof struct
provekit/common/src/lib.rs	Exports PublicInputs type
provekit/common/Cargo.toml	Adds sha2 dependency for hashing
provekit/common/src/witness/witness_builder.rs	Passes public input indices to witness splitting logic
provekit/common/src/witness/scheduling/splitter.rs	Ensures public inputs are placed in w1 and properly ordered after constant builder
provekit/r1cs-compiler/src/noir_proof_scheme.rs	Extracts ACIR public input indices for witness splitting
provekit/prover/src/lib.rs	Extracts public inputs from witness and passes to proof generation
provekit/prover/src/whir_r1cs.rs	Implements public weights computation and statement updates for both single and batch commitment cases
provekit/verifier/src/lib.rs	Passes public inputs to verification
provekit/verifier/src/whir_r1cs.rs	Verifies public input hash and updates statements with public weights constraints

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Bisht13]

The following must produce identical results:

• Rust: PublicInputs::hash() using SkyscraperCRH::evaluate()
• Go: hashPublicInputs() using sc.CompressV2()

Add a cross-language test with known test vectors.

[ashpect]

Ref in : #257

[Bisht13]

This is hardcoded and assumes:

• Batch mode: 3 constraints for statement1 + 1 public weights + 3 for statement2 = 7
• But what if public inputs are empty in batch mode?
  The Go verifier calculates this dynamically:

if !cfg.PublicInputs.IsEmpty() {
    witnessLinearStatementEvalsSize = 7
} else {
    witnessLinearStatementEvalsSize = 6
}

[Bisht13]

No validation that the public inputs extracted from witness match what the circuit expects. If acir_public_inputs indices are wrong, proof will be valid but verify wrong values.

[Bisht13]

The verifier creates dummy zero-weight vectors. This is correct because the verifier doesn't know the actual weights (only the prover does), but:

1. This should be commented explaining why zeros are OK
2. Verify that the WHIR protocol handles this correctly (the actual weighted sum comes from the hint)

[Bisht13]

When public inputs are empty, the hint whir_public_weights_query_answer is still read from the transcript but never validated. A malicious prover could put garbage here and it would be ignored.

[Bisht13]

Duplicate Logic Between Single/Batch Paths. Same pattern in the verifier, the public input hash verification and statement extension logic is copy-pasted between the two branches.

[Bisht13]

Please add unit tests for testing all cases of public inputs.