fix(common): reject FIELD_IDs whose .np magic aliases another format

`np_format` derives the `.np` magic by offsetting the final byte with
`FIELD_ID`, which reserves all 256 values of that byte for `.np`. Nothing
recorded or enforced that reservation. Assert it at compile time against the
other three format constants, so a field whose magic would collide is a build
error rather than a file one reader silently accepts as another.

Offsetting one byte is a bijection on `u8`, so distinct ids always give distinct
magics and no field can collide with another. What `np_format` cannot see,
working one field at a time, is two backends declaring the same `FIELD_ID`.
`field_tags.rs` is the only place all three fields are in scope together, so it
asserts the ids and magics are pairwise unique. Reading `FORMAT` there also
const-evaluates the new assert for the non-bn254 fields, which nothing else in
the workspace does.

Author: BornPsych

provekit/common/src/whir_r1cs.rs

@@ -259,13 +259,45 @@ pub struct ProvekitProof<P: ProofField> {
     pub whir_r1cs_proof: WhirR1CSProof,
 }
 
+/// Formats whose magic `.np` must never alias.
+#[cfg(not(target_arch = "wasm32"))]
+const NON_NP_FORMATS: [[u8; 8]; 3] = [
+    binary_format::PROVER_FORMAT,
+    binary_format::VERIFIER_FORMAT,
+    binary_format::NOIR_PROOF_SCHEME_FORMAT,
+];
+
+#[cfg(not(target_arch = "wasm32"))]
+const fn formats_eq(a: [u8; 8], b: [u8; 8]) -> bool {
+    let mut i = 0;
+    while i < 8 {
+        if a[i] != b[i] {
+            return false;
+        }
+        i += 1;
+    }
+    true
+}
+
 /// Derive the `.np` format magic from [`ProofField::FIELD_ID`] by offsetting
 /// the final magic byte: bn254 (id 0) keeps the historical magic, other fields
 /// a distinct one.
+///
+/// The offset is a bijection on `u8`, so distinct ids always yield distinct
+/// magics — at the cost of reserving all 256 values of the final byte.
 #[cfg(not(target_arch = "wasm32"))]
 const fn np_format(field_id: u8) -> [u8; 8] {
     let mut f = binary_format::NOIR_PROOF_FORMAT;
     f[7] = f[7].wrapping_add(field_id);
+
+    let mut i = 0;
+    while i < NON_NP_FORMATS.len() {
+        assert!(
+            !formats_eq(f, NON_NP_FORMATS[i]),
+            "FIELD_ID makes the `.np` magic collide with another ProveKit file format"
+        );
+        i += 1;
+    }
     f
 }
 
@@ -286,13 +318,26 @@ impl<P: ProofField> MaybeHashAware for ProvekitProof<P> {
 
 #[cfg(all(test, not(target_arch = "wasm32")))]
 mod tests {
-    use super::{binary_format, np_format};
+    use {
+        super::{binary_format, np_format, NON_NP_FORMATS},
+        std::collections::HashSet,
+    };
 
     #[test]
-    fn np_format_preserves_bn254_and_distinguishes_fields() {
+    fn np_format_preserves_bn254() {
         assert_eq!(np_format(0), binary_format::NOIR_PROOF_FORMAT);
-        assert_ne!(np_format(1), np_format(0));
-        assert_ne!(np_format(2), np_format(0));
-        assert_ne!(np_format(2), np_format(1));
+    }
+
+    #[test]
+    fn np_format_is_collision_free_over_every_field_id() {
+        let magics: HashSet<[u8; 8]> = (0..=u8::MAX).map(np_format).collect();
+        assert_eq!(magics.len(), 256, "FIELD_ID -> magic must be injective");
+        for other in NON_NP_FORMATS {
+            assert!(
+                !magics.contains(&other),
+                "`.np` magic space collides with {:?}",
+                std::str::from_utf8(&other)
+            );
+        }
     }
 }

tooling/provekit-fixtures/tests/field_tags.rs

@@ -0,0 +1,36 @@
+//! Every proof field must carry a distinct `FIELD_ID` and `.np` magic, so one
+//! field's proof is rejected by another field's verifier.
+//!
+//! `np_format` sees one field at a time, so only a place with every backend in
+//! scope can catch two of them declaring the same `FIELD_ID`. Reading `FORMAT`
+//! here is also what const-evaluates `np_format`'s collision assert for the
+//! non-bn254 fields — nothing else in the workspace does.
+
+use {
+    provekit_backend_bn254::Bn254Field,
+    provekit_backend_goldilocks::{GoldilocksEfField, GoldilocksField},
+    provekit_common::{file::FileFormat, ProofField, ProvekitProof},
+    std::collections::HashSet,
+};
+
+#[test]
+fn field_tags_are_unique() {
+    fn tag<P: ProofField>(name: &'static str) -> (&'static str, u8, [u8; 8]) {
+        (name, P::FIELD_ID, <ProvekitProof<P> as FileFormat>::FORMAT)
+    }
+    let tags = [
+        tag::<Bn254Field>("Bn254Field"),
+        tag::<GoldilocksField>("GoldilocksField"),
+        tag::<GoldilocksEfField>("GoldilocksEfField"),
+    ];
+
+    let ids: HashSet<u8> = tags.iter().map(|&(_, id, _)| id).collect();
+    let magics: HashSet<[u8; 8]> = tags.iter().map(|&(_, _, magic)| magic).collect();
+    let named: Vec<_> = tags
+        .iter()
+        .map(|&(name, id, magic)| (name, id, String::from_utf8_lossy(&magic).into_owned()))
+        .collect();
+
+    assert_eq!(ids.len(), tags.len(), "FIELD_ID collision: {named:?}");
+    assert_eq!(magics.len(), tags.len(), "`.np` magic collision: {named:?}");
+}