feat: per-block L1-to-L2 message bundles, move parity to checkpoint root (A-1374)

Implements AZIP-22 Fast Inbox FI-04. Parity verification moves from the block-root
variants to the checkpoint root. Every block-root variant now takes a per-block message
bundle (l1_to_l2_messages, num_msgs, frontier hint) that appends to the L1-to-L2 tree via
append_leaves_to_snapshot and absorbs the same leaves into an L1ToL2MessageSponge threaded
across the checkpoint's blocks. BlockRollupPublicInputs replaces in_hash and the FI-03
inbox_rolling_hash pair with an explicit is_first_block flag and start/end message sponges.
The checkpoint root gains the parity-root proof, asserts sponge continuity and that the
merged block sponge equals the parity sponge, and sources the header's legacy in_hash and
inbox_rolling_hash from parity. Transitionally the first block carries the whole checkpoint's
messages padded to 1024 with num_msgs=1024; non-first blocks carry empty bundles. Behavior
stays bit-identical to the current state (same tree roots, same header bytes).

Author: spalladino

barretenberg/cpp/src/barretenberg/aztec/aztec_constants.hpp

@@ -244,8 +244,7 @@
 #define AVM_EMITPUBLICLOG_DYN_DA_GAS 32
 #define AVM_SSTORE_DYN_DA_GAS 64
 #define AVM_WRITTEN_PUBLIC_DATA_SLOTS_TREE_HEIGHT 6
-#define AVM_WRITTEN_PUBLIC_DATA_SLOTS_TREE_INITIAL_ROOT                                                                \
-    "0x13954b76f8ab76c38ab687731f802fc90e5d55e0592fa6f56d0a73024b3f8356"
+#define AVM_WRITTEN_PUBLIC_DATA_SLOTS_TREE_INITIAL_ROOT "0x13954b76f8ab76c38ab687731f802fc90e5d55e0592fa6f56d0a73024b3f8356"
 #define AVM_WRITTEN_PUBLIC_DATA_SLOTS_TREE_INITIAL_SIZE 1
 #define AVM_RETRIEVED_BYTECODES_TREE_HEIGHT 5
 #define AVM_RETRIEVED_BYTECODES_TREE_INITIAL_ROOT "0x0ff65ad321f05745d4c80e2e18e94241093d2e49017ff8cc151df4f207a43c12"

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/abis/block_rollup_public_inputs.nr

@@ -1,3 +1,4 @@
+use crate::abis::L1ToL2MessageSponge;
 use protocol_test_utils::make_fixture;
 use types::{
     abis::{
@@ -39,17 +40,19 @@ pub struct BlockRollupPublicInputs {
     // stored in the checkpoint header, enabling validation of the blocks included in a checkpoint given their headers.
     pub block_headers_hash: Field,
 
-    // Root of the `l1_to_l2` message subtree, set in the first block root and propagated to the checkpoint root.
-    // Block root rollups that are not the first in a checkpoint will have an `in_hash` value of 0.
-    pub in_hash: Field,
-
-    // Inbox rolling-hash chain segment consumed by this block range, set in the first block root from the parity root
-    // and propagated to the checkpoint root exactly like `in_hash`: the first block root carries the checkpoint's
-    // `(start, end)`, non-first block roots carry `(0, 0)`, merges take the left rollup's pair, and
-    // `validate_consecutive_block_rollups` asserts the right rollup's pair is zero. Unlike `in_hash`, the value may
-    // legitimately be zero (genesis / empty checkpoint), so it is not asserted nonzero at the checkpoint root.
-    pub start_inbox_rolling_hash: Field,
-    pub end_inbox_rolling_hash: Field,
+    // Whether this block range starts at the first block of its checkpoint. Only the first block root sets this true;
+    // merges propagate it from the left rollup and `validate_consecutive_block_rollups` asserts the right rollup's is
+    // false, so it can only reach the checkpoint root through the leftmost leaf. It replaces `in_hash`'s former
+    // structural role: the checkpoint root asserts the merged value is true, and it drives the block-end blob-absorb
+    // flag (the l1-to-l2 tree root is absorbed only for the first block).
+    pub is_first_block: bool,
+
+    // Poseidon2 message-bundle sponge threaded across the blocks of the checkpoint. The leftmost block starts from the
+    // empty sponge and each block absorbs its bundle's leaves; `validate_consecutive_block_rollups` asserts
+    // `right.start_msg_sponge == left.end_msg_sponge`, and merges take `start` from the left and `end` from the right.
+    // The checkpoint root asserts the merged end equals the parity root's sponge over the same (padded) leaf list.
+    pub start_msg_sponge: L1ToL2MessageSponge,
+    pub end_msg_sponge: L1ToL2MessageSponge,
 
     // Root of the *wonky* tree composed of all tx out hashes in this block. It will be combined with the `out_hash`
     // values from other blocks within the same checkpoint to form a *wonky* tree.

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/abis/mod.nr

@@ -1,11 +1,13 @@
 // TODO: Move to types/src/abis/rollup/
+// `l1_to_l2_message_sponge` is declared first because the serde `#[derive(...)]` macro requires a field type's module
+// to be declared before any struct that embeds it (see the ordering note in `types/src/lib.nr`).
+mod l1_to_l2_message_sponge;
 mod public_chonk_verifier_public_inputs;
 mod tx_rollup_public_inputs;
 mod block_rollup_public_inputs;
 mod parity_public_inputs;
 mod checkpoint_rollup_public_inputs;
 mod root_rollup_public_inputs;
-mod l1_to_l2_message_sponge;
 
 pub use block_rollup_public_inputs::BlockRollupPublicInputs;
 pub use checkpoint_rollup_public_inputs::CheckpointRollupPublicInputs;

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/abis/parity_public_inputs.nr

@@ -1,3 +1,4 @@
+use crate::abis::L1ToL2MessageSponge;
 use types::traits::{Deserialize, Empty, Serialize};
 
 #[derive(Deserialize, Eq, Serialize)]
@@ -9,6 +10,13 @@ pub struct ParityPublicInputs {
     // Rolling hash of the Inbox message chain after absorbing the `num_msgs` real messages in this batch. Each link is
     // `sha256ToField(prev || msg)`, matching the truncated-to-field sha256 the L1 Inbox accumulates.
     pub end_rolling_hash: Field,
+    // Poseidon2 message-bundle sponge before absorbing this batch of leaves. Threaded across the four base parity
+    // segments the same way as the rolling hash, so each segment's start equals the previous segment's end.
+    pub start_sponge: L1ToL2MessageSponge,
+    // Message-bundle sponge after absorbing the full (padded) batch of leaves. Unlike the rolling hash, the sponge
+    // absorbs every leaf inserted into the L1-to-L2 tree, including padding zeros (AZIP-22 transitional asymmetry). The
+    // checkpoint root asserts this equals the sponge accumulated across the checkpoint's block roots.
+    pub end_sponge: L1ToL2MessageSponge,
     // Number of real (non-padding) messages absorbed into the rolling hash by this batch.
     pub num_msgs: u32,
     pub vk_tree_root: Field,
@@ -22,6 +30,8 @@ impl Empty for ParityPublicInputs {
             converted_root: 0,
             start_rolling_hash: 0,
             end_rolling_hash: 0,
+            start_sponge: L1ToL2MessageSponge::empty(),
+            end_sponge: L1ToL2MessageSponge::empty(),
             num_msgs: 0,
             vk_tree_root: 0,
             prover_id: 0,

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_merge/tests/consecutive_block_rollups_tests.nr

@@ -1,5 +1,7 @@
 use super::TestBuilder;
-use types::{address::EthAddress, hash::accumulate_sha256};
+use types::{
+    address::EthAddress, constants::BLOCK_ROOT_ROLLUP_VK_INDEX, hash::accumulate_sha256,
+};
 
 #[test]
 fn accumulated_out_hash_correctly() {
@@ -54,45 +56,53 @@ fn output_zero_when_both_out_hashes_are_zero() {
 }
 
 #[test]
-fn non_zero_in_hash_in_left_rollup() {
+fn first_block_in_left_rollup() {
+    // The default builder has a first block root on the left and a non-first block on the right.
     let mut builder = TestBuilder::default();
 
-    builder.left_rollup.in_hash = 123;
-
     let pi = builder.execute();
     builder.assert_expected_public_inputs(pi);
 
-    assert_eq(pi.in_hash, 123);
+    assert(pi.is_first_block);
 }
 
 #[test]
-fn zero_in_hash_in_both_rollups() {
-    let mut builder = TestBuilder::default();
-
-    builder.left_rollup.in_hash = 0;
-    builder.right_rollup.in_hash = 0;
+fn no_first_block_in_either_rollup() {
+    // A merge of two non-first blocks in the middle of a checkpoint carries no first block.
+    let mut builder =
+        TestBuilder::new(BLOCK_ROOT_ROLLUP_VK_INDEX, 1, BLOCK_ROOT_ROLLUP_VK_INDEX, 1);
 
     let pi = builder.execute();
     builder.assert_expected_public_inputs(pi);
 
-    assert_eq(pi.in_hash, 0);
+    assert(!pi.is_first_block);
+}
+
+#[test(should_fail_with = "Right rollup must not be a first block")]
+fn first_block_in_right_rollup() {
+    let mut builder = TestBuilder::default();
+
+    builder.right_rollup.is_first_block = true;
+
+    builder.execute_and_fail();
 }
 
-#[test(should_fail_with = "Right rollup must not carry in_hash")]
-fn non_zero_in_hash_in_right_rollup() {
+#[test(should_fail_with = "Right rollup must not be a first block")]
+fn first_block_in_both_rollups() {
     let mut builder = TestBuilder::default();
 
-    builder.right_rollup.in_hash = 123;
+    builder.left_rollup.is_first_block = true;
+    builder.right_rollup.is_first_block = true;
 
     builder.execute_and_fail();
 }
 
-#[test(should_fail_with = "Right rollup must not carry in_hash")]
-fn non_zero_in_hash_in_both_rollups() {
+#[test(should_fail_with = "Mismatched message sponge: expected right.start_msg_sponge to match left.end_msg_sponge")]
+fn mismatched_message_sponge_fails() {
     let mut builder = TestBuilder::default();
 
-    builder.left_rollup.in_hash = 123;
-    builder.right_rollup.in_hash = 123;
+    // Break the sponge continuity between the left and right rollups.
+    builder.right_rollup.start_msg_sponge.num_absorbed += 1;
 
     builder.execute_and_fail();
 }

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_merge/tests/mod.nr

@@ -58,8 +58,8 @@ impl TestBuilder {
 
         if !is_first_block(left_rollup_vk_index)
             & (left_rollup_vk_index != BLOCK_MERGE_ROLLUP_VK_INDEX) {
-            // Change the start_block_number to be smaller than the left rollup's start_block_number so that the in_hash
-            // won't be set on the left rollup.
+            // Change the start_block_number to be smaller than the left rollup's start_block_number so that
+            // `is_first_block` won't be set on the left rollup.
             fixture_builder.start_block_number = start_block_number - 1;
         }
         let left_rollup = fixture_builder.get_merged_block_rollup_public_inputs(
@@ -68,8 +68,8 @@ impl TestBuilder {
         );
 
         if is_first_block(right_rollup_vk_index) {
-            // Change the start_block_number to be the right rollup's start_block_number so that the in_hash will be set
-            // on the right rollup.
+            // Change the start_block_number to be the right rollup's start_block_number so that `is_first_block` will be
+            // set on the right rollup.
             fixture_builder.start_block_number = start_block_number + num_left_blocks as u32;
         }
         let right_rollup = fixture_builder.get_merged_block_rollup_public_inputs(
@@ -143,10 +143,11 @@ impl TestBuilder {
             accumulate_block_headers_hash(left.block_headers_hash, right.block_headers_hash);
         assert_eq(pi.block_headers_hash, expected_block_headers_hash);
 
-        assert_eq(pi.in_hash, left.in_hash);
-
-        assert_eq(pi.start_inbox_rolling_hash, left.start_inbox_rolling_hash);
-        assert_eq(pi.end_inbox_rolling_hash, left.end_inbox_rolling_hash);
+        // `is_first_block` and the start of the message sponge come from the left rollup; the sponge end comes from the
+        // right rollup.
+        assert_eq(pi.is_first_block, left.is_first_block);
+        assert_eq(pi.start_msg_sponge, left.start_msg_sponge);
+        assert_eq(pi.end_msg_sponge, right.end_msg_sponge);
 
         let expected_out_hash = if (left.out_hash != 0) & (right.out_hash != 0) {
             accumulate_sha256(left.out_hash, right.out_hash)

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_merge/utils/merge_block_rollups.nr

@@ -16,14 +16,15 @@ pub fn merge_block_rollups(
     let block_headers_hash =
         accumulate_block_headers_hash(left.block_headers_hash, right.block_headers_hash);
 
-    // `in_hash` originates from the first block root and must propagate through all merge steps via the left rollup
-    // only. It's checked in `validate_consecutive_block_rollups` to make sure only the left rollup carries it.
-    let in_hash = left.in_hash;
+    // `is_first_block` originates from the first block root and must propagate through all merge steps via the left
+    // rollup only. `validate_consecutive_block_rollups` asserts the right rollup's is false, so only the leftmost leaf
+    // can carry it up to the checkpoint root.
+    let is_first_block = left.is_first_block;
 
-    // The inbox rolling-hash pair propagates the same way: the first block root carries the checkpoint's `(start, end)`,
-    // so we take the left rollup's pair. `validate_consecutive_block_rollups` asserts the right rollup's pair is zero.
-    let start_inbox_rolling_hash = left.start_inbox_rolling_hash;
-    let end_inbox_rolling_hash = left.end_inbox_rolling_hash;
+    // The message sponge threads across the checkpoint's blocks: the range spans left's start through right's end.
+    // `validate_consecutive_block_rollups` asserts `right.start_msg_sponge == left.end_msg_sponge` for continuity.
+    let start_msg_sponge = left.start_msg_sponge;
+    let end_msg_sponge = right.end_msg_sponge;
 
     let out_hash = accumulate_out_hash(left.out_hash, right.out_hash);
 
@@ -41,9 +42,9 @@ pub fn merge_block_rollups(
         end_sponge_blob: right.end_sponge_blob,
         timestamp: left.timestamp, // Both blocks have the same timestamp.
         block_headers_hash,
-        in_hash,
-        start_inbox_rolling_hash,
-        end_inbox_rolling_hash,
+        is_first_block,
+        start_msg_sponge,
+        end_msg_sponge,
         out_hash,
         accumulated_fees,
         accumulated_mana_used,

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_merge/utils/validate_consecutive_block_rollups.nr

@@ -44,19 +44,17 @@ fn assert_prev_block_rollups_follow_on_from_each_other(
 
     // TODO: Consider extracting into its own function:
 
-    // A non-empty `in_hash` originates from the first block root only, and is propagated through all merge
-    // steps via the left rollup only (see merge_block_rollups.nr).
-    // We prevent the right rollup from propagating a nonzero `in_hash`, so it's impossible for any
-    // block but the first to propagate a nonzero `in_hash` up to the checkpoint root.
-    assert_eq(right.in_hash, 0, "Right rollup must not carry in_hash");
-
-    // The inbox rolling-hash pair follows the same rule: only the first block root (which becomes the leftmost leaf)
-    // may carry it, so the right rollup's pair must always be zero. The first block's nonzero `in_hash` already pins it
-    // as the leftmost leaf, so the rolling hash rides along on the same block even when its value is legitimately zero.
+    // `is_first_block` originates from the first block root only, and is propagated through all merge steps via the
+    // left rollup only (see merge_block_rollups.nr). We prevent the right rollup from carrying it, so it's impossible
+    // for any block but the first to propagate `is_first_block == true` up to the checkpoint root.
+    assert(!right.is_first_block, "Right rollup must not be a first block");
+
+    // The message sponge threads across the checkpoint's blocks: the right rollup must start from where the left rollup
+    // ended. Combined with the checkpoint root asserting the leftmost start is empty and the merged end matches the
+    // parity root's sponge, this pins the blocks to insert exactly the parity-committed message list, in order.
     assert_eq(
-        right.start_inbox_rolling_hash,
-        0,
-        "Right rollup must not carry start_inbox_rolling_hash",
+        right.start_msg_sponge,
+        left.end_msg_sponge,
+        "Mismatched message sponge: expected right.start_msg_sponge to match left.end_msg_sponge",
     );
-    assert_eq(right.end_inbox_rolling_hash, 0, "Right rollup must not carry end_inbox_rolling_hash");
 }

noir-projects/noir-protocol-circuits/crates/rollup-lib/src/block_root/block_root_empty_tx_first_rollup.nr

@@ -1,19 +1,16 @@
 use crate::{
-    abis::{BlockRollupPublicInputs, ParityPublicInputs},
-    block_root::components::{BlockRollupPublicInputsComposer, validate_parity_root},
+    abis::{BlockRollupPublicInputs, L1ToL2MessageSponge},
+    block_root::components::BlockRollupPublicInputsComposer,
 };
 use types::{
     abis::{
         append_only_tree_snapshot::AppendOnlyTreeSnapshot,
         checkpoint_constant_data::CheckpointConstantData, state_reference::StateReference,
     },
-    constants::{ARCHIVE_HEIGHT, L1_TO_L2_MSG_SUBTREE_ROOT_SIBLING_PATH_LENGTH},
-    proof::proof_data::UltraHonkProofData,
+    constants::{ARCHIVE_HEIGHT, L1_TO_L2_MSG_TREE_HEIGHT, MAX_L1_TO_L2_MSGS_PER_BLOCK},
 };
 
 pub struct BlockRootEmptyTxFirstRollupPrivateInputs {
-    pub(crate) parity_root: UltraHonkProofData<ParityPublicInputs>,
-
     pub(crate) previous_archive: AppendOnlyTreeSnapshot,
     pub(crate) previous_state: StateReference,
     // The previous block is not in the same checkpoint as the current block. So we need to provide the constants for
@@ -23,19 +20,22 @@ pub struct BlockRootEmptyTxFirstRollupPrivateInputs {
     // timestamp in the checkpoint root.
     pub(crate) timestamp: u64,
 
-    // Hint for inserting the new l1 to l2 message subtree.
-    pub(crate) new_l1_to_l2_message_subtree_root_sibling_path: [Field; L1_TO_L2_MSG_SUBTREE_ROOT_SIBLING_PATH_LENGTH],
+    // L1-to-L2 messages inserted by this block, padded with zeros beyond `num_msgs`.
+    pub(crate) l1_to_l2_messages: [Field; MAX_L1_TO_L2_MSGS_PER_BLOCK],
+    // Number of real (non-padding) leaves in `l1_to_l2_messages`.
+    pub(crate) num_msgs: u32,
+    // Frontier hint for appending the bundle to the l1-to-l2 message tree (validated against `previous_state`).
+    pub(crate) l1_to_l2_message_frontier_hint: [Field; L1_TO_L2_MSG_TREE_HEIGHT],
     // Hint for inserting the new block hash to the last archive.
     pub(crate) new_archive_sibling_path: [Field; ARCHIVE_HEIGHT],
 }
 
 /// The Block Root Empty Tx First Rollup circuit creates the first empty block of a checkpoint.
-/// It processes L1-to-L2 messages and creates the block header.
+/// It inserts the block's L1-to-L2 message bundle and creates the block header.
 /// This variant is used for the first block in a checkpoint that contains no transactions.
 ///
 /// This circuit:
-/// - Verifies the parity root proof containing L1-to-L2 messages for the checkpoint
-/// - Inserts the L1-to-L2 message subtree into the L1-to-L2 message tree
+/// - Appends the block's L1-to-L2 message bundle to the L1-to-L2 message tree and absorbs it into the message sponge
 /// - Initializes an empty sponge blob (since it's the first block in a checkpoint)
 /// - Computes the block header hash and inserts it into the archive tree
 ///
@@ -44,21 +44,19 @@ pub struct BlockRootEmptyTxFirstRollupPrivateInputs {
 ///
 /// VkIndex: BLOCK_ROOT_EMPTY_TX_FIRST_ROLLUP_VK_INDEX
 pub fn execute(inputs: BlockRootEmptyTxFirstRollupPrivateInputs) -> BlockRollupPublicInputs {
-    validate_parity_root(
-        inputs.parity_root,
-        inputs.constants.vk_tree_root,
-        inputs.constants.prover_id,
-    );
-
     BlockRollupPublicInputsComposer::new_from_no_rollups(
         inputs.previous_archive,
         inputs.previous_state,
         inputs.constants,
         inputs.timestamp,
     )
-        .with_new_l1_to_l2_messages(
-            inputs.parity_root.public_inputs,
-            inputs.new_l1_to_l2_message_subtree_root_sibling_path,
+        .with_message_bundle(
+            true,
+            inputs.previous_state.l1_to_l2_message_tree,
+            L1ToL2MessageSponge::new(),
+            inputs.l1_to_l2_messages,
+            inputs.num_msgs,
+            inputs.l1_to_l2_message_frontier_hint,
         )
         .finish(inputs.new_archive_sibling_path)
 }