feat: add Jolt witness crate (#1604)

* feat: add Jolt witness crate

Introduce the jolt-witness crate: the witness-generation layer producing
committed and virtual polynomials for the Jolt VM, dory-assist, wrapper, and
blindfold protocols.

Consolidates follow-up refactors:
- Split the jolt_vm witness module by stage and polynomial family
  (spartan_outer, stage2/3/6, registers, ra, ram, trace, streams, provider).
- Share require_unique_ids / power_of_two_log_rows helpers across the wrapper
  and dory_assist providers via protocols/util.rs.
- Tighten the core witness data-access API: log_rows-only WitnessDimensions,
  ViewRequirement-based oracle_view, and removal of dead encodings, policies,
  and builder indirection.
- Document the core witness vocabulary types.
- Restore the 1604 workspace build.

* fix(jolt-witness): correct next_is_noop boundary and bound stage6 RAM remap

Addresses review feedback on #1604:

- stage2: next_is_noop used is_none_or (-> true at the final cycle), inverting
  the boundary relative to the canonical is_some_and used by every other path
  (jolt-core r1cs/inputs.rs, spartan_outer.rs, trace.rs). It feeds
  ShouldJump = Jump*(1 - NextIsNoop), so the boundary value was inverted.
  Switch to is_some_and.
- stage6: remapped_ram_address was computed inline, skipping the >= ram_k
  bound that the shared remapped_ram_address() helper (ram.rs) enforces and
  that stage2 and every ram.rs path route through. An out-of-range remap would
  index past the ram_k one-hot domain. Route through the helper, keeping the
  ram_address binding (still needed for ram_access_nonzero).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Michael Zhu <mchl.zhu.96@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

Cargo.lock

@@ -34,6 +34,7 @@ members = [
   "crates/jolt-sumcheck",
   "crates/jolt-openings",
   "crates/jolt-verifier",
+  "crates/jolt-witness",
   "crates/jolt-dory",
   "crates/jolt-hyperkzg",
   "crates/jolt-riscv",
@@ -389,6 +390,7 @@ jolt-crypto = { path = "./crates/jolt-crypto" }
 jolt-field = { path = "./crates/jolt-field" }
 jolt-openings = { path = "./crates/jolt-openings" }
 jolt-verifier = { path = "./crates/jolt-verifier" }
+jolt-witness = { path = "./crates/jolt-witness" }
 jolt-poly = { path = "./crates/jolt-poly" }
 jolt-r1cs = { path = "./crates/jolt-r1cs" }
 jolt-transcript = { path = "./crates/jolt-transcript" }

Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "jolt-witness"
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+description = "Witness oracle infrastructure for Jolt proving"
+repository = "https://github.com/a16z/jolt"
+keywords = ["SNARK", "zkvm", "witness"]
+categories = ["cryptography"]
+
+[lints]
+workspace = true
+
+[features]
+default = []
+field-inline = [
+  "jolt-claims/field-inline",
+  "jolt-lookup-tables/field-inline",
+  "jolt-program/field-inline",
+  "jolt-riscv/field-inline",
+]
+
+[dependencies]
+jolt-claims.workspace = true
+jolt-field.workspace = true
+jolt-lookup-tables.workspace = true
+jolt-poly.workspace = true
+jolt-program.workspace = true
+jolt-riscv.workspace = true
+rayon.workspace = true
+thiserror.workspace = true
+
+[dev-dependencies]
+common.workspace = true

crates/jolt-witness/Cargo.toml

@@ -0,0 +1,24 @@
+/// Dimensions of a multilinear witness polynomial.
+///
+/// The evaluation domain is always a power of two, so only the variable count
+/// is stored; the row count is derived.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct WitnessDimensions {
+    pub log_rows: usize,
+}
+
+impl WitnessDimensions {
+    /// Panics if `log_rows >= usize::BITS`; a domain that large is a
+    /// programming error, not recoverable input.
+    pub const fn new(log_rows: usize) -> Self {
+        assert!(
+            log_rows < usize::BITS as usize,
+            "log_rows must be smaller than usize::BITS"
+        );
+        Self { log_rows }
+    }
+
+    pub const fn rows(&self) -> usize {
+        1 << self.log_rows
+    }
+}

crates/jolt-witness/src/dimensions.rs

@@ -0,0 +1,14 @@
+/// Physical representation of a polynomial's evaluations in views and stream
+/// chunks.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum PolynomialEncoding {
+    /// One field element per row.
+    #[default]
+    Dense,
+    /// Small-scalar values (e.g. `u64` words or signed increments) promoted to
+    /// field elements on use.
+    Compact,
+    /// Rows form a `K x T` grid in which each cycle column has at most one
+    /// nonzero entry; only the hot index per cycle is stored.
+    OneHot,
+}

crates/jolt-witness/src/encoding.rs

@@ -0,0 +1,21 @@
+use thiserror::Error;
+
+#[derive(Clone, Debug, Error, PartialEq, Eq)]
+pub enum WitnessError {
+    #[error("unknown witness oracle in namespace `{namespace}`")]
+    UnknownOracle { namespace: &'static str },
+    #[error("requested witness view is unavailable in namespace `{namespace}`")]
+    UnavailableView { namespace: &'static str },
+    #[error("invalid witness dimensions in namespace `{namespace}`: {reason}")]
+    InvalidDimensions {
+        namespace: &'static str,
+        reason: String,
+    },
+    #[error("invalid witness data in namespace `{namespace}`: {reason}")]
+    InvalidWitnessData {
+        namespace: &'static str,
+        reason: String,
+    },
+    #[error("witness provider does not support this view: {view}")]
+    UnsupportedView { view: &'static str },
+}

crates/jolt-witness/src/error.rs

@@ -0,0 +1,35 @@
+//! Witness oracle infrastructure for modular Jolt proving.
+//!
+//! This crate owns data-access abstractions for witness material, not protocol
+//! order or backend allocation policy.
+
+mod dimensions;
+mod encoding;
+mod error;
+mod namespace;
+mod opening;
+mod polynomial;
+mod provider;
+mod public;
+mod streaming;
+
+pub mod protocols;
+
+pub use dimensions::WitnessDimensions;
+pub use encoding::PolynomialEncoding;
+pub use error::WitnessError;
+pub use namespace::{NamespaceId, OracleKind, OracleRef, WitnessNamespace};
+pub use opening::OpeningWitness;
+pub use polynomial::{
+    MaterializationPolicy, OracleDescriptor, PolynomialView, RetentionHint, ViewRequirement,
+};
+pub use protocols::jolt_vm::{
+    RaFamilyCycleIndexSource, RaFamilyCycleIndices, RA_FAMILY_MAX_BYTECODE_CHUNKS,
+    RA_FAMILY_MAX_INSTRUCTION_CHUNKS, RA_FAMILY_MAX_RAM_CHUNKS,
+};
+pub use provider::{CommittedWitnessProvider, WitnessProvider};
+pub use public::PublicValue;
+pub use streaming::{
+    PolynomialBatchChunk, PolynomialBatchStream, PolynomialChunk, PolynomialChunkKind,
+    PolynomialStream,
+};

crates/jolt-witness/src/lib.rs

@@ -0,0 +1,68 @@
+use core::{fmt::Debug, hash::Hash};
+
+/// Label identifying which protocol a witness item belongs to; appears in
+/// every [`crate::WitnessError`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub struct NamespaceId {
+    pub name: &'static str,
+}
+
+impl NamespaceId {
+    pub const fn new(name: &'static str) -> Self {
+        Self { name }
+    }
+}
+
+/// Type-level identity of one protocol's witness taxonomy.
+///
+/// Implemented by uninhabited enums (no values exist; all dispatch is
+/// compile-time). The associated types bind the protocol's polynomial,
+/// opening, public-input, and challenge identifier spaces, so oracles from
+/// different protocols cannot be mixed up.
+pub trait WitnessNamespace {
+    type CommittedId: Copy + Debug + Eq + Hash;
+    type VirtualId: Copy + Debug + Eq + Hash;
+    type OpeningId: Copy + Debug + Eq + Hash;
+    type PublicId: Copy + Debug + Eq + Hash;
+    type ChallengeId: Copy + Debug + Eq + Hash;
+
+    const ID: NamespaceId;
+}
+
+/// Committed polynomials go through the commitment scheme; virtual
+/// polynomials are derived during proving and never committed.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum OracleKind<C, V> {
+    Committed(C),
+    Virtual(V),
+}
+
+/// Typed reference to a single polynomial within namespace `N`.
+#[derive(Debug, PartialEq, Eq, Hash)]
+pub struct OracleRef<N: WitnessNamespace> {
+    pub kind: OracleKind<N::CommittedId, N::VirtualId>,
+}
+
+// Manual impls: deriving would incorrectly require `N: Clone + Copy` even
+// though `N` only appears through its associated types.
+impl<N: WitnessNamespace> Clone for OracleRef<N> {
+    fn clone(&self) -> Self {
+        *self
+    }
+}
+
+impl<N: WitnessNamespace> Copy for OracleRef<N> {}
+
+impl<N: WitnessNamespace> OracleRef<N> {
+    pub const fn committed(id: N::CommittedId) -> Self {
+        Self {
+            kind: OracleKind::Committed(id),
+        }
+    }
+
+    pub const fn virtual_polynomial(id: N::VirtualId) -> Self {
+        Self {
+            kind: OracleKind::Virtual(id),
+        }
+    }
+}

crates/jolt-witness/src/namespace.rs

@@ -0,0 +1,20 @@
+use crate::{OracleRef, WitnessNamespace};
+
+/// Claimed evaluation of `oracle` at `point`: the witness-side data backing
+/// one opening claim.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct OpeningWitness<F, N: WitnessNamespace> {
+    pub oracle: OracleRef<N>,
+    pub point: Vec<F>,
+    pub value: F,
+}
+
+impl<F, N: WitnessNamespace> OpeningWitness<F, N> {
+    pub fn new(oracle: OracleRef<N>, point: Vec<F>, value: F) -> Self {
+        Self {
+            oracle,
+            point,
+            value,
+        }
+    }
+}