fix(zkcc): use interleaved schema ordering matching native witness layout

The BIP340 schema (make_bip340_schema) built private entries grouped by
array type (all bits_s, then all int_sx, etc.), but the native witness
in lfzk_bindings.cc is interleaved per iteration: bits_s[i], int_sx[i],
int_sy[i], int_sz[i].  This mismatch caused named-input resolution via
build_witness_inputs to assign wrong indices, making proof generation
fail with "eval_circuit failed".

Additionally, private entry indices were relative to the private
sub-table (starting at 1), colliding with public input indices.
Fix: interleaved ordering with absolute 1-based indices matching
v_[1..N] in the dense witness array.

Add regression test proving vector 0 through build_witness_inputs
with named keys, exercising the interleaved schema mapping path.

Author: jaromil

src/lua/crypto_zkcc.lua

@@ -631,51 +631,63 @@ end
 
 M.named_logic = new_named_logic
 
-local function repeat_named_entries(entries, prefix, count, kind, input_type)
-    for i = 1, count do
-        entries[#entries + 1] = {
+local function make_bip340_schema(artifact)
+    -- Builds the schema for the native BIP340 verification circuit.
+    -- Entries are ordered and indexed to match Bip340Verify::Witness::input()
+    -- in lfzk_bindings.cc: interleaved bits_s[i], int_sx[i], int_sy[i],
+    -- int_sz[i] (one iteration per i), then e·P trace (also interleaved),
+    -- then py, ry, rz_inv, bits_ry.
+    -- Indices are 1-based absolute positions in the dense witness array.
+
+    local public = {}
+    local private = {}
+    local full = {}
+    local seq = 1 -- 1-based absolute index; v_[0] is the constant-1
+
+    local function add(list, name, kind, input_type)
+        list[#list + 1] = {
             kind = kind,
-            name = string.format("%s_%03d", prefix, i),
+            name = name,
             type = input_type,
-            desc = prefix,
-            index = #entries + 1,
-            decl_order = #entries + 1,
+            desc = name,
+            index = seq,
+            decl_order = seq,
         }
+        seq = seq + 1
     end
-end
 
-local function append_named_entry(entries, name, kind, input_type)
-    entries[#entries + 1] = {
-        kind = kind,
-        name = name,
-        type = input_type,
-        desc = name,
-        index = #entries + 1,
-        decl_order = #entries + 1,
-    }
-end
+    -- Public inputs: v_[1..3]
+    add(public, "rx", "public", "field")
+    add(public, "px", "public", "field")
+    add(public, "e", "public", "field")
 
-local function make_bip340_schema(artifact)
-    local public = {}
-    local private = {}
-    local full = {}
+    -- Private: s·G trace (interleaved)
+    for i = 1, 256 do
+        add(private, string.format("bits_s_%03d", i), "private", "field")
+        if i < 256 then
+            add(private, string.format("int_sx_%03d", i), "private", "field")
+            add(private, string.format("int_sy_%03d", i), "private", "field")
+            add(private, string.format("int_sz_%03d", i), "private", "field")
+        end
+    end
 
-    append_named_entry(public, "rx", "public", "field")
-    append_named_entry(public, "px", "public", "field")
-    append_named_entry(public, "e", "public", "field")
-
-    repeat_named_entries(private, "bits_s", 256, "private", "field")
-    repeat_named_entries(private, "int_sx", 255, "private", "field")
-    repeat_named_entries(private, "int_sy", 255, "private", "field")
-    repeat_named_entries(private, "int_sz", 255, "private", "field")
-    repeat_named_entries(private, "bits_e", 256, "private", "field")
-    repeat_named_entries(private, "int_ex", 255, "private", "field")
-    repeat_named_entries(private, "int_ey", 255, "private", "field")
-    repeat_named_entries(private, "int_ez", 255, "private", "field")
-    append_named_entry(private, "py", "private", "field")
-    append_named_entry(private, "ry", "private", "field")
-    append_named_entry(private, "rz_inv", "private", "field")
-    repeat_named_entries(private, "bits_ry", 256, "private", "field")
+    -- Private: e·P trace (interleaved)
+    for i = 1, 256 do
+        add(private, string.format("bits_e_%03d", i), "private", "field")
+        if i < 256 then
+            add(private, string.format("int_ex_%03d", i), "private", "field")
+            add(private, string.format("int_ey_%03d", i), "private", "field")
+            add(private, string.format("int_ez_%03d", i), "private", "field")
+        end
+    end
+
+    add(private, "py", "private", "field")
+    add(private, "ry", "private", "field")
+    add(private, "rz_inv", "private", "field")
+
+    for i = 1, 256 do
+        add(private, string.format("bits_ry_%03d", i), "private", "field")
+    end
 
     local schema = {
         public = public,

test/lua/zkcc_bip340.lua

@@ -146,6 +146,81 @@ local loaded = zkcc.load_circuit_artifact_bip340(circuit_bytes)
 print(string.format("Circuit size: %d bytes, inputs=%d, public=%d",
     #circuit_bytes, circuit.ninput - 1, circuit.npub_input - 1))
 
+-- ===========================================================================
+-- Regression: prove vector 0 via build_witness_inputs with named keys.
+-- This exercises the interleaved schema mapping path (fix for named-input
+-- ordering: schema must match Bip340Verify::Witness::input() in
+-- lfzk_bindings.cc).
+-- ===========================================================================
+print("=== Named-input regression test (vector 0) ===")
+
+local sig0 = OCTET.from_hex("E907831F80848D1069A5371B402410364BDF1C5F8307B0084C55F1CE2DCA821525F66A4A85EA8B71E482A74F382D2CE5EBEEE8FDB2172F477DF4900D310536C0")
+local pk0  = OCTET.from_hex("F9308A019258C31049344F85F89D5229B531C845836F99B08601F113BCE036F9")
+local msg0 = OCTET.from_hex("0000000000000000000000000000000000000000000000000000000000000000")
+local seed0 = OCTET.from_hex("0000000000000000000000000000000000000000000000000000000000000001")
+
+-- Obtain field-element OCTETs from bip340_compute (direct call, no pcall)
+local w = zkcc.witness.bip340_compute(sig0, pk0, msg0)
+
+-- Build a named-inputs table matching the interleaved schema order
+local named = {
+    rx = w.rx,
+    px = w.px,
+    e  = w.e,
+}
+for i = 1, 256 do
+    named[string.format("bits_s_%03d", i)] = w.bits_s[i]
+    if i < 256 then
+        named[string.format("int_sx_%03d", i)] = w.int_sx[i]
+        named[string.format("int_sy_%03d", i)] = w.int_sy[i]
+        named[string.format("int_sz_%03d", i)] = w.int_sz[i]
+    end
+end
+for i = 1, 256 do
+    named[string.format("bits_e_%03d", i)] = w.bits_e[i]
+    if i < 256 then
+        named[string.format("int_ex_%03d", i)] = w.int_ex[i]
+        named[string.format("int_ey_%03d", i)] = w.int_ey[i]
+        named[string.format("int_ez_%03d", i)] = w.int_ez[i]
+    end
+end
+named.py = w.py
+named.ry = w.ry
+named.rz_inv = w.rz_inv
+for i = 1, 256 do
+    named[string.format("bits_ry_%03d", i)] = w.bits_ry[i]
+end
+
+-- Build witness inputs from named keys
+local named_inputs = zkcc.build_witness_inputs{
+    circuit = loaded,
+    inputs = named,
+}
+local named_public = zkcc.build_witness_inputs{
+    circuit = loaded,
+    public_inputs = { rx = w.rx, px = w.px, e = w.e },
+}
+
+-- Prove and verify through the named path
+local named_proof = zkcc.prove_circuit{
+    circuit = loaded,
+    inputs = named_inputs,
+    seed = seed0,
+}
+assert(named_proof and #named_proof > 0, "named-input proof generation failed")
+
+local named_ok = zkcc.verify_circuit{
+    circuit = loaded,
+    proof = named_proof,
+    public_inputs = named_public,
+    seed = seed0,
+}
+assert(named_ok, "named-input verification failed")
+print("  named-input prove+verify: ok")
+
+-- ===========================================================================
+-- Main BIP340 vector sweep
+-- ===========================================================================
 local vectors = load_vectors()
 assert(#vectors > 0, "missing BIP340 test vectors")