ebfull

The tests for `u64_into_boolean_vec_le` and `field_into_boolean_vec_le`/`field_into_allocated_bits_le` are terrible.

These would test group hash invoked with various personalizations, using vectors obtained from Python/Sagemath.

Test vectors for pedersen_hash

1

These would test pedersen_hash using vectors obtained from Python/Sagemath.

This is done in `AllocatedNum` and `EdwardsPoint`.

This has little surface area but still needs to be tested, e.g., `add_bool_with_coeff`.

Use `Unknown`/`PrimeOrder` marker types inside circuit

2

These are used outside the circuit a lot, but it seems they would be very handy inside the circuit. Then, you could have a "compress" method defined only for prime...

`Spend` circuit can have "dummy" inputs that bypass the authentication path check, let's test that these constraints work correctly.