fix(prover): cover L2G binding rejection, dedupe ELF re-parse in continuation verify

- Add tests that splice a different run's global proof onto valid epochs
  (same shape, different L2G data) so verify_l2g_commitment_binding_view's
  own reject branch actually executes, both for the owned and archived
  verify paths. The existing tampered-root tests were caught earlier by
  verify_epoch's per-epoch root check and never reached this binding.
- Thread entry_point out of verify_continuation_archived so
  verify_continuation_and_attest can fold program_id via
  program_id_from_digest instead of re-parsing the ELF with
  program_id_from_elf.
- Extract access_recursion_archive, sharing the aligned-fallback +
  rkyv::access boilerplate between verify_recursion_blob and
  verify_continuation_and_attest.

Author: Oppen

prover/src/continuation.rs

@@ -1179,27 +1179,31 @@ pub fn verify_continuation_with_roots(
     decode_commitment: Option<Commitment>,
     page_genesis_commitments: Option<&[(u64, Commitment)]>,
 ) -> Result<Option<Vec<u8>>, Error> {
-    verify_continuation_view(
+    let result = verify_continuation_view(
         ContinuationProofView::Owned(bundle),
         elf_bytes,
         opts,
         decode_commitment,
         page_genesis_commitments,
-    )
+    )?;
+    Ok(result.map(|(public_output, _entry_point)| public_output))
 }
 
 /// [`verify_continuation_with_roots`]'s zero-copy counterpart, for the
 /// recursion `continuation` guest: reads every per-epoch/global proof in
 /// place via [`ContinuationProofView::Archived`] instead of deserializing an
 /// owned [`MultiProof`]. Only small per-epoch metadata is materialized. Roots
 /// are always supplied here (the guest never recomputes from the ELF in-VM).
+///
+/// Also returns `entry_point` so callers can fold a `program_id` via
+/// [`crate::recursion::program_id_from_digest`] without a second `Elf::load`.
 pub(crate) fn verify_continuation_archived(
     archived: &ArchivedContinuationProof,
     elf_bytes: &[u8],
     opts: &ProofOptions,
     decode_commitment: Commitment,
     page_genesis_commitments: &[(u64, Commitment)],
-) -> Result<Option<Vec<u8>>, Error> {
+) -> Result<Option<(Vec<u8>, u64)>, Error> {
     verify_continuation_view(
         ContinuationProofView::Archived(archived),
         elf_bytes,
@@ -1213,13 +1217,14 @@ pub(crate) fn verify_continuation_archived(
 /// [`verify_continuation_archived`] (archived), operating on a
 /// [`ContinuationProofView`] rather than either's concrete type — the same
 /// split [`crate::verify_recursion_blob`] uses for the monolithic path.
+/// Returns the public output plus `entry_point` (see [`verify_continuation_archived`]).
 fn verify_continuation_view(
     bundle: ContinuationProofView<'_>,
     elf_bytes: &[u8],
     opts: &ProofOptions,
     decode_commitment: Option<Commitment>,
     page_genesis_commitments: Option<&[(u64, Commitment)]>,
-) -> Result<Option<Vec<u8>>, Error> {
+) -> Result<Option<(Vec<u8>, u64)>, Error> {
     // Bound the claimed private-input page count before using it to size/allocate AIRs
     // (mirrors `verify_with_options`). The count is also bound into the global proof's
     // Fiat-Shamir statement (`absorb_continuation_global_statement`), so any wrong value
@@ -1342,7 +1347,7 @@ fn verify_continuation_view(
         return Ok(None);
     }
 
-    Ok(Some(public_output))
+    Ok(Some((public_output, elf.entry_point)))
 }
 
 /// Precompute the ELF-derived roots [`verify_continuation_with_roots`] accepts:
@@ -2153,10 +2158,11 @@ mod tests {
         );
     }
 
-    // Negative: corrupting an epoch's claimed L2G table root must be rejected —
-    // `verify_l2g_commitment_binding_view` compares each epoch's `l2g_root` against the
-    // corresponding sub-proof root in the global proof, so a mismatched root causes
-    // the binding to fail. Guards the L2G root↔global commitment binding.
+    // Negative: corrupting an epoch's claimed L2G table root must be rejected. This
+    // tamper is caught by `verify_epoch`'s own root-consistency check (the epoch's
+    // claimed `l2g_root` no longer matches what its own proof committed) before the
+    // cross-epoch `verify_l2g_commitment_binding_view` ever runs — see
+    // `test_split_verify_rejects_global_proof_from_a_different_run` for that.
     #[test]
     fn test_split_verify_rejects_tampered_l2g_root() {
         let _ = env_logger::builder().is_test(true).try_init();
@@ -2177,9 +2183,8 @@ mod tests {
 
     // Same tamper as `test_split_verify_rejects_tampered_l2g_root`, but through the
     // zero-copy blob path (`verify_continuation_and_attest`) rather than
-    // `verify_continuation`. Guards `verify_continuation_archived`'s view-based
-    // `verify_l2g_commitment_binding_view` against the same corruption its owned
-    // counterpart already catches.
+    // `verify_continuation`. Guards the archived path's per-epoch root check against
+    // the same corruption the owned path already catches.
     #[test]
     fn test_continuation_blob_rejects_tampered_l2g_root() {
         let _ = env_logger::builder().is_test(true).try_init();
@@ -2209,4 +2214,91 @@ mod tests {
             "a tampered l2g_root must be rejected over the archived blob path too"
         );
     }
+
+    // Negative: `verify_l2g_commitment_binding_view`'s own reject branch, which the two
+    // tests above don't reach (they're caught earlier by `verify_epoch`'s per-epoch root
+    // check). Two bundles proved from the same ELF/epoch size with different
+    // same-length private inputs share every shape value (`n`, `table_counts`,
+    // `touched_page_bases`, `num_private_input_pages`) but commit different actual L2G
+    // data, so splicing one's `global` proof onto the other's epochs leaves every
+    // per-epoch check and `verify_global`'s own `multi_verify` passing (each half is
+    // independently valid for that exact shape) while the per-epoch claimed roots no
+    // longer match what the spliced-in global proof's L2G sub-tables actually commit.
+    #[test]
+    fn test_split_verify_rejects_global_proof_from_a_different_run() {
+        let _ = env_logger::builder().is_test(true).try_init();
+        let elf_bytes = asm_elf_bytes("test_private_input_xpage");
+        let opts = ProofOptions::default_test_options();
+
+        let input_a: Vec<u8> = (0u8..16).collect();
+        let input_b: Vec<u8> = (0u8..16).map(|b| b ^ 0xFF).collect();
+
+        let mut bundle_a = prove_continuation(&elf_bytes, &input_a, 2, &opts).unwrap();
+        let bundle_b = prove_continuation(&elf_bytes, &input_b, 2, &opts).unwrap();
+        assert!(
+            verify_continuation(&elf_bytes, &bundle_a, &opts)
+                .unwrap()
+                .is_some(),
+            "bundle_a must verify standalone before splicing"
+        );
+        assert!(
+            verify_continuation(&elf_bytes, &bundle_b, &opts)
+                .unwrap()
+                .is_some(),
+            "bundle_b must verify standalone before splicing"
+        );
+        assert_eq!(
+            bundle_a.epochs.len(),
+            bundle_b.epochs.len(),
+            "same ELF/epoch size/input length must yield the same epoch split"
+        );
+        assert_eq!(
+            bundle_a.touched_page_bases, bundle_b.touched_page_bases,
+            "same-length private inputs must touch the same pages"
+        );
+        assert_ne!(
+            bundle_a.epochs[0].l2g_root, bundle_b.epochs[0].l2g_root,
+            "different private-input bytes must commit different L2G data"
+        );
+
+        bundle_a.global = bundle_b.global;
+
+        assert!(
+            verify_continuation(&elf_bytes, &bundle_a, &opts)
+                .unwrap()
+                .is_none(),
+            "a global proof spliced in from a different run must be rejected"
+        );
+    }
+
+    // Same construction as `test_split_verify_rejects_global_proof_from_a_different_run`,
+    // but through the zero-copy blob path — guards
+    // `verify_l2g_commitment_binding_view`'s archived call site.
+    #[test]
+    fn test_continuation_blob_rejects_global_proof_from_a_different_run() {
+        let _ = env_logger::builder().is_test(true).try_init();
+        let elf_bytes = asm_elf_bytes("test_private_input_xpage");
+        let opts = crate::recursion::MIN_PROOF_OPTIONS;
+
+        let input_a: Vec<u8> = (0u8..16).collect();
+        let input_b: Vec<u8> = (0u8..16).map(|b| b ^ 0xFF).collect();
+
+        let mut bundle_a = prove_continuation(&elf_bytes, &input_a, 2, &opts).unwrap();
+        let bundle_b = prove_continuation(&elf_bytes, &input_b, 2, &opts).unwrap();
+        assert_eq!(bundle_a.epochs.len(), bundle_b.epochs.len());
+        assert_eq!(bundle_a.touched_page_bases, bundle_b.touched_page_bases);
+        assert_ne!(bundle_a.epochs[0].l2g_root, bundle_b.epochs[0].l2g_root);
+
+        bundle_a.global = bundle_b.global;
+
+        let blob =
+            crate::recursion::encode_continuation_guest_input(bundle_a, &elf_bytes, &opts)
+                .expect("encode_continuation_guest_input failed");
+        let result = crate::recursion::verify_continuation_and_attest(&blob, &opts)
+            .expect("verify_continuation_and_attest errored");
+        assert!(
+            result.is_none(),
+            "a global proof spliced in from a different run must be rejected over the archived blob path too"
+        );
+    }
 }

prover/src/lib.rs

@@ -267,6 +267,39 @@ pub fn recursion_archive_bytes(blob: &[u8]) -> Option<&[u8]> {
     Some(&blob[RECURSION_INPUT_PREFIX_LEN..])
 }
 
+/// Validate a recursion-input blob's wire prefix and bytecheck-validate its
+/// archive, in place. Shared by [`verify_recursion_blob`] and
+/// [`crate::recursion::verify_continuation_and_attest`].
+///
+/// Returns the archived value, the original (possibly-unaligned) archive
+/// bytes, and the base pointer `archived` reads from — callers rebasing
+/// zero-copy subslices back onto `blob` need that base.
+pub(crate) fn access_recursion_archive<'s, 'a: 's, T>(
+    blob: &'a [u8],
+    aligned_fallback: &'s mut rkyv::util::AlignedVec<RECURSION_INPUT_ALIGN>,
+) -> Result<(&'s T, &'a [u8], *const u8), Error>
+where
+    T: rkyv::Portable
+        + for<'b> rkyv::bytecheck::CheckBytes<rkyv::api::high::HighValidator<'b, rkyv::rancor::Error>>,
+{
+    let archive_bytes: &'a [u8] = recursion_archive_bytes(blob)
+        .ok_or_else(|| Error::Execution(String::from("recursion blob: bad magic or version")))?;
+
+    let archive: &'s [u8] = if (archive_bytes.as_ptr() as usize).is_multiple_of(RECURSION_INPUT_ALIGN)
+    {
+        archive_bytes
+    } else {
+        aligned_fallback.extend_from_slice(archive_bytes);
+        aligned_fallback
+    };
+    let archive_base = archive.as_ptr();
+
+    let archived: &'s T = rkyv::access::<T, rkyv::rancor::Error>(archive).map_err(|e| {
+        Error::Execution(format!("recursion blob: bytecheck validation failed: {e}"))
+    })?;
+    Ok((archived, archive_bytes, archive_base))
+}
+
 /// Result of a recursion-blob verification: the verdict plus the inner
 /// proof's committed public output (zero-copy from the blob), which the
 /// recursion guest folds into `program_id(...) ‖ public_output`.
@@ -310,31 +343,15 @@ pub fn verify_recursion_blob<'a>(
 ) -> Result<RecursionVerification<'a>, Error> {
     use rkyv::rancor::Error as RkyvError;
 
-    // Validate + strip the aligning magic/version prefix. In the guest the
-    // returned slice starts at the 16-aligned archive base (the prefix exists
-    // precisely so the archive lands aligned at
+    // In the guest the blob's archive starts at the 16-aligned archive base
+    // (the wire prefix exists precisely so the archive lands aligned at
     // `PRIVATE_INPUT_START + 4 + PREFIX_LEN`), so the in-place doubleword
-    // loads do not trap.
-    let archive_bytes = recursion_archive_bytes(blob)
-        .ok_or_else(|| Error::Execution(String::from("recursion blob: bad magic or version")))?;
-
-    // A host caller's buffer carries no alignment guarantee (`Vec<u8>` is
-    // align-1) — in-place access there would be UB. Fall back to one aligned
-    // copy when the base is misaligned; the guest path is aligned by
-    // construction and stays zero-copy.
-    let mut aligned_fallback = rkyv::util::AlignedVec::<{ RECURSION_INPUT_ALIGN }>::new();
-    let archive: &[u8] = if (archive_bytes.as_ptr() as usize).is_multiple_of(RECURSION_INPUT_ALIGN)
-    {
-        archive_bytes
-    } else {
-        aligned_fallback.extend_from_slice(archive_bytes);
-        &aligned_fallback
-    };
-
-    // `blob` is untrusted; validate before the zero-copy access.
-    let archived = rkyv::access::<ArchivedGuestInput, RkyvError>(archive).map_err(|e| {
-        Error::Execution(format!("recursion blob: bytecheck validation failed: {e}"))
-    })?;
+    // loads do not trap. A host caller's buffer carries no such guarantee
+    // (`Vec<u8>` is align-1), so `access_recursion_archive` falls back to one
+    // aligned copy in `aligned_fallback` when the base is misaligned.
+    let mut aligned_fallback = rkyv::util::AlignedVec::<RECURSION_INPUT_ALIGN>::new();
+    let (archived, archive_bytes, archive_base): (&ArchivedGuestInput, &[u8], *const u8) =
+        access_recursion_archive(blob, &mut aligned_fallback)?;
 
     // Materialize only the small metadata; the proof stays in the buffer.
     let table_counts: TableCounts =
@@ -356,11 +373,11 @@ pub fn verify_recursion_blob<'a>(
     let public_output: &[u8] = archived.vm_proof.public_output.as_slice();
     let decode_commitment: Commitment = archived.decode_commitment;
 
-    // Rebase the returned slices onto the caller's buffer: `archive` may be
-    // the aligned fallback copy, whose lifetime ends with this call. Same
-    // bytes at the same offsets in both buffers.
+    // Rebase the returned slices onto the caller's buffer: `archived` may
+    // point into the aligned fallback copy, whose lifetime ends with this
+    // call. Same bytes at the same offsets in both buffers.
     let rebase = |s: &[u8]| -> &'a [u8] {
-        let offset = s.as_ptr() as usize - archive.as_ptr() as usize;
+        let offset = s.as_ptr() as usize - archive_base as usize;
         &archive_bytes[offset..offset + s.len()]
     };
     let inner_elf_rebased = rebase(inner_elf);

prover/src/recursion.rs

@@ -314,7 +314,7 @@ pub fn verify_continuation_and_attest(
     let decode_commitment: Commitment = archived.decode_commitment;
     let inner_elf: &[u8] = archived.inner_elf.as_slice();
 
-    let Some(public_output) = crate::continuation::verify_continuation_archived(
+    let Some((public_output, entry_point)) = crate::continuation::verify_continuation_archived(
         &archived.bundle,
         inner_elf,
         proof_options,
@@ -325,7 +325,9 @@ pub fn verify_continuation_and_attest(
         return Ok(None);
     };
 
-    let id = program_id_from_elf(inner_elf, &decode_commitment, &page_commitments)?;
+    // Avoids a second `Elf::load` (already done by `verify_continuation_archived`).
+    let digest = elf_digest(inner_elf);
+    let id = program_id_from_digest(&digest, entry_point, &decode_commitment, &page_commitments);
     let mut attestation = id.to_vec();
     attestation.extend_from_slice(&public_output);
     Ok(Some(attestation))