Every capability below is labeled IMPLEMENTED, ROADMAP, or RESEARCH -- the same three-state discipline the rest of this project's docs use. Nothing here is aspirational copy dressed as a shipped feature.
Prove a specific program executed correctly. The verifier re-executes it itself, so there is no secret witness standing behind the proof.
Every column but the accumulator and registers is asserted directly (as a boundary constraint) against the specific program and its actual execution, for every row. The verifier already knows the correct value because it re-executed the program -- see the Architecture page for the full argument.
Built with Winterfell. FRI-based, transparent -- no trusted setup ceremony.
zkvm-stark::prove_program and verify_program wrap Winterfell's prover/verifier. Real proof, ~11 KB, ~5.5ms to verify on the reference workload.
Program and inputs are fully public. Branch outcomes and register accesses are asserted directly, not derived through an algebraic gadget.
No lookup argument, no permutation check, no auxiliary trace segment. Nine boundary assertions per row plus two transition-constraint shapes (accumulator, register) is the entire AIR.
A designated attester signs off on a proof verified off-chain. A documented trust bridge, not a cryptographic on-chain STARK check.
AttestedVerifier.sol checks an ECDSA signature from one designated attester key over the claimed proof result -- not the STARK proof itself. 8 Foundry tests cover the access-control and state-machine surface.
Body-size limits, request timeouts, concurrency caps, and a benchmarked 2,000-instruction ceiling -- proving time grows worse than linearly past that.
1 MB body limit, 60s timeout, 4 concurrent requests, and a 2,000-instruction cap derived from real measurements (1,000 instr. ≈ 1.2s, 2,000 ≈ 6.0s, 4,000 ≈ 32.0s).
prove and verify exposed as real MCP tools, verified with an actual initialize → tools/list → tools/call handshake.
Runs on its own port (4478) rather than nested onto the HTTP API -- rmcp's StreamableHttpService response type doesn't line up with axum::Router::nest_service without an adapter layer.
Backward jumps and dynamic memory addressing -- the next two items in the real engineering roadmap, not yet built.
JZ/JNZ can only jump forward today, and LOAD/STORE address one of four fixed registers, not dynamic memory. Both are named, scoped gaps in docs/ROADMAP.md, not silent omissions.
A standard RISC-V subset instead of the custom .zkasm ISA -- researched direction, not started.
Listed after loops and addressable memory in the real roadmap ordering.
The only path to a trustless on-chain verifier for this specific AIR -- a literature-review scope, not an implementation.
docs/RECURSION.md is a review of what recursive STARK compression would require for this AIR specifically. Nothing here is inherited for free from another prover's recursion pipeline.