@@ -66,6 +66,7 @@ jobs:
           python3 -m unittest proof-methods/vole/test_acir_to_sieve.py
           python3 -m py_compile proof-methods/acir/blake3_leaf.py proof-methods/acir/tamper.py
           bash -n proof-methods/acir/run.sh
+          bash -n proof-methods/acir/gates.sh
           python3 -m unittest proof-methods/acir/test_blake3_leaf.py
 
       - name: Measurement example runs
 
@@ -42,16 +42,25 @@ is written, and from writing ACIR by hand. `circuits/baseline` calls `full_u64_c
 # nargo and bb at the versions CI pins for zk/compose
 NARGO=nargo BB=bb proof-methods/acir/run.sh 0 9 10 999999999999999999 \
   1000000000000000000 9999999999999999999 10000000000000000000 18446744073709551615
-bb gates -s ultra_honk -b proof-methods/acir/circuits/target/hand.json
-BB=bb python3 proof-methods/acir/tamper.py 30
+BB=bb proof-methods/acir/gates.sh
+for c in hand noir_var noir_tuned; do BB=bb python3 proof-methods/acir/tamper.py "$c" 15; done
 python3 -m unittest proof-methods/acir/test_blake3_leaf.py
 ```
 
 `run.sh` proves and verifies all four circuits for the given values, with
 bounds that do not reveal them. It does not pin tool versions or thread
 counts; compare timings only from one machine and one toolchain.
-`tamper.py` changes one witness of the hand-written circuit at a time and
-checks that the proof fails. Measurements are kept outside the repository.
+`gates.sh` prints each circuit's UltraHonk gate count. `tamper.py` changes
+one prover-chosen witness at a time (in the hand-written circuit, an appended
+witness; in the Noir circuits, a hint output, sampled per hint function) and
+checks that the proof fails. It is a smoke test for hint outputs the circuit
+leaves unconstrained, not evidence that the constraints are complete: it does
+not re-solve the witnesses that depend on the changed one, so a rejection can
+come from those stale values rather than from the hint's own constraints, and
+it samples rather than covering every call site. Completeness rests on review
+of the generator and the Noir source, and, for the hand-written additions, on
+the unit test that bounds every addition result. Measurements are kept
+outside the repository.
 
 Research prototype, not externally audited. It covers the unsigned opening
 only; `full_i64_check` has the same structure.
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Prints the UltraHonk gate count of each circuit run.sh built, one JSON
+# object per line. Run run.sh first; leaf::N sets the number of openings.
+set -euo pipefail
+cd "$(dirname "$0")/circuits"
+BB=${BB:-bb}
+n=$(sed -n 's/^pub global N: u32 = \([0-9]*\);/\1/p' leaf/src/lib.nr)
+for p in baseline noir_var noir_tuned spliced hand; do
+  gates=$("$BB" gates -s ultra_honk -b "target/$p.json" 2>/dev/null \
+    | python3 -c 'import json,sys; print(json.load(sys.stdin)["functions"][0]["circuit_size"])')
+  printf '{"circuit": "%s", "openings": %s, "ultra_honk_gates": %s}\n' "$p" "$n" "$gates"
+done
@@ -1,12 +1,27 @@
 #!/usr/bin/env python3
-"""Soundness spot check for the hand-written opening, after run.sh.
+"""Smoke test for unconstrained hint outputs in the openings, after run.sh.
 
-Changes one witness of circuits/target/hand.gz at a time (adds 1) and checks
-that UltraHonk proving or verification fails. XOR outputs are skipped:
-Barretenberg recomputes them from the inputs, so changing one in the witness
-file changes nothing.
+Changes one prover-chosen witness of circuits/target/CIRCUIT.gz at a time
+(adds 1) and checks that UltraHonk proving or verification fails:
 
-Usage: tamper.py SAMPLES [SEED]   (BB names the bb binary, default `bb`)
+- hand: any witness the generator appended (digits, selectors, rotation and
+  carry splits, message words, digest bytes);
+- noir_var, noir_tuned: any output of an unconstrained (Brillig) hint,
+  sampled per hint function, so the rotation (`split`) and carry
+  (`carry_split`) hints of noir_tuned and the compiler's division and
+  inverse hints are each exercised. An inverse hint whose input is zero is
+  skipped: an is-zero check leaves it free by design.
+
+This does not show that the constraints are complete. Witnesses that depend
+on the changed one are not re-solved, so a change can be rejected by an
+equation further on that sees a stale value, even if the hint's own range
+check were missing; and each group is sampled, not every call site.
+
+XOR outputs are skipped: Barretenberg recomputes them from the inputs, so
+changing one in the witness file changes nothing.
+
+Usage: tamper.py CIRCUIT SAMPLES [SEED]   (SAMPLES per group; BB names the bb
+binary, default `bb`)
 """
 
 import base64
@@ -28,42 +43,85 @@ def load(path):
         return m.unpack(gzip.decompress(f.read()))
 
 
-def accepted(witness):
+def accepted(circuit, witness):
     path, out = os.path.join(T, "tamper.gz"), os.path.join(T, "tamper")
     with open(path, "wb") as f:
         f.write(gzip.compress(m.pack([[[0, witness]]])))
     os.makedirs(out, exist_ok=True)
-    vk = os.path.join(T, "proof-hand", "vk")
+    vk = os.path.join(T, f"proof-{circuit}", "vk")
 
     def run(*args):
         return subprocess.run([BB, *args], capture_output=True, check=False).returncode == 0
 
-    return run("prove", "-s", "ultra_honk", "-b", os.path.join(T, "hand.json"), "-w", path,
+    return run("prove", "-s", "ultra_honk", "-b", os.path.join(T, f"{circuit}.json"), "-w", path,
                "-k", vk, "-o", out) and \
         run("verify", "-s", "ultra_honk", "-p", os.path.join(out, "proof"), "-k", vk,
             "-i", os.path.join(out, "public_inputs"))
 
 
+def value(expr, witness):
+    products, linear, const = expr
+    v = int.from_bytes(const, "big")
+    for q, a, b in products:
+        v += int.from_bytes(q, "big") * int.from_bytes(witness[a], "big") * int.from_bytes(witness[b], "big")
+    for q, a in linear:
+        v += int.from_bytes(q, "big") * int.from_bytes(witness[a], "big")
+    return v % m.P
+
+
+def hint_outputs(program, witness):
+    """Outputs of each unconstrained (Brillig) hint, grouped by function name.
+
+    The inverse hint of an is-zero check is free when its input is zero (any
+    value satisfies the check, and nothing else reads it), so those are left
+    out."""
+    names = [f[0] for f in program[1]]
+    groups = {}
+    for op in program[0][0][2]:
+        if "BrilligCall" in op:
+            fid, inputs, outputs = op["BrilligCall"][:3]
+            if names[fid] == "directive_invert" and value(inputs[0]["Single"], witness) == 0:
+                continue
+            out = groups.setdefault(names[fid], set())
+            for item in outputs:
+                if "Simple" in item:
+                    out.add(item["Simple"])
+                else:
+                    out.update(item["Array"])
+    return groups
+
+
 def main():
-    samples = int(sys.argv[1])
-    random.seed(int(sys.argv[2]) if len(sys.argv) > 2 else 1)
-    with open(os.path.join(T, "hand.json"), encoding="utf-8") as f:
+    circuit, samples = sys.argv[1], int(sys.argv[2])
+    random.seed(int(sys.argv[3]) if len(sys.argv) > 3 else 1)
+    with open(os.path.join(T, f"{circuit}.json"), encoding="utf-8") as f:
         artifact = json.load(f)
-    opcodes = m.unpack(gzip.decompress(base64.b64decode(artifact["bytecode"])))[0][0][2]
-    xor_out = {op["BlackBoxFuncCall"]["XOR"][3] for op in opcodes
+    program = m.unpack(gzip.decompress(base64.b64decode(artifact["bytecode"])))
+    xor_out = {op["BlackBoxFuncCall"]["XOR"][3] for op in program[0][0][2]
                if "XOR" in op.get("BlackBoxFuncCall", {})}
-    first = max(load(os.path.join(T, "spliced.gz"))[0][0][1]) + 1
-    witness = load(os.path.join(T, "hand.gz"))[0][0][1]
-    assert accepted(witness), "the untampered witness must prove and verify"
-    added = sorted(k for k in witness if k >= first and k not in xor_out)
-    bad = []
-    for k in random.sample(added, samples):
-        w = dict(witness)
-        w[k] = m.fb(int.from_bytes(w[k], "big") + 1)
-        if accepted(w):
-            bad.append(k)
-    print(json.dumps({"tampered": samples, "accepted": bad}))
-    sys.exit(1 if bad else 0)
+    witness = load(os.path.join(T, f"{circuit}.gz"))[0][0][1]
+    assert accepted(circuit, witness), "the untampered witness must prove and verify"
+    if circuit == "hand":
+        first = max(load(os.path.join(T, "spliced.gz"))[0][0][1]) + 1
+        groups = {"appended": {k for k in witness if k >= first}}
+    else:
+        groups = hint_outputs(program, witness)
+    report = {}
+    failed = False
+    # Up to SAMPLES changes per group, so every kind of hint is exercised.
+    for name, chosen in sorted(groups.items()):
+        candidates = sorted(chosen - xor_out)
+        picked = random.sample(candidates, min(samples, len(candidates)))
+        bad = []
+        for k in picked:
+            w = dict(witness)
+            w[k] = m.fb(int.from_bytes(w[k], "big") + 1)
+            if accepted(circuit, w):
+                bad.append(k)
+        report[name] = {"candidates": len(candidates), "tampered": len(picked), "accepted": bad}
+        failed |= bool(bad)
+    print(json.dumps({"circuit": circuit, "groups": report}))
+    sys.exit(1 if failed else 0)
 
 
 if __name__ == "__main__":