Module transcript 

Fiat-Shamir transcript of the quadratic sumcheck.

Overview

This module is the single statement of what a batch of quadratic sumcheck rounds absorbs. Both sides consume it through the same three calls.

The description itself is a value, built from the numbers that shape a batch.

Shape

    round 0:  polynomial     2 extension elements
              grinding       present only when the difficulty is positive
              challenge      1 extension element
    round 1:  ...

A quadratic round polynomial has three values and two of them cross the wire. The third is what the round identity of the basis reconstructs.

Sub-protocol

A sumcheck is almost always a phase of something larger.

It therefore seeds a transcript of its own from a borrowed sponge, and hands the sponge back. The surrounding protocol keeps its own description, and brackets this run inside it.

That is what lets the two descriptions be written independently and still compose.

Empty runs

A batch of zero rounds absorbs nothing and draws nothing.

Such a batch is therefore not a transcript at all. No seed is folded in, and no step is played.

A caller whose configuration reduces to zero rounds needs no special case of its own.

What the shape binds

A fingerprint of the description enters the sponge before any step runs.

The round count and the grinding difficulty both change the description. The fingerprint therefore covers them.

The basis does not change it. It renames the two values a round sends without moving a single step. It is bound as an instance label instead.

No shipped prover or verifier drives the projective reading yet. The label makes the two seeds differ before one exists.

Structs

ProverTranscript

Prover-side transcript of one batch of quadratic sumcheck rounds.

SumcheckShape

Numbers that fix the transcript of one batch of quadratic sumcheck rounds.

VerifierTranscript

Verifier-side transcript of one batch of quadratic sumcheck rounds.