fix(stark-prover): replace 128-bit XOR accumulator with 256-bit BLAKE3 leaf dual accumulator (Phase 4a+4b)

[LucienSong]

Summary

Aligns the STARK signature batch commitment with WP §STARK — replaces the 128-bit XOR-fold accumulator with a 256-bit dual-channel BLAKE3 accumulator, and wires the batch-root commitment directly into the block header (proof-carrier).

Changes

Phase 4a — STARK accumulator upgrade

• air.rs: 4-column trace [acc_lo, acc_hi, leaf_lo, leaf_hi], 2 degree-3 transition constraints, 4 boundary assertions; SigBatchPublicInputs.batch_root_lo/hi split
• prover.rs: SigBatchEntry.to_leaf_bytes() = BLAKE3(msg_hash ‖ pk_hash); to_field_elements() splits 32-byte leaf into (lo, hi) f128 pair; dual-channel build_trace(); compute_batch_root() returns [u8; 32]; verify_sig_batch() returns error for commitment-only proofs
• proof.rs: batch_root_bytes [u8; 16] → [u8; 32], version 1 → 2; commitment_only() + has_proof() constructors
• Cargo.toml: blake3 = { workspace = true }

Phase 4b — Proof carrier (header field population)

• block_producer.rs: synchronously compute batch root before signing; embed SigBatchProof::commitment_only(batch_root, n) in header.sig_aggregate_proof so it is covered by the block hash and proposer seal
• block_importer.rs: skip full STARK verification for commitment-only proofs; log debug and continue — full STARK proof arrives via ProofAmendment

Compatibility fixes

• system_rewards.rs / mod.rs: extract lo-half [0..16] from 32-byte batch_root_bytes for SettledL1Input.batch_root: u128 feeding the L2 recursive circuit (unchanged interface)

Test results

cargo test -p shell-stark-prover  →  125 passed
cargo test -p shell-node          →  220 passed
cargo clippy --workspace -- -D warnings  →  clean
cargo fmt --all -- --check        →  clean

White paper alignment

• WP §STARK: leaf = BLAKE3(msg_hash ‖ pk_hash) — ✅
• WP §STARK: 256-bit batch root in sig_aggregate_proof — ✅
• WP §STARK: full STARK proof in ProofAmendment, not inline — ✅
• Block hash covers batch-root commitment — ✅

[Copilot]

Pull request overview

This PR upgrades the STARK signature batch commitment from a 128-bit XOR-fold accumulator to a 256-bit dual-channel BLAKE3 accumulator (Phase 4a), and embeds the commitment-only batch root directly in the block header before signing so it is covered by the proposer seal (Phase 4b). A separate refactor moves PQ address resolution out of TxExecutionResult.pq_addr_map into a ShellStateDb.address_registry snapshot, and introduces a commit_pqvm_state_raw variant for committing to a second WorldState.

Changes:

• STARK AIR / prover / proof: 4-column trace [acc_lo, acc_hi, leaf_lo, leaf_hi] with two degree-3 transitions, BLAKE3 leaves, 32-byte batch_root_bytes, version bump 1→2, and commitment_only() / has_proof() helpers.
• Block producer embeds SigBatchProof::commitment_only(...) in the header before signing; block importer accepts commitment-only payloads and defers full STARK verification to ProofAmendment arrival.
• PQVM commit path is refactored: commit_pqvm_state(&result, &mut state_db) for in-place commits, commit_pqvm_state_raw(..., &registry) for a second target (node's persistent WorldState).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
crates/stark-prover/Cargo.toml	Adds blake3 workspace dep for the new leaf hash.
crates/stark-prover/src/air.rs	Dual-accumulator AIR: 4 cols, 2 degree-3 transitions, 4 boundary assertions; lo/hi public inputs.
crates/stark-prover/src/proof.rs	batch_root_bytes becomes [u8;32]; version → 2; commitment_only() and has_proof() constructors.
crates/stark-prover/src/prover.rs	BLAKE3 leaves, dual-channel trace, 32-byte compute_batch_root, commitment-only rejected in verify_sig_batch.
crates/node/src/node/block_producer.rs	Synchronously computes batch root, embeds commitment-only proof in header before signing; snapshots address registry across dual commits.
crates/node/src/node/block_importer.rs	Skips full STARK verification for commitment-only payloads; updated to new commit_pqvm_state signature.
crates/node/src/node/system_rewards.rs	Extracts lo-half (bytes[0..16]) from 32-byte root for u128-based L2 recursive circuit.
crates/node/src/node/mod.rs	Re-exports commit_pqvm_state_raw, SigBatchProof, compute_batch_root; test fixtures updated to 32-byte roots.
crates/pqvm/src/lib.rs	Re-exports commit_pqvm_state_raw.
crates/pqvm/src/executor.rs	Removes pq_addr_map from TxExecutionResult; introduces do_commit_state core helper plus commit_pqvm_state / commit_pqvm_state_raw.
crates/pqvm/src/state_db.rs	Renames pq_hints/hint_pq_address to address_registry/register_pq_address; adds resolve_address and address_registry_snapshot.
crates/pqvm/tests/common/mod.rs	Updates to new commit_pqvm_state signature.
crates/pqvm/tests/integration.rs	Updates to new commit_pqvm_state signature and address-registry naming.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.