Hekate v0.35.0

The reported security level was wrong, and this release restates it at 100 bits that follow from published theorems. Column queries were priced at list-decoding capacity where the cited theorems give the unique-decoding radius, which overstated the query term by 2.3 to 2.4x on the shipped tables measured; the same overstating function also chose each table's encoding geometry, and a formula that gates a decision cannot grade it. Three further terms were missing from the sum. Paying for 100 proven bits costs 287 column queries instead of 176, which costs about 25 percent in proof bytes and leaves prove time and peak memory inside the benchmark noise floors. No forgery is known that exploited any of this: every value the verifier computed was computed correctly, and a proof that verified was a real proof of a real statement. What was wrong is the number attached to the answer. Two new crates ship alongside, hekate-sha2 and hekate-rsa. Pair with the signed prover cdylib 0.13.0. Upgrade is mandatory for any deployment relying on the security figure.

§ Security accounting (#31)

• Unique-decoding pricing. Config::ldt_bits charged t · log2(1/rho), which is 1.0 bit per query at rate 1/2 and list-decoding-capacity pricing. The correct term is -log2((1 + rho)/2), 0.4150 bits at rate 1/2. Queries move 176 to 287.
• The formula no longer gates geometry. The fractional-encoding gate read a 128-bit threshold computed by the same overstating function it reported with. It now reads MIN_PRODUCTION_BITS, the floor it actually serves.
• Proximity term completed. The additive fold term gained the eq-tensor factor over the grid's rows and the curve factor over the eta walk, worth 4 to 7 bits, and RingSwitchPlan::split_vars now takes the widest grid still clearing the floor.
• LogUp challenge term counted. field_bits - log2(bus rows), 108 bits at 2^20 rows and 102 at 2^26, appeared in no estimate. check_logup_security computes it from the program's bus counts and both sides run it before gamma is drawn.
• Per-table reporting. The old single line covered the main table's inner argument. Every table and the outer argument now log their own figures on both sides.
• Measured. hekate/tests/mixture_proximity.rs builds the shipped encode and measures the per-query pass rate of two cheating strategies over 200,000 query sets, reproducing both bounds to three decimals.

§ Proof size (#30)

• One tensor vector per table on a single lambda line, in place of one per claim.
• The LogUp helper h is opened inside the trace evaluation argument rather than as its own round.
• The outer argument moves to the unique-decoding radius, 240 queries to 155, and then to 121 with the batched linear test.
• Bus clocks gain a phase column, which lets several requesters share one bus_id.

§ SHA-256 and RSA-2048 (#29)

• hekate-sha2 0.1.0. SHA-256 compression chiplet over bit-expanded B32 columns, one committed carry word per 32-bit add, Ch and Maj committed, one bus emit per block. The CPU table owns padding and the feed-forward add.
• hekate-rsa 0.1.0. Pkcs1Statement proves s^65537 mod N == PKCS1-v1_5(H) for a 2048-bit modulus, with N public and the signature and message witness.
• hekate-gadgets gains the modexp chiplet on a stateless-service bus and exponent-form integer chains over GF(2^128)*.
• The RAM, ROM and IntArith suites move from hekate into hekate-gadgets.

§ Performance

Signed public cdylib 0.13.0, Apple M3 Max, --release, features std parallel blake3 table-math, Config::prod(), best of three, zero-knowledge arm. The base column and the reproduce commands are in the workspace README.

Proof size rises 14 to 29 percent against 0.34.0, across the ten workloads both releases measured. Prove time and peak memory land inside the benchmark noise floors on every workload, which is what choosing 287 queries over the unconstrained minimum of 241 bought: the geometry did not move.

§ Breaking

• Proofs and bundles. Proof wire v5 to v6, bundle v4 to v5. num_queries, ldt_support_size and outer_queries are transcript-bound and all three moved, hence a 0.34.0 proof fails replay at the first challenge. Re-prove against this release.
• Minimum table height is 512 rows. A table needs at least as many rows as there are queries, and 287 rounds up to 2^9. A shorter table aborts with ldt_support_size (256) must be >= num_queries (287).
• Outer statement capacity. Lowering outer queries to 121 raises the message length, pushing the cap on multiplication wires from 173,098 to 11,183,509.
• Prover cdylib 0.13.0, signed (SHA-256, Ed25519, ML-DSA-65). An older cdylib emits proofs this verifier rejects.
• Versions. Workspace 0.34.0 to 0.35.0; hekate-keccak and hekate-aes 0.8.0, hekate-pqc 0.9.0; hekate-sha2 and hekate-rsa 0.1.0.

§ Not promised

• 128 bits. Not reachable over GF(2^128) at any query count. Every additive term has the form n/|F| and sits at 128 - log2(n), and queries shrink none of them. It needs challenges from a 256-bit field, a protocol change.
• Grinding. We do not use proof-of-work to buy query bits. If we adopt it, those bits will be reported separately.
• Terms we have not identified. Five terms were wrong or missing and we found them. How many terms a soundness argument has is not something the argument tells you.
• Independent audit. This workspace has not had one.