feat: add chunked C2 proving [skip-line-limit]

.github/workflows/releases.yml

@@ -367,7 +367,7 @@ jobs:
       - name: Pull circuit artifacts
         id: pull
         run: |
-          SOURCE_HASH=$(pnpm tsx scripts/build-circuits.ts hash)
+          SOURCE_HASH=$(pnpm tsx scripts/build-circuits.ts hash --preset insecure-512 --committee all)
           echo "source_hash=$SOURCE_HASH" >> $GITHUB_OUTPUT
 
           if git fetch origin circuit-artifacts 2>/dev/null; then

agent/CONTEXT.md

@@ -96,14 +96,14 @@ opentelemetry/tracing.
 
 ## Circuit map (IDs ↔ `CircuitName` in `crates/events`)
 
-- **DKG** (`circuits/bin/dkg/`): C0 `pk` (PkBfv) · C2a `sk_share_computation` · C2b
-  `e_sm_share_computation` · C3 `share_encryption` · C4 `share_decryption`
+- **DKG** (`circuits/bin/dkg/`): C0 `pk` (PkBfv) · C2a `sk_share_computation_chunk` · C2b
+  `esm_share_computation_chunk` · C3 `share_encryption` · C4 `share_decryption`
 - **Threshold** (`circuits/bin/threshold/`): C1 `pk_generation` · C5 `pk_aggregation` · P3
   `user_data_encryption_ct0/ct1` (+ wrapper) · C6 `share_decryption` · C7
   `decrypted_shares_aggregation`
-- **Recursive aggregation** (`circuits/bin/recursive_aggregation/`): fold kernels (`c2ab_fold`,
-  `c3_fold`, `c6_fold`, `node_fold`, `nodes_fold`, …) and the top-level `dkg_aggregator` /
-  `decryption_aggregator`, which produce the on-chain Honk verifiers (committed only for
-  `(insecure-512, minimum)`).
+- **Recursive aggregation** (`circuits/bin/recursive_aggregation/`): fold kernels
+  (`c2ab_chunk_fold`, `c3_fold`, `c6_fold`, `node_fold`, `nodes_fold`, …) and the top-level
+  `dkg_aggregator` / `decryption_aggregator`, which produce the on-chain Honk verifiers (committed
+  only for `(insecure-512, minimum)`).
 - `config` circuit validates preset constants (CRT moduli, bounds, parity matrices). Parity matrices
   are generated by the Rust `generate_parity_matrices` binary — never hand-edit.

agent/INVARIANTS.md

@@ -269,6 +269,8 @@ skip-proof feature containment (`pnpm check:invariants`, baselines in
   public-input layout and must be redeployed on committee change.
 - Parity matrices (`parity_{insecure,secure}.nr`) are derived artifacts regenerated from preset
   `QIS` + committee `(N, T)`; hand-edits are caught by regenerate-and-diff.
+- Smudging constants (`smudging.nr`) are derived artifacts regenerated from the BFV preset and
+  committee size. C1 and C2b use the same generated bit width.
 
 ### Noir / Barretenberg compatibility
 
@@ -287,8 +289,10 @@ skip-proof feature containment (`pnpm check:invariants`, baselines in
 ### DKG / threshold structure
 
 - SK splits into N shares; any **M+1** reconstruct/decrypt. — `flow-trace/04`
-- `party_id` derives from the finalized committee normalized by ascending address; 1-indexed,
-  strictly increasing. Active aggregator = lowest non-expelled `party_id`. — `ARCHITECTURE.md`;
+- DKG runtime and NodeFold `party_id` derives from the finalized committee normalized by ascending
+  address; it is zero-indexed and strictly increasing. Active aggregator = lowest non-expelled
+  `party_id`. Decryption-aggregator Shamir coordinates are a separate 1-indexed circuit format and
+  translate to zero-indexed registry slots at the wrapper boundary. — `ARCHITECTURE.md`;
   `flow-trace/04`
 - DKG aggregation receives **exactly H** canonical honest NodeFold proofs (unique in-range party
   IDs) and **exactly N** ordered committee addresses; every preset has `H < N` — never assert
@@ -326,6 +330,16 @@ skip-proof feature containment (`pnpm check:invariants`, baselines in
 - **No proof-disabled bypass (C-02):** both final verifier calls are mandatory in production;
   `skip_proof_aggregation` works only under the `test-only-skip-proof-aggregation` Cargo feature;
   production verifiers reject placeholder C5/C7 proofs. — INDEX concern #32
+- **Complete DKG recursive VK binding:** the DKG proof carries the canonical `NodeFold` VK hash and
+  a recursive VK manifest. The manifest binds the C0/C1, C2 chunk/batch/finalizer/C2AB, C3
+  leaf/fold/kernel/C3AB, C4 leaf/C4AB, and NodesFold kernel VK hashes. NodesFold and C3Fold bind
+  both the current accumulator VK and each prior accumulator's expected kernel or fold VK hash, and
+  every fold step asserts the accumulator's child-VK hash equals the inner proof's VK hash (IF-005);
+  a substituted inner VK fails witness generation. C2 terminal proofs
+  (`SkC2ChunkFinalize`/`ESmC2ChunkFinalize`) are bound to the deployment-time chunk-leaf and
+  `C2ChunkBatch` VK anchors before generic verification (IF-006). `BfvPkVerifier` checks these
+  values against deployment-time anchors before it calls the Honk verifier. — `dkg_aggregator`,
+  `BfvPkVerifier`
 - Circuit soundness fixes to preserve: `ModU64::div_mod` verifies
   `result*divisor == dividend (mod modulus)` (IF-001); C7 compares **every** decoded coefficient,
   including zeros, to the claimed message (IF-002).

agent/flow-trace/00_INDEX.md

@@ -196,12 +196,14 @@ _Found during source-code cross-referencing of these trace documents._
 
 ### Circuit Audit Remediations
 
-| Finding                                               | Status | Implemented behavior                                                                                                                                                                                              |
-| ----------------------------------------------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **IF-001 — unconstrained U64 modular division**       | Fixed  | `ModU64::div_mod` verifies the hinted quotient satisfies `result * divisor == dividend (mod modulus)`; the Noir suite includes a non-invertible-divisor regression test.                                          |
-| **IF-002 — conditional C7 decoding equality**         | Fixed  | C7 compares every decoded coefficient with the claimed message, including zero coefficients; a focused regression test rejects a nonzero decoded value claimed as zero.                                           |
-| **IF-003 — decryption proof phase and party binding** | Fixed  | `decryption_aggregator` requires 1-indexed, strictly increasing party IDs, while `BfvDecryptionVerifier` checks the surfaced SK/ESM commitments against the E3's registry-backed DKG anchors.                     |
-| **IF-004 — ciphertext commitment binding**            | Fixed  | The off-chain SAFE commitment is stored at ciphertext publication, propagated as a final decryption-proof public input, and compared on-chain without attempting BFV decoding or Poseidon2 execution in Solidity. |
+| Finding                                               | Status | Implemented behavior                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| ----------------------------------------------------- | ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **IF-001 — unconstrained U64 modular division**       | Fixed  | `ModU64::div_mod` verifies the hinted quotient satisfies `result * divisor == dividend (mod modulus)`; the Noir suite includes a non-invertible-divisor regression test.                                                                                                                                                                                                                                                                                            |
+| **IF-002 — conditional C7 decoding equality**         | Fixed  | C7 compares every decoded coefficient with the claimed message, including zero coefficients; a focused regression test rejects a nonzero decoded value claimed as zero.                                                                                                                                                                                                                                                                                             |
+| **IF-003 — decryption proof phase and party binding** | Fixed  | `decryption_aggregator` requires 1-indexed, strictly increasing party IDs, while `BfvDecryptionVerifier` checks the surfaced SK/ESM commitments against the E3's registry-backed DKG anchors.                                                                                                                                                                                                                                                                       |
+| **IF-004 — ciphertext commitment binding**            | Fixed  | The off-chain SAFE commitment is stored at ciphertext publication, propagated as a final decryption-proof public input, and compared on-chain without attempting BFV decoding or Poseidon2 execution in Solidity.                                                                                                                                                                                                                                                   |
+| **IF-005 — fold-step child VK binding**               | Fixed  | Every `c3_fold`/`nodes_fold` step asserts the accumulator's child-VK hash equals the verifying key hash of the inner proof folded that step. A substituted (even canonical) inner VK now fails witness generation instead of passing silently. Regression-covered by `fold_vk_binding_adversarial_tests`.                                                                                                                                                           |
+| **IF-006 — C2 terminal VK binding at ingress**        | Fixed  | Before generic (bb) verification, each `SkC2ChunkFinalize`/`ESmC2ChunkFinalize` proof is checked against the deployment-time anchors: the child field equals the canonical chunk-leaf VK hash for that proof type, the final field equals the canonical `C2ChunkBatch` VK hash, the public-signal length matches the frozen committee and preset, and every field is canonical. A mismatch marks the signed proof invalid. Covered by `validate_c2_terminal_proof`. |
 
 ### Protocol Design Concerns