z0p v0.2.1 — clean rustdoc CI

z0p v0.2.1

Patch release for the v0.2.0 line. No protocol or wire-format changes.

Fixed

• Rustdoc now builds cleanly with -D warnings: the sumcheck module docs
  no longer link to the crate-private verify_final helper.
• tools/check.py now includes the same rustdoc gate used by CI.

Verification

All CI jobs pass: stable fmt/clippy/tests, MSRV 1.74, rustdoc with warnings
denied, and portable SIMD on nightly. The 1M-step AIR benchmark remains at
approximately 1.76 s prove / 2.2 ms verify / 203,553 B.

Full changelog: v0.2.0...v0.2.1

z0p v0.2.0 — Fp4, wire format v5, faster proving

Superseded by v0.2.1 for a rustdoc CI fix. No protocol or wire-format changes.

z0p v0.2.0

The first tagged release with the quartic-extension, wire-format v5, and
optimized FRI/AIR stack.

Highlights

• 1,048,576-step AIR: approximately 1.76 s prove, 2.2 ms verify,
  203,553 B proof on the development machine (1.55 s with the optional
  nightly simd feature).
• Wire format v5: four Fp4 values per 64-byte FRI leaf and eight joint
  AIR trace rows per 64-byte leaf. Older proof bytes are rejected.
• Fp4 challenges across FRI, STARK composition, upcs/Gemini, sumcheck,
  and lookup, raising per-challenge algebraic entropy to about 124 bits.
• New proving surfaces: upcs point/multi-point openings, Gemini and
  BaseFold-style multilinear commitments, committed LogUp (lookup_pcs),
  a register-machine AIR (vm), and a recursion fragment.
• Performance work: linked second-column LDEs, Karatsuba Ext4/Fp2,
  Horner folding, parallel NTT butterflies, out-of-place bit reversal, and
  wider PoW scan bands.
• Audit entry point: AUDIT.md, formal/design papers, security and
  red-team reports, and exact-size benchmark baselines.

Verification

• 267 library tests, 9 hardening tests, 13 security tests, 10 red-team tests,
  5 doc tests.
• python3 tools/check.py passes fmt, clippy, debug/release tests, and the
  pinned benchmark regression.

Status and limitations

Unaudited pre-1.0 research software. The advertised ~100-bit schedule is a
query/PoW budget, not an end-to-end soundness proof. There is no general
circuit compiler, recursion closure, or zkVM. See SECURITY.md and
AUDIT.md.

Assets

• z0p-eprint.pdf: design, formal specification, and benchmarks.

z0p v0.1.0 — initial public release

z0p v0.1.0

Initial public release of z0p: a from-scratch, zero-dependency zero-knowledge
proving stack in safe Rust.

Included

• Binary fields (gf2), BabyBear (babybear), BLAKE3-256 (hash), and
  Fiat-Shamir transcripts with proof-of-work grinding (transcript).
• Domain-separated Merkle trees with caps (merkle), parallel NTT (ntt),
  FRI polynomial commitments (fri), MLE and sumcheck (mle, sumcheck).
• Fibonacci AIR/STARK (air), range checks (range), table membership
  (table), hash-folded IVC (fold), and zero-knowledge masking (blind).
• Canonical, fail-closed wire encoding (codec) and a ChaCha20 CSPRNG (rng).
• Security, red-team, and hardening test suites, plus tools/check.py gates.

Status

Unaudited research software. Soundness figures are conjectured; do not deploy
for high-value statements before external review. See SECURITY.md.