Prototype a feature-gated hybrid opener that shares ring switching and a Ligerito continuation across two independently authenticated roots. The deliverable is a sound composition and measured tradeoff for mixed workloads, not replacement of ordinary BitZ openings.
Sources
BitZ opening/authentication contract is normative for the target contract. PoC two-root hybrid opener and initial-row authentication adapter is implementation reference only; preserve target field, layout, transcript and security requirements unless this issue explicitly introduces a versioned protocol.
Relation and geometry
Treat the virtual packed message V as a fixed, public embedding of the two source messages plus explicit zero padding. Bind both roots, source identities, message/codeword geometries, lane offsets, field/basis encodings and the full security profile. Require compatible GF(2^128) encodings or an explicit proven conversion; do not reinterpret another field's elements or weaken either branch's integer/no-wrap constraints. A synthetic combined digest is statement binding, not a Merkle root authenticating all rows by itself.
Proposed normative flow
After binding the hybrid version and statement, execute the profile-required initial OOD sample of V before branch PIOP/forest challenges; PR #76 owns the reusable OOD machinery. Run both branch reductions in the prescribed bound order. At their combined terminal claim, emit/check/absorb the shared ring-switch message, then derive its batching challenges. Incorporate the OOD claim with a fresh post-message coefficient. Sample an independently domain-separated zero-padding claim after ring messages and include its zero target in the same basis. Execute one Ligerito continuation; when it requests initial rows, supply each real slice with authentication to its own root and the prescribed zero lanes.
Ordered verifier
Validate geometry/profile and both roots; replay OOD; verify both branch reductions and their field boundaries; verify ring-switch target and batching; derive OOD/padding basis residuals; authenticate every initial row slice to the correct root, check zero lanes and padding obligations; verify recursive Ligerito/final residual equations and consume the entire proof. Acceptance requires both roots and every padding/OOD claim, never only the synthetic statement digest.
Scope, impact and validation
Reuse existing branch protocols and security accounting; do not implement a new Binius arithmetization here. Savings may come from avoiding a second continuation, but lane alignment, padding, authentication and profile changes can erase them. Keep opt-in and compare two independent complete openings at identical security/workload. Require positive unequal source widths, padding-boundary tests, negative swapped roots/slices/offsets/nonzero-padding/OOD/branch-claim tests and versioned golden transcripts. Document all new union-bound costs and reject unsupported rate combinations.
Dependencies and coordination
Requires #120. Coordinate with #76.
Prototype a feature-gated hybrid opener that shares ring switching and a Ligerito continuation across two independently authenticated roots. The deliverable is a sound composition and measured tradeoff for mixed workloads, not replacement of ordinary BitZ openings.
Sources
BitZ opening/authentication contract is normative for the target contract. PoC two-root hybrid opener and initial-row authentication adapter is implementation reference only; preserve target field, layout, transcript and security requirements unless this issue explicitly introduces a versioned protocol.
Relation and geometry
Treat the virtual packed message V as a fixed, public embedding of the two source messages plus explicit zero padding. Bind both roots, source identities, message/codeword geometries, lane offsets, field/basis encodings and the full security profile. Require compatible GF(2^128) encodings or an explicit proven conversion; do not reinterpret another field's elements or weaken either branch's integer/no-wrap constraints. A synthetic combined digest is statement binding, not a Merkle root authenticating all rows by itself.
Proposed normative flow
After binding the hybrid version and statement, execute the profile-required initial OOD sample of V before branch PIOP/forest challenges; PR #76 owns the reusable OOD machinery. Run both branch reductions in the prescribed bound order. At their combined terminal claim, emit/check/absorb the shared ring-switch message, then derive its batching challenges. Incorporate the OOD claim with a fresh post-message coefficient. Sample an independently domain-separated zero-padding claim after ring messages and include its zero target in the same basis. Execute one Ligerito continuation; when it requests initial rows, supply each real slice with authentication to its own root and the prescribed zero lanes.
Ordered verifier
Validate geometry/profile and both roots; replay OOD; verify both branch reductions and their field boundaries; verify ring-switch target and batching; derive OOD/padding basis residuals; authenticate every initial row slice to the correct root, check zero lanes and padding obligations; verify recursive Ligerito/final residual equations and consume the entire proof. Acceptance requires both roots and every padding/OOD claim, never only the synthetic statement digest.
Scope, impact and validation
Reuse existing branch protocols and security accounting; do not implement a new Binius arithmetization here. Savings may come from avoiding a second continuation, but lane alignment, padding, authentication and profile changes can erase them. Keep opt-in and compare two independent complete openings at identical security/workload. Require positive unequal source widths, padding-boundary tests, negative swapped roots/slices/offsets/nonzero-padding/OOD/branch-claim tests and versioned golden transcripts. Document all new union-bound costs and reject unsupported rate combinations.
Dependencies and coordination
Requires #120. Coordinate with #76.