z0p v0.2.0 — Fp4, wire format v5, faster proving

Superseded by v0.2.1 for a rustdoc CI fix. No protocol or wire-format changes.

z0p v0.2.0

The first tagged release with the quartic-extension, wire-format v5, and
optimized FRI/AIR stack.

Highlights

• 1,048,576-step AIR: approximately 1.76 s prove, 2.2 ms verify,
  203,553 B proof on the development machine (1.55 s with the optional
  nightly simd feature).
• Wire format v5: four Fp4 values per 64-byte FRI leaf and eight joint
  AIR trace rows per 64-byte leaf. Older proof bytes are rejected.
• Fp4 challenges across FRI, STARK composition, upcs/Gemini, sumcheck,
  and lookup, raising per-challenge algebraic entropy to about 124 bits.
• New proving surfaces: upcs point/multi-point openings, Gemini and
  BaseFold-style multilinear commitments, committed LogUp (lookup_pcs),
  a register-machine AIR (vm), and a recursion fragment.
• Performance work: linked second-column LDEs, Karatsuba Ext4/Fp2,
  Horner folding, parallel NTT butterflies, out-of-place bit reversal, and
  wider PoW scan bands.
• Audit entry point: AUDIT.md, formal/design papers, security and
  red-team reports, and exact-size benchmark baselines.

Verification

• 267 library tests, 9 hardening tests, 13 security tests, 10 red-team tests,
  5 doc tests.
• python3 tools/check.py passes fmt, clippy, debug/release tests, and the
  pinned benchmark regression.

Status and limitations

Unaudited pre-1.0 research software. The advertised ~100-bit schedule is a
query/PoW budget, not an end-to-end soundness proof. There is no general
circuit compiler, recursion closure, or zkVM. See SECURITY.md and
AUDIT.md.

Assets

• z0p-eprint.pdf: design, formal specification, and benchmarks.