A Winterfell Debug-Mode Assertion That Isn't a Soundness Bug
This repo's README tells you to run cargo test --release, not plain cargo test. That's an unusual instruction for a cryptographic project, and it deserves the exact reproduction, not just an assurance.
Running cargo test (debug mode, no --release) against this workspace fails three tests with the same panic, from inside Winterfell itself:
thread 'stark_backend_round_trips_through_the_router' panicked at
winter-prover-0.13.1/src/constraints/evaluation_table.rs:214:9:
assertion `left == right` failed: transition constraint degrees didn't match
expected: [ 21, 21, 21, 21, 21]
actual: [ 14, 0, 0, 0, 0]Those are the real numbers from a real run against this repo's test suite, not illustrative ones. Five constraints (one for the accumulator, four for the registers) were declared with the same degree bound, but only the accumulator's constraint reached its full declared degree on this particular trace — three of the four register constraints came out to exactly 0.
Why the actual degree can be zero
Each register's transition constraint is gated by that register's one-hot selector: active * s_store * reg_sel[k]. If a specific test program never stores into register k — reg_sel[k] is 0 on every row — the term the constraint depends on is identically zero across the whole trace. A constant polynomial has degree 0, no matter what degree bound was declared for the worst case.
This is genuinely data-dependent: the same AIR, run against a program that does touch all four registers, would show a different actual-degree profile. There's no single declared bound that would exactly match every possible program's real degree — some programs will always make some constraints degenerate.
Why this isn't a soundness bug
STARK soundness only requires the declared degree to be an upper bound on the true degree — not an exact match. A constraint that's actually degree 0 but declared as degree 4 is still correctly bounded; the extra declared degree just means slightly more blowup than strictly necessary, not a gap a malicious prover can exploit. Winterfell's debug-only validate_transition_degrees check enforces exact equality, which is strictly stronger than soundness requires — useful as a sanity check for typical AIRs where declared and actual degree usually do match, but a false positive for one like this where the true degree is legitimately data-dependent.
--release compiles that specific debug assertion out. Every test in this workspace passes either way once it's skipped — the tests aren't hiding a failure, they're avoiding a diagnostic that doesn't apply to this AIR's shape.
What we did, and didn't do, about it
We didn't force-fix this by restructuring the constraints to always hit their declared degree — the only way to do that would be adding a term specifically to make the "worst case" always occur, which is extra complexity motivated by a debug-mode diagnostic, not by any real cryptographic need, and carries its own risk of introducing an actual bug into a soundness-critical file. We also didn't quietly rely on --release without explaining why — this reproduction, with the exact numbers, is the documentation of that decision.
The honest state: this is upstream-worthy as a minimal reproduction if anyone wants to raise it with Winterfell directly, and this project runs its real test suite, CI included, under --release — which is a positive claim about how this codebase is tested, made precisely rather than glossed over.