Feat/recursion

README.md

@@ -163,6 +163,23 @@ prf, err := loom.Prove(statement, witness)
 err = loom.Verify(statement, prf)
 ```
 
+## Recursion
+
+`recursion/` provides a first Loom-native recursive wrapper:
+
+- `recursion.ProveNextLayer` checks one Loom proof and proves the verifier's algebraic core with Loom.
+- `recursion.ProveAggregationLayer` folds two Loom proofs into one wrapper proof.
+
+Examples:
+
+```sh
+go run ./examples/circuit_recursion
+go run ./examples/aggregation
+```
+
+Current recursion is specialized to a concrete inner proof and arithmetizes the verifier core: public inputs, exposed values, Lagrange values, logup bus checks, AIR quotient identities, the DEEP-quotient-to-FRI bridge, FRI folding arithmetic, Poseidon2 transcript reconstruction, and Poseidon2 Merkle authentication for point sampling and FRI paths.
+
+
 ## Development
 
 ```sh

board/board.go

@@ -199,7 +199,7 @@ func (b *Builder) addExposeRelativeIthValuePublicConstraint(module string, E exp
 // AddExposeIthValueStep adds a constraint Lagrange_pos * (expr - expr[pos]), and stores expr[pos] in the proof so the verifier has access to it
 // the 1 entry column expr[pos] is registered in the trace
 func (b *Builder) AddExposeIthValueStep(module string, E expr.Expr, out string, pos int) {
-	ctx := ExposeIthValueCtx{Pos: pos}
+	ctx := ExposeIthValueCtx{Module: module, Pos: pos}
 	pvStep := ProverStep{
 		Ctx:  ctx,
 		Ins:  []expr.Expr{E},

examples/aggregation/main.go

@@ -0,0 +1,77 @@
+// Copyright Consensys Software Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+// the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+// an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/consensys/gnark-crypto/field/koalabear"
+	"github.com/consensys/loom/board"
+	"github.com/consensys/loom/expr"
+	"github.com/consensys/loom/prover"
+	"github.com/consensys/loom/recursion"
+	"github.com/consensys/loom/setup"
+	"github.com/consensys/loom/trace"
+	"github.com/consensys/loom/verifier"
+)
+
+func main() {
+	left := proveFibonacci(4)
+	right := proveFibonacci(8)
+
+	aggregated, err := recursion.ProveAggregationLayer(
+		recursion.AggregationInput{Left: left, Right: right},
+		recursion.UsePoseidon2(),
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := recursion.VerifyOutput(aggregated); err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Printf("aggregated commitments=%d\n", len(aggregated.Proof.Commitments))
+}
+
+func proveFibonacci(n int) recursion.RecursionInput {
+	program, tr := fibonacciInstance(n)
+	prf, err := prover.Prove(tr, setup.ProvingKey{}, nil, program)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := verifier.Verify(nil, setup.VerificationKey{}, program, prf); err != nil {
+		log.Fatal(err)
+	}
+	return recursion.RecursionInput{Program: program, Proof: prf}
+}
+
+func fibonacciInstance(n int) (board.Program, trace.Trace) {
+	builder := board.NewBuilder()
+	module := board.NewModule("fibonacci")
+	module.N = n
+	module.AssertZeroExceptAt(expr.Rot("A", 1).Sub(expr.Col("B")), n-1)
+	module.AssertZeroExceptAt(expr.Rot("B", 1).Sub(expr.Col("C")), n-1)
+	module.AssertZero(expr.Col("C").Sub(expr.Col("A")).Sub(expr.Col("B")))
+	builder.AddModule(module)
+
+	program, err := board.Compile(&builder)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	var a, b koalabear.Element
+	b.SetOne()
+	return program, prover.TraceFibonacci(n, a, b)
+}

examples/circuit_recursion/main.go

@@ -0,0 +1,72 @@
+// Copyright Consensys Software Inc.
+//
+// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
+// the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
+// an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"fmt"
+	"log"
+
+	"github.com/consensys/gnark-crypto/field/koalabear"
+	"github.com/consensys/loom/board"
+	"github.com/consensys/loom/expr"
+	"github.com/consensys/loom/prover"
+	"github.com/consensys/loom/recursion"
+	"github.com/consensys/loom/setup"
+	"github.com/consensys/loom/trace"
+	"github.com/consensys/loom/verifier"
+)
+
+func main() {
+	program, tr := fibonacciInstance(16)
+
+	baseProof, err := prover.Prove(tr, setup.ProvingKey{}, nil, program)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := verifier.Verify(nil, setup.VerificationKey{}, program, baseProof); err != nil {
+		log.Fatal(err)
+	}
+
+	next, err := recursion.ProveNextLayer(
+		recursion.RecursionInput{Program: program, Proof: baseProof},
+		recursion.UsePoseidon2(),
+	)
+	if err != nil {
+		log.Fatal(err)
+	}
+	if err := recursion.VerifyOutput(next); err != nil {
+		log.Fatal(err)
+	}
+
+	fmt.Printf("base commitments=%d recursive commitments=%d\n", len(baseProof.Commitments), len(next.Proof.Commitments))
+}
+
+func fibonacciInstance(n int) (board.Program, trace.Trace) {
+	builder := board.NewBuilder()
+	module := board.NewModule("fibonacci")
+	module.N = n
+	module.AssertZeroExceptAt(expr.Rot("A", 1).Sub(expr.Col("B")), n-1)
+	module.AssertZeroExceptAt(expr.Rot("B", 1).Sub(expr.Col("C")), n-1)
+	module.AssertZero(expr.Col("C").Sub(expr.Col("A")).Sub(expr.Col("B")))
+	builder.AddModule(module)
+
+	program, err := board.Compile(&builder)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	var a, b koalabear.Element
+	b.SetOne()
+	return program, prover.TraceFibonacci(n, a, b)
+}

go.mod

@@ -2,25 +2,24 @@ module github.com/consensys/loom
 
 go 1.25.7
 
-require github.com/consensys/gnark-crypto v0.20.1
+require (
+	github.com/consensys/gnark v0.14.1-0.20260224185952-e002a37bb76c
+	github.com/consensys/gnark-crypto v0.20.2-0.20260518201312-fa008e990155
+	github.com/consensys/go-corset v1.2.16
+)
 
 require (
 	github.com/bits-and-blooms/bitset v1.24.4 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/consensys/gnark v0.14.1-0.20260224185952-e002a37bb76c // indirect
-	github.com/consensys/go-corset v1.2.16 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/google/pprof v0.0.0-20260202012954-cb029daf43ef // indirect
-	github.com/leanovate/gopter v0.2.11 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mmcloughlin/mathfmt v0.0.0-20240209192118-76b0fc98f057 // indirect
 	github.com/ronanh/intcomp v1.1.1 // indirect
 	github.com/rs/zerolog v1.34.0 // indirect
 	github.com/sirupsen/logrus v1.9.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	golang.org/x/crypto v0.48.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/tools v0.42.0 // indirect
 )