This skill should be used when the user asks about "AIR", "algebraic intermediate representation", "ZK constraints", "trace design", "constraint soundness", "polynomial commitments", "FRI", "STARK", "lookup arguments", "permutation arguments", "memory consistency", "transition constraints", "boundary constraints", "vanishing polynomial", "quotient polynomial", "Fiat-Shamir", or needs expert-level cryptographic review of constraint systems.
/plugin marketplace add ClementWalter/rookie-marketplace/plugin install air-cryptographer@rookie-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
references/review-checklist.mdExpert-level knowledge for designing, implementing, and auditing Algebraic Intermediate Representations (AIRs) in zero-knowledge proof systems.
Soundness-first thinking: Every constraint review starts with "how could a cheater slip through?" Think adversarially. Construct counterexample traces by hand. Exploit polynomial identity loopholes.
Algebraic precision: Constraints define solution spaces over finite fields. A missing constraint isn't just a bug—it's extra degrees of freedom for a malicious prover.
Essential intuitions:
Interpolation: Given n points, unique polynomial of degree < n passes through them. Lagrange basis makes this explicit.
Vanishing polynomials: Z_H(x) = ∏(x - h) for h ∈ H vanishes exactly on domain H. This is the foundation of constraint enforcement.
Degree behavior:
Evaluation domains: Multiplicative cosets for separation. Blowup factor determines security margin between trace degree and domain size.
| Type | Definition | Example |
|---|---|---|
| Source of truth | Canonical witness data | PC, registers, memory values |
| Derived | Computed from source columns | Flags, decompositions |
| Auxiliary | Added to reduce degree | Intermediate products |
Critical rule: Every column must be constrained. An unconstrained column is a free variable for the prover.
Define precisely what each row represents:
Row types require selectors. Selectors must be:
s(s-1) = 0Σ s_i = 1 (or coverage proof)Start minimal. Add auxiliary columns only when:
Express correct step relation between row i and row i+1:
next_pc = pc + instruction_size (when not branching)
next_register[k] = f(current_state, opcode)
Danger: Writing a relation instead of a function. Multiple valid next-states = unsound.
Pin specific rows to specific values:
Danger: "Final row" must be uniquely defined. Variable-length traces need explicit halt handling.
For boolean b: b(b-1) = 0
For k-bit value x with bits b_0...b_{k-1}:
x = Σ b_i · 2^i
b_i(b_i - 1) = 0 for all i
Danger: Forgetting booleanity constraints on decomposition bits.
Selectors gate which constraints apply to which rows.
Checklist:
Classic bug: All selectors zero makes all gated constraints vacuously true.
Prove two multisets are equal via grand product:
∏(α - a_i) = ∏(α - b_i)
Checklist:
Danger: Product hitting zero, missing boundary constraints, challenge reuse.
Prove all values in column A appear in table T.
Checklist:
Danger: Weak compression allows out-of-table values.
Memory operations form a log: (address, timestamp, value, is_write)
Patterns:
Danger:
Constraint polynomial C(x) should vanish on trace domain H.
Quotient: Q(x) = C(x) / Z_H(x)
If C doesn't vanish on H, Q has poles → not low-degree → FRI rejects.
Constraints apply to different row sets:
Danger: Constraint meant for "all rows" accidentally only enforced on subset due to incorrect vanishing factor.
Track degree of every constraint:
Base constraint degree: d
After selector multiplication: d + deg(selector)
After boundary polynomial: d + deg(boundary)
Composition polynomial degree must stay below domain size with sufficient margin (blowup factor).
Transcript must bind:
Challenge separation: Different arguments need independent challenges. Reusing challenges creates algebraic vulnerabilities.
Danger: Challenge derived before commitment → prover can adapt witness.
Before declaring an AIR sound, try to break it:
If you find a counterexample trace, you found a bug.
| Pattern | Symptom | Fix |
|---|---|---|
| Unconstrained column | Prover sets arbitrarily | Add constraint |
| Missing booleanity | Non-binary "boolean" | Add b(b-1)=0 |
| Selector leakage | Constraint bypassed | Enforce exclusivity |
| Last row escape | Inconsistency hidden | Proper terminal constraints |
| Product zero | Permutation argument fails | Boundary checks, domain separation |
| Challenge reuse | Algebraic cancellation | Separate challenges per argument |
| Weak compression | Lookup collision | Increase randomness |
Understand tradeoffs without being an engineer:
| Choice | Prover Cost | Verifier Cost | Soundness |
|---|---|---|---|
| More columns | Higher memory | Unchanged | Neutral |
| Higher degree | More FRI rounds | More queries | Watch blowup |
| More rows | Linear scaling | Log scaling | Neutral |
| Auxiliary columns | Memory + constraints | Unchanged | Can improve |
Rules of thumb:
When reviewing an AIR, produce:
See references/review-checklist.md for the complete systematic review sheet.