Fix inconsistent gate ordering

Also rename output wire from `c` to `o` internally to remove confusion
with `q_c`, the constant wire selector.

src/commitment_scheme/kzg10/key.rs

@@ -482,13 +482,13 @@ mod test {
             let poly_b = Polynomial::rand(26 + 1, &mut OsRng);
             let poly_b_eval = poly_b.evaluate(&point);
 
-            let poly_c = Polynomial::rand(27, &mut OsRng);
-            let poly_c_eval = poly_c.evaluate(&point);
+            let poly_o = Polynomial::rand(27, &mut OsRng);
+            let poly_o_eval = poly_o.evaluate(&point);
 
             open_multiple(
                 &ck,
-                &[poly_a, poly_b, poly_c],
-                vec![poly_a_eval, poly_b_eval, poly_c_eval],
+                &[poly_a, poly_b, poly_o],
+                vec![poly_a_eval, poly_b_eval, poly_o_eval],
                 &point,
                 &mut Transcript::new(b"agg_flatten"),
             )?
@@ -521,16 +521,16 @@ mod test {
             let poly_b = Polynomial::rand(26, &mut OsRng);
             let poly_b_eval = poly_b.evaluate(&point_a);
 
-            let poly_c = Polynomial::rand(27, &mut OsRng);
-            let poly_c_eval = poly_c.evaluate(&point_a);
+            let poly_o = Polynomial::rand(27, &mut OsRng);
+            let poly_o_eval = poly_o.evaluate(&point_a);
 
             let poly_d = Polynomial::rand(28, &mut OsRng);
             let poly_d_eval = poly_d.evaluate(&point_b);
 
             let aggregated_proof = open_multiple(
                 &ck,
-                &[poly_a, poly_b, poly_c],
-                vec![poly_a_eval, poly_b_eval, poly_c_eval],
+                &[poly_a, poly_b, poly_o],
+                vec![poly_a_eval, poly_b_eval, poly_o_eval],
                 &point_a,
                 &mut Transcript::new(b"agg_batch"),
             )?;

src/composer/arithmetization.rs

@@ -20,10 +20,10 @@ pub struct Arithmetization {
     pub(crate) q_r: BlsScalar,
     /// Output wire selector
     pub(crate) q_o: BlsScalar,
+    /// Fourth wire selector
+    pub(crate) q_4: BlsScalar,
     /// Constant wire selector
     pub(crate) q_c: BlsScalar,
-    /// Fourth wire selector
-    pub(crate) q_d: BlsScalar,
     /// Arithmetic wire selector
     pub(crate) q_arith: BlsScalar,
     /// Range selector
@@ -39,8 +39,8 @@ pub struct Arithmetization {
     pub(crate) w_a: Witness,
     /// Right wire witness.
     pub(crate) w_b: Witness,
-    /// Fourth wire witness.
-    pub(crate) w_d: Witness,
     /// Output wire witness.
     pub(crate) w_o: Witness,
+    /// Fourth wire witness.
+    pub(crate) w_d: Witness,
 }

src/composer/builder.rs

@@ -115,8 +115,8 @@ impl Composer for Builder {
         let q_l = *constraint.coeff(Selector::Left);
         let q_r = *constraint.coeff(Selector::Right);
         let q_o = *constraint.coeff(Selector::Output);
+        let q_4 = *constraint.coeff(Selector::Fourth);
         let q_c = *constraint.coeff(Selector::Constant);
-        let q_d = *constraint.coeff(Selector::Fourth);
 
         let q_arith = *constraint.coeff(Selector::Arithmetic);
         let q_range = *constraint.coeff(Selector::Range);
@@ -130,8 +130,8 @@ impl Composer for Builder {
             q_l,
             q_r,
             q_o,
+            q_4,
             q_c,
-            q_d,
             q_arith,
             q_range,
             q_logic,

src/composer/compiler.rs

@@ -117,8 +117,8 @@ impl Compiler {
         let mut q_l = vec![BlsScalar::zero(); size];
         let mut q_r = vec![BlsScalar::zero(); size];
         let mut q_o = vec![BlsScalar::zero(); size];
+        let mut q_4 = vec![BlsScalar::zero(); size];
         let mut q_c = vec![BlsScalar::zero(); size];
-        let mut q_d = vec![BlsScalar::zero(); size];
         let mut q_arith = vec![BlsScalar::zero(); size];
         let mut q_range = vec![BlsScalar::zero(); size];
         let mut q_logic = vec![BlsScalar::zero(); size];
@@ -130,8 +130,8 @@ impl Compiler {
             q_l[i] = c.q_l;
             q_r[i] = c.q_r;
             q_o[i] = c.q_o;
+            q_4[i] = c.q_4;
             q_c[i] = c.q_c;
-            q_d[i] = c.q_d;
             q_arith[i] = c.q_arith;
             q_range[i] = c.q_range;
             q_logic[i] = c.q_logic;
@@ -143,8 +143,8 @@ impl Compiler {
         let q_l_poly = domain.ifft(&q_l);
         let q_r_poly = domain.ifft(&q_r);
         let q_o_poly = domain.ifft(&q_o);
+        let q_4_poly = domain.ifft(&q_4);
         let q_c_poly = domain.ifft(&q_c);
-        let q_d_poly = domain.ifft(&q_d);
         let q_arith_poly = domain.ifft(&q_arith);
         let q_range_poly = domain.ifft(&q_range);
         let q_logic_poly = domain.ifft(&q_logic);
@@ -155,8 +155,8 @@ impl Compiler {
         let q_l_poly = Polynomial::from_coefficients_vec(q_l_poly);
         let q_r_poly = Polynomial::from_coefficients_vec(q_r_poly);
         let q_o_poly = Polynomial::from_coefficients_vec(q_o_poly);
+        let q_4_poly = Polynomial::from_coefficients_vec(q_4_poly);
         let q_c_poly = Polynomial::from_coefficients_vec(q_c_poly);
-        let q_d_poly = Polynomial::from_coefficients_vec(q_d_poly);
         let q_arith_poly = Polynomial::from_coefficients_vec(q_arith_poly);
         let q_range_poly = Polynomial::from_coefficients_vec(q_range_poly);
         let q_logic_poly = Polynomial::from_coefficients_vec(q_logic_poly);
@@ -173,8 +173,8 @@ impl Compiler {
         let q_l_poly_commit = commit_key.commit(&q_l_poly).unwrap_or_default();
         let q_r_poly_commit = commit_key.commit(&q_r_poly).unwrap_or_default();
         let q_o_poly_commit = commit_key.commit(&q_o_poly).unwrap_or_default();
+        let q_4_poly_commit = commit_key.commit(&q_4_poly).unwrap_or_default();
         let q_c_poly_commit = commit_key.commit(&q_c_poly).unwrap_or_default();
-        let q_d_poly_commit = commit_key.commit(&q_d_poly).unwrap_or_default();
         let q_arith_poly_commit =
             commit_key.commit(&q_arith_poly).unwrap_or_default();
         let q_range_poly_commit =
@@ -199,8 +199,8 @@ impl Compiler {
             q_l: q_l_poly_commit,
             q_r: q_r_poly_commit,
             q_o: q_o_poly_commit,
+            q_4: q_4_poly_commit,
             q_c: q_c_poly_commit,
-            q_4: q_d_poly_commit,
             q_arith: q_arith_poly_commit,
         };
 
@@ -252,8 +252,8 @@ impl Compiler {
             q_l: q_l_poly,
             q_r: q_r_poly,
             q_o: q_o_poly,
+            q_4: q_4_poly,
             q_c: q_c_poly,
-            q_4: q_d_poly,
             q_arith: q_arith_poly,
             q_range: q_range_poly,
             q_logic: q_logic_poly,
@@ -343,8 +343,8 @@ impl Compiler {
             q_l: (selectors.q_l.clone(), q_l_eval_8n.clone()),
             q_r: (selectors.q_r.clone(), q_r_eval_8n.clone()),
             q_o: (selectors.q_o, q_o_eval_8n),
-            q_c: (selectors.q_c.clone(), q_c_eval_8n.clone()),
             q_4: (selectors.q_4, q_4_eval_8n),
+            q_c: (selectors.q_c.clone(), q_c_eval_8n.clone()),
             q_arith: (selectors.q_arith, q_arith_eval_8n),
         };
 

src/composer/compiler/compress.rs

@@ -24,8 +24,8 @@ pub struct CompressedConstraint {
     pub polynomial: usize,
     pub w_a: usize,
     pub w_b: usize,
-    pub w_d: usize,
     pub w_o: usize,
+    pub w_d: usize,
 }
 
 #[derive(
@@ -36,8 +36,8 @@ pub struct CompressedPolynomial {
     pub q_l: usize,
     pub q_r: usize,
     pub q_o: usize,
+    pub q_4: usize,
     pub q_c: usize,
-    pub q_d: usize,
     pub q_arith: usize,
     pub q_range: usize,
     pub q_logic: usize,
@@ -108,17 +108,17 @@ impl CompressedCircuit {
                      q_l,
                      q_r,
                      q_o,
+                     q_4,
                      q_c,
-                     q_d,
                      q_arith,
                      q_range,
                      q_logic,
                      q_fixed_group_add,
                      q_variable_group_add,
                      w_a,
                      w_b,
-                     w_d,
                      w_o,
+                     w_d,
                  }| {
                     let len = scalars.len();
                     let q_m = *scalars.entry(q_m).or_insert(len);
@@ -129,9 +129,9 @@ impl CompressedCircuit {
                     let len = scalars.len();
                     let q_o = *scalars.entry(q_o).or_insert(len);
                     let len = scalars.len();
-                    let q_c = *scalars.entry(q_c).or_insert(len);
+                    let q_4 = *scalars.entry(q_4).or_insert(len);
                     let len = scalars.len();
-                    let q_d = *scalars.entry(q_d).or_insert(len);
+                    let q_c = *scalars.entry(q_c).or_insert(len);
                     let len = scalars.len();
                     let q_arith = *scalars.entry(q_arith).or_insert(len);
                     let len = scalars.len();
@@ -149,8 +149,8 @@ impl CompressedCircuit {
                         q_l,
                         q_r,
                         q_o,
+                        q_4,
                         q_c,
-                        q_d,
                         q_arith,
                         q_range,
                         q_logic,
@@ -166,8 +166,8 @@ impl CompressedCircuit {
                         polynomial,
                         w_a: w_a.index(),
                         w_b: w_b.index(),
-                        w_d: w_d.index(),
                         w_o: w_o.index(),
+                        w_d: w_d.index(),
                     }
                 },
             )
@@ -257,8 +257,8 @@ impl CompressedCircuit {
                 polynomial,
                 w_a,
                 w_b,
-                w_d,
                 w_o,
+                w_d,
             },
         ) in constraints.into_iter().enumerate()
         {
@@ -267,8 +267,8 @@ impl CompressedCircuit {
                 q_l,
                 q_r,
                 q_o,
+                q_4,
                 q_c,
-                q_d,
                 q_arith,
                 q_range,
                 q_logic,
@@ -295,12 +295,12 @@ impl CompressedCircuit {
                 .get(q_o)
                 .copied()
                 .ok_or(Error::InvalidCompressedCircuit)?;
-            let q_c = scalars
-                .get(q_c)
+            let q_4 = scalars
+                .get(q_4)
                 .copied()
                 .ok_or(Error::InvalidCompressedCircuit)?;
-            let q_d = scalars
-                .get(q_d)
+            let q_c = scalars
+                .get(q_c)
                 .copied()
                 .ok_or(Error::InvalidCompressedCircuit)?;
             let q_arith = scalars
@@ -326,25 +326,25 @@ impl CompressedCircuit {
 
             let w_a = Witness::new(w_a);
             let w_b = Witness::new(w_b);
-            let w_d = Witness::new(w_d);
             let w_o = Witness::new(w_o);
+            let w_d = Witness::new(w_d);
 
             let mut constraint = Constraint::default()
                 .set(Selector::Multiplication, q_m)
                 .set(Selector::Left, q_l)
                 .set(Selector::Right, q_r)
                 .set(Selector::Output, q_o)
+                .set(Selector::Fourth, q_4)
                 .set(Selector::Constant, q_c)
-                .set(Selector::Fourth, q_d)
                 .set(Selector::Arithmetic, q_arith)
                 .set(Selector::Range, q_range)
                 .set(Selector::Logic, q_logic)
                 .set(Selector::GroupAddFixedBase, q_fixed_group_add)
                 .set(Selector::GroupAddVariableBase, q_variable_group_add)
                 .a(w_a)
                 .b(w_b)
-                .d(w_d)
-                .o(w_o);
+                .o(w_o)
+                .d(w_d);
 
             if let Some(idx) = public_inputs.get(pi) {
                 if idx == &i {

src/composer/prover.rs

@@ -281,7 +281,7 @@ impl Prover {
         // Add wire polynomial commitments to transcript
         transcript.append_commitment(b"a_w", &a_w_poly_commit);
         transcript.append_commitment(b"b_w", &b_w_poly_commit);
-        transcript.append_commitment(b"c_w", &o_w_poly_commit);
+        transcript.append_commitment(b"o_w", &o_w_poly_commit);
         transcript.append_commitment(b"d_w", &d_w_poly_commit);
 
         // round 2
@@ -420,7 +420,7 @@ impl Prover {
         // add evaluations to transcript.
         transcript.append_scalar(b"a_eval", &evaluations.proof.a_eval);
         transcript.append_scalar(b"b_eval", &evaluations.proof.b_eval);
-        transcript.append_scalar(b"c_eval", &evaluations.proof.c_eval);
+        transcript.append_scalar(b"o_eval", &evaluations.proof.o_eval);
         transcript.append_scalar(b"d_eval", &evaluations.proof.d_eval);
         transcript
             .append_scalar(b"a_next_eval", &evaluations.proof.a_next_eval);
@@ -495,7 +495,7 @@ impl Prover {
         let proof = Proof {
             a_comm: a_w_poly_commit,
             b_comm: b_w_poly_commit,
-            c_comm: o_w_poly_commit,
+            o_comm: o_w_poly_commit,
             d_comm: d_w_poly_commit,
 
             z_comm: z_poly_commit,