feat(EIP-0045): Native STARK Proof Verifier (VerifyStark) - Draft

[a-shannon]

Summary

This PR implements the preactivation review surface for EIP-0045's
VerifyStark opcode (0xB9). It replaces the earlier research prototype with
a four-child ABI, an unavailable-by-default host capability, complete
whole-input preflight for v4+ trees, and a pure-JVM verifier for the
B1-B3-closed RISC Zero v3 profile candidate.

This is deliberately not an activation PR. It does not make any profile
selectable by default or activate one on Ergo mainnet or testnet; the final
cost schedule, transition snapshot, node admission controller, and activation
package remain separate gates.

ErgoScript ABI

verifyStark(
  proofChunks:         Coll[Coll[Byte]],
  applicationPayload: Coll[Byte],
  programId:           Coll[Byte],
  profileId:           Coll[Byte]
): Boolean

The AST and wire encoding have exactly four children in that order. There is
no vmType, costParams, query count, Merkle depth, or other script-declared
work parameter.

Consensus-facing design

• The evaluator is fail-closed by default. A node must supply an authenticated,
  purpose-specific StarkVerificationCapability; legacy constructors preserve
  source and binary compatibility by installing Unavailable.
• The capability snapshots the chain domain, protocol generation, validation
  purpose, lifecycle table, dispatch charge, profile charge, proof shape, and
  payload bound. Profile IDs are unique and unsigned-lexicographically sorted.
• Evaluation resolves profileId and lifecycle first. An exact unknown ID is
  Absent and returns false after dispatch without evaluating the three
  heavy children. Unavailable is a host-capability failure and Quarantined
  is a typed input failure; neither can be converted into Boolean success by
  negation or soft-fork fallback. An active invocation pays the complete fixed
  profile charge before the program, payload, proof chunks, parser, or
  cryptography can run.
• Ergo constructs ErgoStatementV1, binding the receipt to the chain domain,
  profile, guest program, executing contract, and exact application payload.
  A typed invalid proof returns false; cost, host-invariant, allocation, and
  fatal VM failures continue to propagate.
• v0-v3 retain their historical one-pass deserialization semantics but reject
  any structurally present or introduced VerifyStark. A v4+ tree completes a
  deterministic recursive materialization/preflight over the entire input,
  including dead branches, before normal evaluation. The continuation is
  opaque and single-use.

Initial verifier profile

The checked-in review/test candidate targets the stock RISC Zero v3.0.5
succinct receipt family (risc0-zkp 3.0.4 / recursion 4.0.4): BabyBear,
degree-4 extension, Poseidon2 recursion, and the shipping outermost lift,
join, and resolve controls needed by single-segment, multi-segment, and
assumption-bearing receipts.

The profile package is content-addressed and byte exact:

• 29,773-byte algorithm artifact;
• 65,119-byte binary-data artifact;
• 458-byte manifest;
• profileId 23c4a123ffb33a1c8db89436fe0e7972bd8e4e289459ee5fd71be5440607d383.

The verifier enforces canonical transport, strict EOF, BabyBear field bounds,
typed terminal allowlisting, the pinned inner control root, exact claim
equality, and complete FRI/Merkle/constraint verification. Imported RISC Zero
logic and independent test-vector provenance are mapped in
docs/eip-0045-risc0-source-map.json; Apache-2.0 notices are included in JVM
binary, source, test, and documentation artifacts and in the npm distribution.

Compatibility note

Complete preflight requires every ValueSerializer to describe its structural
children. Registered consensus serializers implement that contract explicitly.
Legacy external subclasses retain source and binary compatibility through
concrete defaults, but those defaults fail closed during structural preflight:
an undeclared serializer is rejected and is never silently treated as a leaf.

Validation included

• exact four-child serialization and type rejection;
• v0-v3 structural feature gating and v4 recursive whole-input preflight;
• dead-branch, nested context/register, wrong-type, suffix, ordering, and
  single-use continuation cases;
• unavailable, absent, quarantined, active, cost-limit, and exception paths;
• statement/claim/profile/package canonicalization;
• BabyBear, Ext4, Poseidon2, ReadIOP, Merkle, FRI, circuit, and raw-seal KATs;
• one independent real RISC Zero raw-seal interoperability KAT using a
  different guest image and journal; it is not part of B4 and is not B4-closure
  evidence;
• JVM/Scala.js compilation and the supported Scala binary-version matrix.

Verification status for the replacement commit

Targeted local verification of f78deadd668f801e7fae3bc884283f79c6f484fa
passed: coreJVM 63/63, dataJVM 4/4, and Scala.js 22/22, for 89/89 tests.
These are targeted preactivation checks, not a claim that every repository
suite has run. GitHub CI passed on this replacement commit in all four
configured lanes: JVM Scala 2.11.12, 2.12.21, and 2.13.18, plus the
Scala.js/npm lane on Scala 2.13.18. Node/devnet integration has not run. The
appropriate status remains draft review, not merge or activation readiness.

Integration note

Open PR #1170 also touches VersionContext.scala and Interpreter.scala in a
behavior-preserving refactor of checkSoftForkCondition. It addresses a
different objective, but both branches meet at the MaxSupportedScriptVersion
and soft-fork fallback boundary. If #1170 lands first, this branch may need
conflict resolution followed by rerunning the v0-v3/v4+ version, preflight,
and fallback tests.

Explicitly out of scope

Activation still requires EIP B4-B8: the final identity-bound receipt and
negative corpus, measured consensus metering, authenticated network transition,
independent reproduction/review, node admission and mempool protections, and
testnet operational evidence. A shared 262,144-byte standalone relay/API/
mempool policy must also be shipped before activation while received and
historical block decoding remain outside that local policy. The closed B1-B3
package is a reviewable profile identity, not authorization to use it on-chain.

Review focus

1. Four-child serialization and language-version compatibility.
2. Whole-input preflight completeness and single-use continuation semantics.
3. Capability/lifecycle/fixed-precharge ordering and exception taxonomy.
4. Exact profile package, raw-seal grammar, claim binding, and JVM verifier.
5. Absence of an accidental activation or script-controlled workload path.

Specification: ergoplatform/eips#103

[a-shannon]

Superseded: this comment describes the former 159-test Poseidon1/Ext16 prototype. The current branch is the four-child RISC Zero v3 BabyBear/Ext4/Poseidon2 preactivation review surface; see the PR body for exact scope and current verification status.