refactor(rotation): move rotation proof to chip level and unify selec…

[hero78119]

A pre-requisites PR before batch main-sumcheck across "all" chip.
This PR refactor rotation and unify the gkr-circuit main-sumcheck flow.

What changed (high level)

This PR reshapes the proving/verification pipeline so rotation constraints are handled at chip level instead of being embedded in each GKR layer proof.
Core effect: rotation logic is now a first-class chip-proof component (rotation_proof) and selector/eval wiring is unified across CPU, GPU, native verifier, and recursion verifier.

Changed areas are mainly:

• ceno_zkvm/src/scheme/* (prover/verifier flow and proof struct)
• gkr_iop/src/gkr/layer/* (layer construction, selector grouping, zerocheck/sumcheck behavior)
• ceno_recursion/src/zkvm_verifier/* (recursive proof input/verification alignment)

---

Major proving-flow changes

1) Rotation proof moved out of per-layer proof and into chip proof

Previously, LayerProof carried optional rotation data at layer scope.
Now, rotation proof is stored in ZKVMChipProof.rotation_proof and handled once at chip level.

Implications:

• Per-layer proof payload is simplified (LayerProof now focuses on main sumcheck path).
• Rotation presence/shape checks become explicit at chip verification boundary.
• Recursion binding mirrors this with has_rotation_proof + rotation_proof in chip-level input.

---

2) Main constraints and rotation constraints are no longer split into separate in-layer proving phases

Before, zerocheck flow effectively had a special rotation handling path and then main constraints.
Now, main sumcheck flow is unified around out_sel_and_eval_exprs, while rotation is produced/checked as a dedicated chip-level proof and then mapped back through selector groups.

Implications:

• Less bifurcation in prover logic.
• Fewer “special-case” transitions between rotation and non-rotation constraints.
• Cleaner challenge/eval accounting and easier reasoning about claimed openings.

---

3) Selector context construction is unified using first-layer selector groups

CPU/GPU prover and verifier paths now build selector contexts by iterating first-layer selector groups (out_sel_and_eval_exprs) rather than relying on branchy ad-hoc logic.

Implications:

• Better CPU/GPU parity.
• Consistent selector semantics (r_selector, w_selector, lookup/zero/whole selectors).
• Reduced risk of backend-specific drift in selector evaluation behavior.

---

4) Rotation selector groups become explicit and dedicated

In gkr_iop layer construction, rotation claims reserve dedicated selector groups/opening slots (3-way grouping for left/right/origin-style rotation openings).
A helper (rotation_selector_group_indices) is used to map rotation claims to the right selector groups deterministically.

Implications:

• Unambiguous assignment of rotation claim evals to selector groups.
• Avoids accidental dedup/aliasing with ordinary selector groups.
• Makes verifier-side matching stricter and easier to audit.

---

Design rationale

1. Single source of truth for rotation handling
   Rotation is conceptually chip-level logic that spans selector/eval organization; storing it at chip level matches that abstraction better than per-layer optional fields.

2. Reduce proving-flow complexity and duplicated logic
   Previous split paths (rotation-specific + main constraints) created duplicated mechanics and increased maintenance burden. Unifying flow lowers cognitive and code complexity.

---

Net effect

This PR is a proving architecture cleanup:

• rotation is elevated to chip-level proofing,
• selector/eval flow is unified across backends and verifiers,
• and proof shape invariants are tightened.

[Copilot]

Pull request overview

Refactors the GKR main-sumcheck pipeline so rotation constraints are handled at the chip proof level (instead of per-layer), and unifies selector/eval wiring across CPU/GPU/native verifier/recursion verifier; additionally introduces explicit selector groups for rotation and ECC “bridge” claims.

Changes:

• Moves rotation proof from LayerProof into ZKVMChipProof.rotation_proof, and updates prover/verifier + recursion binding accordingly.
• Reworks selector-group construction and out-eval assignment to be driven by first-layer out_sel_and_eval_exprs, including explicit rotation/ECC-bridge selector groups.
• Updates CPU/GPU zerocheck provers to compute selector-eq MLEs and splice them into the witness list by structural witness id.

Reviewed changes

Copilot reviewed 22 out of 22 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
gkr_iop/src/gkr/mock.rs	Adjusts mock evaluation plumbing for removed n_instance and updated eval APIs.
gkr_iop/src/gkr/layer_constraint_system.rs	Removes n_instance plumbing from layer constraint system construction.
gkr_iop/src/gkr/layer/zerocheck_layer.rs	Removes in-layer rotation proving/verification; keeps rotation verifier helpers and unifies main zerocheck expression logic.
gkr_iop/src/gkr/layer/sumcheck_layer.rs	Simplifies LayerProof to remove per-layer rotation proof.
gkr_iop/src/gkr/layer/gpu/mod.rs	Unifies GPU zerocheck main sumcheck flow; introduces selector-eq replacement by structural wit id; exposes rotation prover helper.
gkr_iop/src/gkr/layer/cpu/mod.rs	Same unification as GPU; selector-eq replacement by structural wit id; exposes rotation prover helper.
gkr_iop/src/gkr/layer.rs	Removes n_instance; adds explicit rotation/ECC-bridge selector group wiring + indices helpers.
gkr_iop/src/circuit_builder.rs	Adds ec_bridge_selectors to constraint system.
gkr_iop/src/chip.rs	Updates chip evaluation-count accounting to include rotation + ECC-bridge openings.
ceno_zkvm/src/tables/shard_ram.rs	Adds ECC bridge selectors and structural-witness wiring for ShardRam.
ceno_zkvm/src/structs.rs	Updates ECC proof eval layout comment.
ceno_zkvm/src/scheme/verifier.rs	Verifier now assigns rotation/ECC bridge group evals into out_evals before GKR verification.
ceno_zkvm/src/scheme/utils.rs	Adds ECC-bridge claim derivation + rotation/group assignment helpers; removes pub-IO MLE wiring in witness gen.
ceno_zkvm/src/scheme/prover.rs	Runs ECC quark + rotation proof at chip scope; passes them into main-constraints proving; stores chip-level rotation proof.
ceno_zkvm/src/scheme/hal.rs	Extends device HAL with RotationProver; changes ECC quark prover to return Option.
ceno_zkvm/src/scheme/gpu/mod.rs	Adds standalone prove_rotation_impl, adapts main-constraints proving to accept rotation/ECC proofs and fill out-evals.
ceno_zkvm/src/scheme/gpu/memory.rs	Updates GPU memory estimation to remove rotation extras at layer scope.
ceno_zkvm/src/scheme/cpu/mod.rs	Adds CPU RotationProver and adapts main-constraints proving similarly to GPU.
ceno_zkvm/src/scheme.rs	Adds chip-level rotation_proof field to ZKVMChipProof.
ceno_zkvm/src/precompiles/lookup_keccakf.rs	Updates test harness to explicitly prove/verify rotation and assign rotation group evals.
ceno_recursion/src/zkvm_verifier/verifier.rs	Updates recursive verifier to consume chip-level rotation proof and to build out_evals sized by gkr_circuit.n_evaluations.
ceno_recursion/src/zkvm_verifier/binding.rs	Adds chip-level rotation proof fields to recursion proof input binding; removes per-layer rotation fields.

[Copilot]

Pull request overview

Copilot reviewed 22 out of 22 changed files in this pull request and generated 2 comments.

[kunxian-xia]

@copilot please summarize/highlight the concrete sumcheck expressions in main sumcheck phase. And update it to the corresponding comments and submit a pull request.

[Copilot]

@kunxian-xia I've opened a new pull request, #1310, to work on those changes. Once the pull request is ready, I'll request review from you.

[hero78119]

in #1301 adjust the flow to be more concise, where ecc prove is not the first one

create_chip_proof
  |
  +--> build main witness (records / layers)
  |
  +--> prove tower relation
  |         - build tower witnesses (r/w/logup)
  |         - sumcheck tower
  |         - output: rt_tower, tower_proof, out_evals
  |
  +--> [optional] prove rotation
  |         - output: rotation_proof + rotation points
  +--> [optional] prove ECC quark
  |         - input: ec_point_exprs / ec_slope_exprs witnesses
  |         - output: ecc_proof { rt, evals, sum }
  |
  +--> prove main constraints (GKR)
  |         - initialize out_evals at rt_tower
  |         - wire rotation claims -> selector groups
  |         - wire ECC bridge claims (x/y/s) -> selector groups
  |         - run GKR prove
  |         - output: gkr_iop_proof + opening evals + input_opening_point
  |
  +--> PCS opening
  |
  '--> assemble ZKVMChipProof