v0.28.0

Features

• Added the miden-precompiles crate with the official deferred precompile registry used by the VM/prover/verifier path (#3222).
• Added partial deferred-proof APIs in miden-prover (prove_partial, prove_partial_sync, and prove_partial_from_trace_sync) and Verifier::verify_partial.
• [BREAKING] Removed the public miden::core::crypto::dsa::ecdsa_k256_keccak::verify_prehash and raw miden::precompiles::crypto::dsa::ecdsa_secp256k1::assert_verify_prehash ECDSA prehash verifier entrypoints. ECDSA K256 Keccak verification is now exposed only through the high-level verify procedure, whose implementation inlines the verifier, loads signature scalars directly from advice, and avoids the raw prehash memory ABI (#3222).
• Added Package::get_export_node() and Package::procedures_with_attribute() APIs (#3320).
• Imported the Miden crypto crates, benches, fuzz targets, and Wycheproof tests into this workspace (#3366).
• Restored the ExactSizeIterator impl on miden-serde-utils::ReadManyIter, matching upstream, and corrected size_hint to advertise the exact remaining count (#3366).
• [BREAKING] Restored AeadPoseidon2::key_from_bytes to upstream canonical-Felt decoding. The SHA-256 KDF that briefly appeared on this branch is removed; keys persisted under the KDF contract must be re-derived (#3366).
• Documented the SharedSecret zeroization contract on the k256 and x25519 ECDH paths: the type now holds owned [u8; 32] bytes and zeroizes on drop (#3366).
• Hardened Randomizable::from_random_bytes to return None on short slices instead of panicking (#3366).
• Capped BudgetedReader::max_alloc at 0 for zero-sized elements, so a length-prefixed Vec<ZST> can no longer claim u64::MAX elements (deliberate, documented divergence from upstream) (#3366).
• Added optional read-only trace events: processor recognizes sys::trace_event and forwards the user trace ID below it to SyncHost::on_trace/Host::on_trace. Unhandled trace events are no-ops, and DefaultHost supports named trace-handler registration (#3396).
• Opened the LargeSmtForest backend API for external implementations: made LineageMutation::new and AppliedLineageMutation::new public and added LineageId::as_bytes and MutationSet::from_parts.

Changes

• Split package serialization assembly tests into their own module (#3083).
• [BREAKING] Replaced the legacy proof-bound precompile request/transcript model with the deferred-DAG framework in miden_core::deferred; the old request/transcript API has been removed in favor of Node, Tag, DeferredState, DeferredStateWire, Precompile, and PrecompileRegistry (#3222).
• [BREAKING] Reworked ExecutionProof into separate StarkProof and DeferredProof envelopes. The old public fields, deferred_state() and stark_proof() accessors, into_parts(), and three-argument ExecutionProof::new constructor were removed, and proof serialization changed.
• [BREAKING] Replaced the free verify_with_max_deferred_elements functions in miden-verifier and miden-vm with the configurable Verifier API. Use Verifier::with_max_deferred_elements(...) followed by verify(...) or verify_partial(...).
• [BREAKING] Replaced precompile request count/calldata execution limits with deferred-state element budgeting. Use ExecutionOptions::with_max_deferred_elements(...) and verify_with_max_deferred_elements(...) for non-default deferred-state budgets (#3222).
• [BREAKING] Removed the miden::core::crypto::dsa::eddsa_ed25519 MASM module, Rust handler, docs, and tests. EdDSA support is temporarily removed from core-lib and will be reintroduced once it is supported by the precompiles prover (#3222).
• [BREAKING] Removed the miden::core::crypto::hashes::sha512 MASM module, Rust handler, docs, and tests. SHA-512 support is temporarily removed from core-lib and will be reintroduced once it is supported by the precompiles prover (#3222).
• [BREAKING] Changed the miden::core::crypto::dsa::ecdsa_k256_keccak advice/signature ABI to QX[8] || QY[8] || SIG_R[8] || SIG_S[8] as little-endian u32 field elements. Existing 65-byte signature advice must be re-encoded as (r, s) limbs without a recovery byte (#3222).
• [BREAKING] Migrated proof-bound precompiles to the deferred-DAG proof wire. ExecutionProof now carries a DeferredStateWire, proof serialization is incompatible with previous proof-bound precompile requests, and verification rehydrates the wire under the built-in miden_precompiles::registry() before binding the resulting deferred root to the STARK public inputs (#3222).
• FastProcessor restore_call_state() and restore_context() now return OperationError::Internal instead of panicking on empty stacks (#3371, fixes #3296).
• Bound deferred precompile STARK proofs to the generated precompile ACE relation digest (#3344).
• [BREAKING] Split Poseidon2 permutation rows out of ChipletsAir into Poseidon2PermutationAir, and updated the recursive verifier ACE registry for three AIRs (#3345).
• [BREAKING] Optimize periodic columns evaluation for fewer ACE gates (#3347).
• Split dense MastForest order helpers and package serialization tests into smaller modules, and routed dense forest finalization and static library setup through dedicated builder and library methods (#3346).
• [BREAKING] Renamed module and kernel metadata APIs from ModuleInfo/Kernel to ModuleDescriptor/KernelDescriptor, including matching module descriptor method names (#3356).
• Replaced panics in OverflowTable::restore_context(), get_current_overflow_stack(), and get_current_overflow_stack_mut() with proper OperationError returns (#3370).
• [BREAKING] Added missing constraint in Bitwise chiplet (#3386).
• [BREAKING] Optimized the recursive verifier MASM by changing fri_ext2fold4 to accept a natural coset index and return a loop-ready stack layout for FRI layer folding (#3349).
• [BREAKING] Sped up constraints evaluation during proving: the prover now runs generated, globally-CSE'd constraint evaluators, and ACE lowering consumes the same captured constraint IR. The public ACE pipeline now targets Miden's Felt/QuadFelt field pair instead of accepting arbitrary base and extension fields (#3404).
• Faster Poseidon2 hashing on aarch64 targets with SVE2 via an SVE2 kernel (#3405).
• Parallelized commitment buffer initialization and made the LMCS upsampling scratch buffer lazy (#3406).
• Sped up trace building: chiplets build in parallel, and on the sync proving paths the hasher chiplet builds during execution (on by default, ExecutionOptions::with_overlapped_trace_build) (#3407).
• [BREAKING] Added dead-node elimination in ACE DAG (#3408).
• [BREAKING] Normalized each AIR's committed LogUp sum by its trace length and changed the running-sum constraint to close cyclically, removing the requirement that lookup activity be absent from the last row (#3412).
• [BREAKING] Reworked recursive verification around canonical execution claims: ExecutionClaim carries a domain-tagged commitment bound into the Fiat-Shamir statement, and native verification takes (proof, claim) with Verifier::verify_partial returning the deferred obligation as a #[must_use] Unsettled token. The MASM entrypoint becomes exec.vm::verify_vm_proof [claim_ptr] -> [D, num_queries, query_pow_bits, deep_pow_bits, folding_pow_bits]: it verifies the caller-staged claim and returns the deferred root with the proof's transcript-bound security parameters. miden_verifier::recursive builds the advice (#3422).
• [BREAKING] Added AdviceStack as the public advice stack type. AdviceInputs and AdviceProvider now use it, and the old raw stack field and extend_stack helpers were removed (#3423).
• [BREAKING] Removed unused public APIs and narrowed test-only helper visibility across VM and crypto crates (#3424).
• Enable simd128 Plonky3 backend for WASM builds and added related CI job (#3433).
• [BREAKING] Bumped Plonky3 related dependencies to integrate SVE2 and WASM-SIMD128 speed-ups and include a NEON bugfix. (#3441).

Fixes

• Validated SectionId on deserialization: Section::read_from() now rejects invalid identifiers and the serde path delegates to FromStr, keeping both readers on the same invariant (#3277).
• Fixed hash_bytes(&[]) returning Word::default(); the empty-bytes input now absorbs a padding marker and permutes, producing a nonzero digest consistent with the 10* sponge padding rule (#3366).
• Fixed a latent CryptoBox (IES) key-derivation bug: HKDF-SHA256 output is now reduced into canonical Felts via AeadScheme::key_from_uniform_bytes instead of being fed into canonical decoding, which rejected noncanonical limbs at ~2^-30 per key (#3366).
• Hardened AeadPoseidon2 and XChaCha decrypt paths against malleable ciphertexts by rejecting trailing bytes after a valid EncryptedData encoding (#3366).
• Hardened Falcon signature deserialization against short buffers and rejected trailing bytes in SignaturePoly::read_from_bytes (#3366).
• Fixed ReadAdapter buffer position not being reset when the local buffer drained to empty during read_slice (#3366).
• Restored compact SMT serialization budgets so an empty-subtree-only NodeValue can be read under a tight budget (#3366).
• Fixed hash_elements_in_domain(&[], d) colliding with hash_elements_in_domain(&[ZERO; RATE_WIDTH], d) for nonzero d, by absorbing a ONE padding marker on the empty-input branch (#3366).
• Built the crypto SVE archive from target cfg (CARGO_CFG_TARGET_ARCH / CARGO_CFG_TARGET_FEATURE) instead of #[cfg(target_feature = "sve")], which does not fire in build scripts (#3366).
• Qualified the word-wrapper derive macro's emitted String as alloc::string::String and wrapped the impl in const _: () = { extern crate alloc; ... } for no_std and #![no_implicit_prelude] consumers (#3366).
• Fixed miden-format producing lines longer than the configured maximum for item imports; imports now wrap one item per line. Added overflow_delimited_expr to opt into keeping long word(...)/event(...) call heads on the assignment line when they fit (#3380).
• Documented the program-entrypoint locals invariant on Procedure::set_num_locals and now assert it at that AST mutation site, so setting locals on an executable module's begin..end block panics at the producer boundary. The existing assembler assertion is retained as a backstop for entrypoints built directly via Procedure::new (#3382).
• [BREAKING] Fixed a soundness gap in the chiplets AIR where a chiplet section's first-row initialization was skipped when the preceding section was empty. A program that uses memory but performs no u32and/u32xor operations produces an empty bitwise section, which caused the memory chiplet to skip its "values not being written must be zero" reset; a malicious prover could exploit this to forge a read of never-written memory. Each section's first row is now identified from the chiplet selectors at the boundary rather than from the previous chiplet's last row, so the initialization holds no matter which preceding sections are empty. The ACE section-start reset was hardened the same way as a precaution (#3387).
• [BREAKING] Bound MMR peak commitments to the leaf count by hashing [num_leaves, 0, 0, 0] || padded_peaks, and updated the core library mmr::pack/mmr::unpack procedures to use the same preimage (#3388).