feat: enable recursion#742
Conversation
|
/ai-review |
Codex Code ReviewFound 2 issues:
|
b628a1d to
619e262
Compare
|
/bench |
- Introduces smoke test with verification of empty program - Implements `get_random_custom_v03` to avoid panics when accessing hashmaps
619e262 to
fcf20ef
Compare
Codex Code ReviewFindings
Notes I reviewed only the PR diff and nearby dependencies. I did not build or run tests per the static-review constraints. |
|
Benchmark Results for modified programs 🚀
|
| # The in-VM STARK verifier. `default-features = false` drops `parallel` (no | ||
| # threads in-guest) and `sysinfo`; the prove-side code compiles but is dead-code | ||
| # eliminated since this guest only calls `verify_with_options`. A plain std guest | ||
| # (build-std includes std) — no no_std plumbing needed. | ||
| lambda-vm-prover = { path = "../../../prover", default-features = false } |
There was a problem hiding this comment.
The comment says default-features = false "drops ... sysinfo", but sysinfo is an unconditional dependency of the prover (prover/Cargo.toml:24), not gated behind any feature. So it is still pulled in and compiled for the RISC-V target — only parallel/rayon are actually dropped. Suggest correcting the comment to avoid implying sysinfo is excluded.
| /// whole `VmProof` can be passed as private input to a verifier guest (naive | ||
| /// recursion); the previous 6.7 MiB was too small to hold real proofs. | ||
| pub const MAX_PRIVATE_INPUT_SIZE: u64 = 64 * 1024 * 1024; | ||
| /// Fixed high address where private input is mapped. Guest programs can read |
There was a problem hiding this comment.
Raising this constant invalidates a comment elsewhere: prover/src/lib.rs:962 still says "MAX_PRIVATE_INPUT_SIZE fits in ~26 pages of DEFAULT_PAGE_SIZE". With 64 MiB and DEFAULT_PAGE_SIZE = 1 << 18 (256 KiB), max_pages is now ~257, so that comment is stale. The computed bound itself is fine (it derives from the constant), just the comment needs updating.
Review: feat: enable recursionReviewed the non-generated changes (skipping Verified as correct (called out because they looked risky at first glance)
Medium — build/CI coupling worth confirming is intentional
Low — stale/misleading comments (inline)
Minor
Nice touch: switching the guest |
Benchmark — ethrex 20 transfers (median of 3)Table parallelism: auto (cores / 3)
Commit: fcf20ef · Baseline: cached · Runner: self-hosted bench |
AI ReviewPR #742 · 16 changed files Findings
Status column reflects the verdict from the verifier: deepseek-verifier (openrouter/deepseek/deepseek-v4-pro). AI-001: Recursion guest never halts explicitly; relies on _start's auto-halt, but main returns i32 (type mismatch with extern "C" fn main() declared as () -> ())
Claim {'evidence': {'suggested_fix': "Either (a) declare the recursion guest's main as Evidence Suggested fix AI-002: Recursion guest main returns i32 and never halts — prover will error with MissingHaltEcall
Claim The recursion guest's Evidence Comparing to the other recursion-suite guests that this PR adds/builds: Suggested fix Change AI-003: Recursion guest will panic on verify failure — `assert!` and `.expect` abort into undefined instruction stream
Claim
Evidence
Suggested fix Either add an explicit AI-004: 64 MiB MAX_PRIVATE_INPUT_SIZE may be insufficient for the use case, with no concrete bound check before proving the outer proof
Claim {'evidence': {'suggested_fix': 'Document the proven upper bound on serialized blob size for the chosen FRI parameters (e.g. "the roundtrip test passes up to N MiB with MIN_PROOF_OPTIONS"), or add a host-side Evidence Suggested fix AI-005: __getrandom_v03_custom silently replaces panicking backend with a constant-seeded StdRng — wrong threat model for in-VM guests
Claim {'evidence': {'suggested_fix': 'Tighten the docstring to call out explicitly: (a) the bytes returned are public-knowledge to anyone who has read this source file (the seed is a constant in the binary), (b) never use this for security-sensitive randomness, including challenge generation or any path that touches Fiat-Shamir. If the goal is to allow HashMap to work without leaking unpredictable IDs across runs, consider documenting that explicitly. Consider also routing the getrandom v0.2 backend (which is what postcard/std often pulls) — currently the diff only adds a v0.3 backend, but the cargo dep tree at recursion/Cargo.lock shows both v0.2.16 and v0.3.4 of getrandom. Verify which one actually fires for HashMap in the recursion guest build.</value>'}} Evidence Suggested fix AI-006: Recursion guest crate duplicates Cargo.lock (1.2k lines) with stale pins that will drift from the workspace
Claim {'evidence': {'suggested_fix': 'Either (a) use Evidence Suggested fix AI-007: Inner prove path may reject MIN_PROOF_OPTIONS (fri_number_of_queries=1) on the host
Claim The Evidence The constant is labeled "intentionally terrible — used by the capacity-probing test", and the test asserts Suggested fix Either (a) confirm in a comment that AI-008: All new recursion smoke tests are #[ignore]'d and not run in CI by default; the test_recursion_blob_decodes_and_verifies_on_host regression guard is effectively dead code in CI
Claim {'evidence': {'suggested_fix': "Either (a) add a non-ignored variant of Evidence Suggested fix AI-009: Recursion guest's `print_string` calls in __getrandom_v03_custom are no-ops in the guest build, but still print in any host build that happens to include the guest
Claim {'evidence': {'suggested_fix': 'Remove the print_string calls (they're no-ops anyway), or move them behind a Evidence Suggested fix AI-010: Inline comment in Makefile contradicts code: 'no_std inner guests' for recursion-elfs but the rule builds with -Z build-std=core,alloc,std,...
Claim {'evidence': {'suggested_fix': 'Split into two Makefile rules: one for the no_std inner guests (empty, fibonacci) that uses Evidence Suggested fix Reviewer Lanes
Verification Lanes
Native Codex and Claude reviews run separately and post their own comments. They are not included in this structured provenance report. Raw lane outputs, candidates, final issues, and model metrics are uploaded as workflow artifacts. |
Summary
bench_vs/lambda/:empty(no_std halt, inner program under test) andrecursion(std verifier guest that deserializes a postcard-encoded(VmProof, elf, ProofOptions)and callsverify_with_options).compile-recursion-elfs/clean-recursion-elfstargets;test-prover-alldepends oncompile-recursion-elfs.MAX_PRIVATE_INPUT_SIZEfrom 6.7 MB → 64 MiB to fit a realVmProofas private input.ProofOptionsfrom the prover crate so the verifier guest can name it without a directstarkdep.prover/src/tests/recursion_smoke_test.rswith ignored tests at two tiers: execute-only (in-VM verify, skips outer STARK prove) and full-prove (outer proof + host verify).HashMapaccess in the guestHow to test
Build the guest ELFs first:
Run the cheapest regression guard (host-only encode/decode + verify, seconds):
Execute-only tier (in-VM verify, no outer prove, tens of GB RAM):
Full pipeline (outer STARK prove + verify, ~125 GB RAM):
Or via make (builds ELFs + runs all ignored prover tests):