Appendix: Action Circuit Polynomial Constraints
This appendix lists the 193 polynomial constraints of the Orchard Action circuit at orchard 0.13.1. Each polynomial vanishes on every valid assignment: .
Provenance. The polynomials are extracted from the
src/circuit_description
dump (a serialisation of
halo2_proofs::plonk::PinnedVerificationKey) by the
gates-to-latex
tool that ships in this repo. To regenerate after an upstream
change, run make appendix-gates from the onboarding/
directory; the tool re-reads the vendored copy at
onboarding/data/orchard-0.13.1-circuit_description.txt.
Notation. The advice, fixed, and instance columns are
indexed by their column_index in the constraint system:
- , , : advice column at the current row, rotated by or .
- , , : fixed column at the
current row or a rotation. The pinned circuit uses 29 fixed
columns; the lowest indices are the selector-promotion
columns produced by Halo 2's
compress_selectorspass, and the higher indices carry the chip-level constants used by the ECC, Sinsemilla, and Poseidon chips. - Constants are rendered in hex. Values below
0xffffare shown in full; larger values are truncated to a six-hex-digit head followed by\ldotsto keep KaTeX expressions readable.
Grouping. Halo 2's compress_selectors pass packs every
meta.create_gate(...) group into a single shared fixed column
by giving the column a small integer value per gate member.
That value selects the member through an envelope of the form
. Two
polynomials that share the same envelope column therefore
come from the same source-level create_gate call. We use
as the group key and list polynomials per group; the
source-level chip that owns each group can be identified by
opening src/circuit.rs and reading the chip-configuration
calls in Circuit::configure in order. Polynomials that do
not match the envelope pattern are listed under "Ungrouped".
Scope. This is the raw polynomial form, not yet annotated
with chip-level meaning. Phase 2 of this work would attach a
source-level chip name to each group (ECC, Sinsemilla,
Poseidon, Merkle, CommitIvk, NoteCommit). Doing so cleanly
requires upstream changes in halo2_proofs to expose gate
names; the pinned dump deliberately strips them.
Summary
| Envelope column | Polynomials in group | Original indices |
|---|---|---|
| 2 | 87, 88 | |
| 2 | 97, 98 | |
| 17 | 1, 2, 3, 4, 5, 6, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34 | |
| 17 | 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22,,... | |
| 18 | 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, ,... | |
| 18 | 53, 54, 55, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, ,... | |
| 4 | 56, 57, 58, 59 | |
| 4 | 60, 61, 62, 63 | |
| 11 | 79, 80, 81, 82, 83, 84, 85, 86, 89, 90, 91 | |
| 26 | 92, 93, 94, 95, 96, 106, 107, 108, 109, 110, 111, 112, 113, ,... | |
| 21 | 99, 100, 101, 102, 103, 104, 105, 127, 128, 129, 130, 131, 1,... | |
| 25 | 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, ,... | |
| 28 | 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, ,... |