Daira-Emma Hopwood

Note that a sensible stepping stone would be to switch to Kyber first, leaving a switch to a post-quantum SNARK for later. That would be sufficient for post-quantum privacy (because...

Since #3958 is fixed, the next step is to put the protocol spec at a stable URL (ECC-internal ticket https://github.com/Electric-Coin-Company/z.cash/issues/1149). Edit: it is now at https://zips.z.cash/protocol/protocol.pdf . To see link...

I personally like the immediate indication (even just scanning/searching the source without going to the webapp) that there is more to the implementation of a consensus rule than just the...

> If any dynamic table is present, we add a "synthetic" column that stores a "table tag", with zero meaning "table disabled". Any dynamic table *or* more than one table....

https://www.youtube.com/watch?v=639DZpIC0Fc has an interesting example of using two tables compositionally, where one is non-constant.

Since you need a selector per argument *instead of* a single $U$ with the multiple lookup argument approach, I don't see that this ever saves any columns or complexity.

The only reason I can think of to allow querying a fixed column at a non-cur rotation, is to be able to combine (say) two fixed columns into one if...

I think @Brechtpd is probably referring to the case where a gate selected on a usable row, references a cell on an unusable row. But that is a circuit bug:...

If I'm reading `halo2_proofs/src/dev.rs` correctly, the difference between a `ConstraintPoisoned` error, and what I suggested using constant folding, is that multiplying by *any* zero (including an advice value that happens...

This is useful and was just dropped accidentally. Needs rebase and review.