The poi package (Freivalds-over-F_p verification) is hard-consumed
by luxfi/precompile/aivmbridge/computeproof.go but has no README.
Adds Overview + API + wire codec spec + soundness bound + worked
example so a new contributor can audit a fraud proof without
reading the engine.
Pure docs. No behavior change.
- promptseal: KEM X25519 → X-Wing (X25519 + ML-KEM-768), making the prompt-confidentiality envelope
POST-QUANTUM (secure if either half holds) — matching the strict-PQ posture of ML-DSA staking. The
proof layer was already PQ (keccak + information-theoretic Freivalds). 6/6 still green.
- attestation: a REAL TEE quote verifier (closes the audit's TEE stub). Verify() checks an ECDSA-P256
report signature, an x509 cert chain to a PINNED vendor root, a measurement allow-list, AND that the
report binds the operator's confidentiality key — so a sealed prompt opens ONLY inside the attested
enclave (custody end to end). 6/6 incl. forged-sig, unpinned-root (an attacker's own well-formed
quote is rejected), wrong-measurement, unbound-key, tampered-measurement.
- poi/scale_test.go: 1/10/100/1000-node scaling. VerifyOpening is per-node-independent → linear
aggregate throughput (542 → 542k proofs/sec) at constant latency, and fraud-caught probability
→ 1.0 as nodes grow. + BenchmarkVerifyOpening.
Mirrors the Rust red-team against the canonical Go verifier the chain consumes: the pre-fit-challenge
killer (forge passes a guessed r1, fails a beacon-fresh r2 — proves the post-commit beacon is
load-bearing), a griefer's uncommitted opening can't slash, the wire decoder never panics on fuzzed
frames, and over-large dims are rejected. go test ./poi: ok.
EncodeOpening/DecodeOpening: one canonical frame (root|index|beacon|A|B|C|proof) shared by the Go
prover, the aivmbridge precompile, and the Solidity reference, so a real-model-sized opening is
verified NATIVELY on-chain instead of in gas-bounded EVM bytecode. CheckOpening/CheckDecoded return
(included, freivaldsOK) — the two bits the gate needs (genuine = both; fraud = included && !ok).
Bounds every length (MaxOpeningDim) so a malformed frame can't over-allocate. Tests: round-trip,
honest, fraud, not-included (griefer), truncated. go test ./poi: ok.
Mirror of hanzo-engine/src/poi_transcript.rs: ProofTranscript (keccak Merkle over per-matmul
leaves), ExactMatmul (whole-K i64), VerifyOpening (Merkle inclusion + Freivalds), ChallengeIndex.
VerifyOpening is the production caller the audit found missing — the off-chain watcher imports it
and slashes a bond when an opening fails. Tests: transcript round-trip, fabricated-output-caught,
swapped-reveal-caught, and a pinned golden DeriveChallenges vector mirrored byte-for-byte in the
Rust suite (cross-language parity enforced, not assumed). go test ./poi: ok.
The Proof-of-Inference verifier primitive in its proper home, beside
keccak.go (which the aivmbridge already imports). Freivalds matmul check
over F_p (p=2^61-1) on the exact int8 i32 accumulator: an honest A*B
passes; a single tampered output entry (incl. a buried off-by-one in a
16x24 matmul) is caught; signed entries reduced correctly; keccak-derived
challenges deterministic; wrong dims fail closed. All tests pass.
This is the canonical verifier the chain consumes (chains/aivm settlement,
the computeattest precompile). hanzo-engine/src/poi.rs is the Rust
prover-side mirror; luxcpp/crypto is the C++ native mirror. The forward-
pass commitment + transcript binding are not here (engine/chain side); no
end-to-end proof is emitted yet.
