Achievement Review — Proving Nothing vs its Learning Objectives

The same five personas who authored learnobjectives.md read all 14 chapters sequentially (~137,000 words each) and scored the book against their own goals, 0–10 per goal with quoted evidence; a chapter score is the mean of its goal scores. Full per-goal verdicts follow the matrix. Raw persona reviews: graphify-out/.personas/review-*.md.

Scoring matrix

Chapter	Crypto	Educator	Engineer	Assessor	Economist	Mean
Chapter 1	4.0	7.5	5.8	9.8	6.8	6.8
Chapter 2	5.5	9.0	6.0	10.0	8.3	7.8
Chapter 3	5.3	8.5	6.5	8.8	7.5	7.3
Chapter 4	6.8	9.8	8.0	9.5	7.5	8.3
Chapter 5	7.0	7.0	8.3	9.8	7.0	7.8
Chapter 6	6.5	9.5	8.3	10.0	6.5	8.2
Chapter 7	7.8	8.8	7.5	9.8	8.0	8.4
Chapter 8	8.0	9.0	8.0	10.0	9.5	8.9
Chapter 9	6.0	9.3	6.5	9.3	6.0	7.4
Chapter 10	6.8	9.8	7.3	10.0	7.5	8.3
Chapter 11	6.8	8.3	6.8	9.3	5.8	7.4
Chapter 12	4.3	5.0	5.0	6.0	3.5	4.8
Chapter 13	6.5	7.0	7.0	9.5	8.3	7.7
Chapter 14	5.3	7.0	6.3	9.5	6.5	6.9
Persona mean	6.2	8.2	7.0	9.4	7.0	7.6

Book-wide achievement: 7.6/10. Strongest chapter: Chapter 8: Layer 7 -- The Verdict (8.9). Weakest: Chapter 12: Midnight -- The Privacy Theater (4.8).

Findings the panel converged on

Chapter 12 (Midnight) is the unanimous floor — every persona scored it lowest or near-lowest (3.5–6.0): the Zswap protocol named in the objectives never appears in the chapter (grep-verified: it appears only in chapters 2, 3, and 7), nullifier treatment is thin, the author's own IOG/Midnight position goes unexamined, and vendor documentation is cited as verification.
The 4×4 Sudoku thread thins after chapter 6 and vanishes from chapters 7, 8, 11, and 13 (educator), weakening the book's own signature pedagogical device exactly where the material gets hardest.
Narration where rigor was demanded (cryptographer, 6.2 mean): the sum-check soundness proof, the ZK simulator, and every security game are absent — the book consistently teaches about the theorems rather than the theorems.
Strong operational grounding in the core craft chapters (engineer: 8.3 on chapters 5–6) but whitepaper-level treatment elsewhere; the Airbender field ambiguity the graph flagged resolves to an unsourced in-table assertion of M31, with ZisK as Goldilocks.
Governance economics is a genuine strength (economist: 9.5 on chapter 8, 8.3 on chapters 2 and 13): ceremonies, the capex/opex frame, and verifier governance carry real analytical content rather than name-drops.
Assessment readiness is high overall (assessor: 9.4 mean) — most chapters supply what a student needs to produce the specified evidence of mastery; chapter 12 is again the exception (6.0).

Chapter 1: The Promise of Provable and Programmable Secrets

Chapter mean: 6.8/10

Prof. Elena Vasquez — Theoretical Cryptographer — 4.0/10

[4/10] Define an Interactive Proof system exactly as GMR 1985 does… — GMR is cited with venue and pages and completeness/soundness are named ("the honest succeed," "the dishonest fail," $2^{128}$), but there is no probabilistic game, no PPT verifier, and no explicit acceptance probabilities or soundness error anywhere in "The Proof at the Door."
[3/10] Define the Zero-Knowledge Property via the simulation paradigm: exhibit the… — Simulation gets exactly one sentence ("The proof is simulatable: anyone could generate something that looks identical") with no simulator construction, no perfect/statistical/computational distinction, and no statement that ZK is a property of the verifier's view.
[3/10] State the Fiat-Shamir Transform (deg 8) precisely as it… — The transform is narrated ("replace the verifier with a hash function… turned a conversation into a calculation") with the 1986 citation, but the public-coin restriction, the random-oracle theorem, and the un-proven status under concrete hash instantiation are all absent.
[6/10] Read the Seven-Layer Model and the Trust-Minimized (vs Trustless)… — The chapter itself concedes "the word 'trustless' is marketing," walks per-layer trust in "The Deepest Question," and flags Layers 1/7 as social versus 2–6 as mathematical with "the map is provisional," but never does the promised SNARK-vs-STARK layer-by-layer assumption-with-reduction audit.

Dr. Sam Okafor — Mathematics Educator — 7.5/10

[4/10] Own the interactive-proof intuition before any formalism (GMR 1985)… — The interaction-plus-randomness insight is stated ("The verifier asks random questions... each individual answer, taken alone, is meaningless"), but the anchor is the bouncer/ID scenario, the 4x4 Sudoku appears only as a late preview in "The First Decision," and students never physically play verifier for even one round before "completeness" and "soundness" are named.
[7/10] Hold completeness, soundness, and the zero-knowledge property as three separate promises… — "The Proof at the Door" gives each property its own paragraph with its own precise content ("the honest succeed," 2^128 soundness, simulatability), so the three never blur — but they are made visible in the bar scenario, not in the Sudoku game I specified.
[9/10] Internalize the Seven-Layer Model as the book's map, not a theorem… — "The Seven Layers at a Glance" lays out all seven with per-layer chapter pointers, flags the map as provisional ("The map is provisional. The territory is more tangled."), and "The First Decision" traces the Sudoku through program/witness/constraints/proof so students can point layers at it.
[10/10] Stuck-point: students must be able to articulate why "trust-minimized" is NOT… — Addressed head-on in the opening pages ("The word 'trustless' is marketing. The accurate word is 'trust-minimized.'") and then made concrete in "The Deepest Question," which names one testable trust assumption per layer.

Priya Raghavan — ZK Systems Engineer — 5.8/10

[3/10] Implement the 4x4 Sudoku running example as an… — The puzzle grid, the three properties, and the Fiat-Shamir idea (hash replaces the live verifier) are all present, but there is no protocol mechanics, no code, and no per-round soundness-error arithmetic, so a student could not build the interactive proof or measure rounds-to-2^-40 from this chapter alone.
[4/10] Take one production stack you can run today (say… — The seven layers are vividly defined with real systems placed at each (Groth16's 192-byte G1/G1/G2 structure on BLS12-381, Jolt's layer fusion, Cairo co-design), but no on-disk artifacts (.r1cs, SRS, .wtns) are named, so the decomposition stays a diagram, not an ls listing.
[9/10] Argue the Trust-Minimized (vs Trustless) thesis with receipts:… — "The Deepest Question" delivers exactly this: KZG Summoning's 141,416 participants (L1), Tornado Cash = vs <== plus the Chaliasos 67% underconstrained stat (L2), the Zcash Groth16 timing leak (L3), the measured 10,000x-50,000x overhead tax (L4/5), BN254's 128-to-~100-bit erosion (L6), and Beanstalk's $182M governance drain with the honest ~$80M-netted caveat (L7), all cited.
[7/10] Read GMR 1985 and Fiat-Shamir 1986 (the two… — Both papers are cited with full venue detail and the interactive-proof mechanism (random challenges, statistically independent answers) is stated crisply, but the chapter never names what Fiat-Shamir actually trades away (random-oracle-model security, the weak-FS transcript-binding hazard), only gesturing that the hash "plays the verifier's role."

Dr. Marisol Chen — Assessment Designer — 9.8/10

[10/10] Define a zero-knowledge proof by stating its three properties… — The chapter explicitly names and explains completeness, soundness, and zero-knowledge in "The Proof at the Door" and ties them to the GMR 1985 paper by title and venue, fully supporting a closed-book graded paragraph.
[9/10] List the seven layers of the Seven-Layer Model… — All seven layers appear labeled and in order in "The Seven Layers at a Glance," but they are presented as prose headings rather than the labeled stack diagram my evidence artifact asks students to reproduce, so the diagram itself must be inferred.
[10/10] Explain the Fiat-Shamir Transform in the student's own words… — The 1986 Fiat-Shamir passage states verbatim that the prover "replace[s] the verifier with a hash function" and that "the hash function plays the verifier's role," exactly the substitute-verifier account the objective requires.
[10/10] Paraphrase the book's trust-minimized-versus-trustless thesis… — The chapter states the thesis twice ("trustless is marketing; the accurate word is trust-minimized") and walks all seven trust assumptions in "The Deepest Question," giving a peer-restatable account.

Prof. David Lindqvist — Political Economist of Trust — 6.8/10

[9/10] Students must be able to prosecute the word "trustless"… — The chapter states almost verbatim that "trustless is marketing" and "trust-minimized" is accurate, names the monolithic trust (bank, platform, government), enumerates all seven weaker assumptions, and even flags that "independently replaceable" holds only in principle because of inter-layer coupling.
[6/10] Students must be able to read completeness, soundness, and zero-knowledge… — All three properties are vividly taught through the bouncer scenario with real stakes (honest users turned away, 2^128 forgery cost), but the counterparty insurance framing — soundness insures the verifier, zero-knowledge insures the prover, who bears residual loss on failure — remains implicit rather than argued as a risk-allocation contract.
[5/10] Students must be able to analyze the Fiat-Shamir transform as a personnel… — The personnel change is there almost literally ("the hash function plays the verifier's role... without being present"), but the price of the hire — the random oracle model as a new assumption and the weak-Fiat-Shamir failure mode purchased in exchange — is entirely absent, with security simply asserted.
[7/10] Using the Seven-Layer Model as an institutional org chart, students… — "The Deepest Question" section names the trusted occupant of every layer's seat (141,416 ceremony participants, the circuit author with the 67% Chaliasos figure, the multisig committee at Layer 7), but replacement cost in capex, coordination, or migration pain is priced only for Layers 1 and 6 and deferred elsewhere; eIDAS 2.0 and L2Beat carry real analytical content here, and the Midnight/IOG conflict is disclosed with a stated verifiability commitment rather than left unexamined.

Chapter 2: Layer 1 -- Building the Stage

Chapter mean: 7.8/10

Prof. Elena Vasquez — Theoretical Cryptographer — 5.5/10

[4/10] Define a Structured Reference String and Toxic Waste (Trapdoor) formally… — The SRS algebra $[s]G, [s^2]G, \ldots$ appears in "How the Algebra Works" and BCTV14 is correctly diagnosed ("the mathematical security proof… had a gap" from extra SRS elements), but no evaluation-binding theorem, no q-type assumption is named, and trapdoor equivocation is asserted ("they can forge unlimited proofs") rather than proven.
[6/10] Formalize the 1-of-N Trust Model as a security game… — The multiplicative argument ($s = \tau_1 \cdot \tau_2 \cdots \tau_N$, "a product of unknowns is unknown") is a genuine proof sketch, the ADOPT framework applies Wang-Cohney-Bonneau to Sprout/Sapling/KZG concretely, and preconditions (side channels, backups, subverted destruction) are surfaced — but no adversary-corrupts-N−1 game is ever written down, capping this at the gesture ceiling.
[6/10] Distinguish Universal vs Circuit-Specific Setup with Sonic as… — Sonic is explicitly "the ancestor" of universal setups with deterministic public per-circuit derivation, and the setup-spectrum table cleanly separates the collision-resistance assumption class from discrete log, but updatability appears only inside quoted paper titles and what it buys is never explained.
[6/10] Analyze the Quantum Shelf Life of Trusted Setups against… — Quantum shelf life, HNDL (with the FEDS working paper), and the Capex/Opex framing honestly labeled economic ("meant to anchor the arithmetic") are all present, but the chapter conflates trapdoor-extraction forgery with "every shielded transaction… becomes retroactively decryptable," skipping exactly the forge-versus-retroactive-hiding separation I demanded.

Dr. Sam Okafor — Mathematics Educator — 9.0/10

[10/10] Own the picture of the Structured Reference String as a stage… — "How the Algebra Works" builds the powers-of-tau ruler ($[s]G, [s^2]G, \ldots$) and forgery consequence ("prove that 2+2=5"), and the ceremony is traced through named individual contributions: Peter Todd's furnace, Andrew Miller's volatile RAM, and the thirty-second browser secret.
[10/10] Own the 1-of-N intuition through the concrete arc from Zcash Sprout… — The 2016-six-participants-to-2023-141,416 arc is the chapter's spine, with the "141,416-Person Question" section and the explicit callback "The accurate word is 'trust-minimized.' This distinction matters, and it will recur at every layer."
[6/10] Stuck-point: students must be able to articulate why a compromised trusted setup… — The consequence is consistently and correctly framed as forgery ("unlimited counterfeiting," CVE-2019-7167, "becomes forgeable if a quantum computer extracts the trapdoor"), but the chapter never states head-on that a ceremony compromise is NOT a privacy leak, and the adjacent HNDL passage ("shielded transactions could become tomorrow's open records") sits unlabeled next to the trapdoor story, inviting exactly the soundness/privacy fusion I warned about.
[10/10] Understand the capex/opex economics of why ceremonies persist despite transparent… — "The Capex/Opex Framework" runs the amortization arithmetic ($750/day Groth16 vs $11,000/day raw STARK for 1,000 proofs), and the hybrid STARK-to-SNARK pipeline is previewed as promised ("transparent on the inside, compact on the outside -- is the dominant production pattern in 2026").

Priya Raghavan — ZK Systems Engineer — 6.0/10

[4/10] Run a local powers-of-tau ceremony end-to-end with snarkjs:… — The 1-of-N multiplicative algebra ([s]G powers, tau products) and ceremony history (Sprout's furnaces through KZG's 141,416 browser contributions with per-contribution timings) are excellent, but there is no snarkjs, no commands, and no named on-disk artifact, so the student cannot actually run one.
[5/10] Demonstrate why the trapdoor matters by forging: given a… — CVE-2019-7167/BCTV14 gets a dedicated section explaining the extra SRS elements, the three-year exposure window, and the indistinguishable-forgery consequence, but the forgery itself is never constructed — no equations, no exercise — so it stays a story rather than a demo.
[6/10] Benchmark the Universal vs Circuit-Specific tradeoff: change one constraint… — The Capex/Opex framework lands with real numbers (200-300k gas Groth16 vs 2-5M gas STARK, the $274k/yr vs $4M/yr 1000-proofs/day arithmetic, per-circuit derivation "in seconds" via compactc, 2.5-hour Sapling contributions), but the change-one-constraint re-ceremony timing experiment is never staged.
[9/10] Trace the Hybrid STARK-to-SNARK Pipeline (the dominant 2026… — Exactly delivered: the inner-transparent/outer-Groth16 pattern is named as the 2026 dominant architecture with SP1/Stwo/RISC Zero/Airbender/ZisK instances, the outer KZG wrapper is explicitly identified as the reintroduced ceremony dependence, and the HNDL section says precisely what an adversary archives today (the public SRS), backed by NIST IR 8547, CNSA 2.0, and the Fed's FEDS 2025-093 paper.

Dr. Marisol Chen — Assessment Designer — 10.0/10

[10/10] Describe the purpose of a Trusted Setup Ceremony and… — The SRS section defines the string, names the trapdoor "toxic waste," and states explicitly that anyone retaining it "can forge proofs of false statements," giving everything the written account requires.
[10/10] Summarize the 1-of-N trust model, with mastery shown by… — The chapter covers both named ceremonies (Sprout's six participants, KZG's 141,416) and derives the 1-of-N guarantee algebraically via the multiplicative-secret argument ("a product of unknowns is unknown").
[10/10] Classify a given list of schemes (KZG-based, Groth16, STARK)… — The setup-spectrum table supplies the trusted-versus-transparent axis and the "Universal versus Circuit-Specific Setups" section supplies the other, so the two-by-two sorting table is directly producible.
[10/10] Interpret the BCTV14 bug (CVE-2019-7167) and the Quantum Shelf… — Dedicated sections "The Bug That Was Not a Ceremony Failure" and "The Quantum Shelf Life" state each lesson for ceremony design (construction correctness is independent of ceremony integrity; pairing-based SRSes have finite quantum lifespans).

Prof. David Lindqvist — Political Economist of Trust — 8.3/10

[9/10] Students must be able to model a trusted setup ceremony… — "The 141,416-Person Question" section does the marginal-participant analysis I demanded almost exactly (mathematical value of participant 141,417: zero; operational, signaling, and Luhmann trust-vs-confidence value: everything), contrasting Sprout's six against the KZG Summoning and even conceding the "legitimacy" purchase is sociological rather than cryptographic.
[6/10] Students must be able to explain why the BCTV14 bug (CVE-2019-7167)… — The "Bug That Was Not a Ceremony Failure" section nails the core lesson (perfect ceremony, flawed construction, undetectable counterfeiting, conjunction not chain), but it claims the fix was "deployed transparently" — eliding the historically secret remediation via the Sapling upgrade — and never asks my who-audits-the-auditors question or names Zcash holders as the silent risk-bearers.
[9/10] Students must be able to deploy the Capex/Opex Setup Economics Framework… — A dedicated section works the ledger with named actors and real numbers (ceremony capex of a few million, a rollup operator's $274K/yr Groth16 vs $4M/yr STARK opex, sub-two-year payback), credits Sonic for the universal-SRS amortization shift, and derives the hybrid pattern as the economically rational equilibrium.
[9/10] Students must be able to grade a real ceremony against the ADOPT framework… — Sprout, Sapling, KZG, and Midnight's in-progress ceremony are each graded against ADOPT with BGM17's coordinator dependencies noted, and the Quantum Shelf Life is genuinely priced as a depreciating asset via an option-value scenario table, HNDL with the Fed FEDS paper, and the "$15M liability on the balance sheet" framing my goal demanded — though the coordinator's residual powers get description more than enumeration; notably, Midnight receives real scrutiny here (incomplete ceremony, weaker ADOPT scores, "existential" quantum exposure) rather than promotion.

Chapter 3: Choreographing the Act (Layer 2 -- Language)

Chapter mean: 7.3/10

Prof. Elena Vasquez — Theoretical Cryptographer — 5.3/10

[5/10] Define an Under-Constrained Circuit (deg 7) precisely: the relation… — The Tornado Cash mechanism is correctly identified ("the witness generator computed the correct value; the constraint system did not enforce it") but the strict-superset-of-the-intended-relation definition is never stated, the forged witness is never constructed, and ZK-intact-while-soundness-fails goes unremarked.
[4/10] Read the Chaliasos et al. SoK (USENIX Security 2024, cited)… — The chapter sharpens the figure to "95 of 141 real-world bugs" and locates them at the circuit layer, but repeats the number four times without once interrogating what counted as a vulnerability or whether the dataset's composition biases the 67%.
[7/10] Map Circom, Compact (Midnight DSL), Cairo, and RISC-V onto… — The four-philosophy mapping is complete with tables, and the load-bearing thesis "what the developer sees determines what bugs the developer makes" is stated outright, though the soundness burden (hand-written constraints vs compiler vs ISA semantics) is left implicit rather than assigned per philosophy.
[5/10] State formally what Picus (QED^2) and ZKAP verify… — Picus gets a mechanism sketch ("reducing the under-constrainedness problem to queries on systems of polynomial equations") and ZKAP's "nondeterministic signals" category gestures at determinism-as-proxy, and the disclose() under-/over-disclosure distinction is genuinely sharp — but the semantic gap between witness uniqueness and implementing the intended relation is replaced by a mere tool-coverage gap (R1CS-only).

Dr. Sam Okafor — Mathematics Educator — 8.5/10

[6/10] Own the intuition that a circuit language writes claims, not computations… — The assert-not-run idea surfaces through the Circom dual-track discussion ("<-- computes a value. The triple-equals === constrains it") and loop unrolling "because ZK circuits have no concept of iteration," but the Sudoku rulebook is only sketched with comment placeholders ("// For each row: assert all four values distinct") rather than written out as actual constraints, so the worked object I demanded is deferred.
[10/10] Stuck-point: students must be able to articulate why assigning a value is NOT… — The under-constrained section hits the stuck-point exactly: "The witness generator computed the correct value. The constraint system did not enforce it... One character. Complete soundness break," backed by the 95-of-141 (67%) Chaliasos statistic and ZKAP's three root causes, with Chapter 1 having already planted the = vs <== preview.
[10/10] Hold the four language philosophies (EVM-compatible, ZK-native ISA, general-purpose ISA… — "The Four Philosophies" delivers the taxonomy with my exact rationale stated up front ("It is about what the developer sees. And what the developer sees determines what bugs the developer makes"), plus decision tables and the compiler-as-the-part-that-matters coda (MTZK's 21 compiler bugs).
[8/10] Own the disclose() boundary as deliberate, audited revelation: in the Sudoku… — "Compact's Disclosure Analysis" makes the boundary a compile-time artifact with reviewer-visible error paths and the 11-error voting-contract redesign, and the running example marks "what hides (solution) versus what reveals (puzzle)" — though applying disclose(get_solution()) to the secret solution while calling the clues "public input" slightly muddies the clues-disclosed/solution-hidden line I wanted drawn.

Priya Raghavan — ZK Systems Engineer — 6.5/10

[5/10] Reproduce the Tornado Cash '=' vs '<==' bug in… — The dual-track mechanics are explained precisely (<-- computes, === constrains, <== does both; witness generator right, constraint absent), but no actual Circom circuit, malicious witness, or prove-the-false-statement walkthrough is provided, so reproduction is left entirely to the reader.
[6/10] Run an actual circuit static analyzer — Picus (QED^2)… — Picus/QED^2, ZKAP (F1 0.82 vs Circomspect's 0.64; 41% division-by-zero, 24% nondeterministic signals), zkFuzz (66 bugs, 38 zero-days), and MTZK (21 compiler bugs) are covered with real findings counts and the honest R1CS-only limitation, but the chapter never runs one or shows output to triage, and CI gating goes unmentioned.
[6/10] Implement the same range-check-plus-uniqueness logic (the Sudoku constraints)… — The Four Philosophies land with working Compact, Noir, and Leo code and the developer-sees-vs-gets-constrained thesis is the chapter's spine, but the requested trio is incomplete: no Circom code at all, no RISC-V guest program, and the Compact Sudoku's constraints are comment-sketch pseudocode.
[9/10] Write a small Compact (Midnight DSL) contract and audit… — Fully delivered: witness declaration plus off-chain JS implementation, a verbatim compiler disclosure-path error, the three enumerated leak surfaces (ledger writes, circuit returns, kernel ops), the ZKIR public/private transcript split, and the naive voting contract that leaked vote choice through ledger-write patterns (11 disclosure errors) — with the over-disclosure gap honestly flagged.

Dr. Marisol Chen — Assessment Designer — 8.8/10

[7/10] Classify Circom, Cairo, Noir, Leo, and Compact into… — Cairo (Philosophy B) and Compact/Noir/Leo (Philosophy D) are sorted explicitly, but Circom is treated as a pre-taxonomy first-generation circuit language and never assigned a philosophy, so one of the five required sorts lacks chapter support.
[10/10] Explain why under-constrained circuits account for 67% of catalogued… — The chapter gives the 95-of-141 statistic, the dual-track problem, and the explicit compute-versus-constrain operator distinction (<-- computes, === constrains, <== does both), fully enabling the articulation.
[8/10] Apply the lesson of the Tornado Cash '=' versus '<==' bug… — The bug mechanics and operator semantics are explained clearly in prose, but the chapter contains no actual Circom code listing, so a student repairing a supplied fragment works from described rather than demonstrated syntax.
[10/10] Use disclosure analysis to mark the disclose() boundary in a… — Compact witness declarations, disclose() semantics, real compiler error output, and the three leakage categories (ledger writes, circuit returns, kernel operations) are all shown with code, making the labeling exercise directly producible.

Prof. David Lindqvist — Political Economist of Trust — 7.5/10

[8/10] Students must be able to identify the trust migration this layer… — The Chaliasos 67% (95 of 141) figure carries the whole chapter's argument that "what the developer sees determines what bugs the developer makes," and the compiler is explicitly elevated to the load-bearing trusted party (MTZK's 21 compiler bugs, "beautiful syntax and a buggy compiler is worse"), though the migration is shown rather than named as a change in whom the verifier trusts.
[6/10] Students must be able to read the Tornado Cash '=' vs '<==' bug… — The one-character mechanics are dissected twice with real analytical content (witness computed, constraint unenforced, any value substitutable), but the chapter never names pool users as the invisible risk-bearers nor argues which liability regime — audit markets, formal tooling mandates, or language design — would price the risk correctly; the tooling survey substitutes for the missing institutional argument.
[9/10] Students must be able to analyze the Four Layer-2 Language Philosophies… — The Polygon zkEVM sunset is worked exactly as I demanded — $250M Hermez acquisition, commercial unviability, Baylina's own pivot to RISC-V as the market pricing the bet — and Philosophy D's internal comparison genuinely allocates semantic-gap risk (Compact: compiler; Noir: developer; Leo: structure) rather than merely listing features.
[7/10] Students must be able to argue the regulatory and institutional value of Compact's… — disclose() gets a serious treatment including the 11-error voting-contract redesign and the honest under- vs over-disclosure limitation, and Picus/QED² and ZKAP carry real content (F1 scores, root-cause taxonomy, the R1CS-only coverage gap), but the tool-vendor-concentration cost goes unargued and the chapter's comparative Compact claims ("no other ZK language...") read promotional with the author's IOG position unflagged in this chapter.

Chapter 4: The Secret Performance (Layer 3 -- Witness Generation)

Chapter mean: 8.3/10

Prof. Elena Vasquez — Theoretical Cryptographer — 6.8/10

[6/10] Define the Witness relative to an NP relation and… — Witness generation is cleanly separated from proving with the 50-70% figure properly sourced to ZKPoG (ePrint 2025/765), and the model boundary is stated ("the mathematical definition describes the proof. It does not describe the process of generating the proof"), but no NP relation is ever defined and the simulator/verifier's-view framing is absent.
[9/10] Work through the Zcash Groth16 Timing Attack (R=0.57)… — The full attack is reconstructed from the cited USENIX 2020 paper — MSM zero-skipping, Hamming-weight leakage, 1.000 vs 1.337 ZEC methodology, Monero's R=0.04 contrast — and the exact lesson I demanded appears verbatim: "The proof was zero-knowledge. The prover was not."
[6/10] Define Constant-Time Proving as a property (execution trace and… — Reinforced Concrete's "Bars" 256 KB secret-indexed table is correctly identified as the cache-timing culprit (with Poseidon's power-map correctly exonerated), but constant-time proving is prescribed as a checklist rather than defined as a property, and streaming witness generation is analyzed only for memory footprint — its effect on the memory-access side channel is never examined.
[6/10] Turn the Privacy as a Luxury Good rationale into… — The hardware ladder (Tier 0-4), GSMA figures, and TEE caveats (Foreshadow, AEPIC, Downfall) make the delegation trust assumption vivid, but it is never stated formally and the chapter never asks whether delegated proving re-monolithizes the seven-assumption decomposition Chapter 1 promised.

Dr. Sam Okafor — Mathematics Educator — 9.8/10

[10/10] Own the witness as an object distinct from the proof: the witness IS… — "The Sudoku Witness" box shows the filled-in grid as the witness ("the witness is the completed grid -- sixteen field elements") with the execution trace as its step-by-step recording of checks, explicitly building on Chapter 3's dual-track constraints.
[9/10] Internalize the Witness Gap: 50-70% of proving time is spent generating… — The gap is the chapter's opening scandal with the ZKPoG 50-70% figure, the Amdahl's-Law 20%-to-71% flip worked numerically, and BatchZK/streaming/ZKPoG each given a mechanism — only the trace of one Sudoku constraint from source to witness slot is missing.
[10/10] Stuck-point: students must be able to articulate why the zero-knowledge property is NOT… — Addressed head-on and memorably ("The proof was zero-knowledge. The prover was not."), with the Zcash R=0.57 timing attack walked through measurement-by-measurement against Monero's constant-time R=0.04 contrast, exactly quantifying what the ZK property covers and what it does not.
[10/10] Understand "privacy as a luxury good": client-side proving is maximal privacy… — The phrase appears verbatim, the five-tier Hardware Ladder prices it ($200 phone to $1M cluster), and the GSMA-grounded conclusion "well over 90%... must delegate. They must trust" lands the reintroduced-trust point from Chapter 1.

Priya Raghavan — ZK Systems Engineer — 8.0/10

[7/10] Profile a real prover run end-to-end (Circom witness gen… — The 50-70% Witness Gap claim is sourced (ZKPoG ePrint 2025/765), decomposed with the 2s+8s→2s+0.8s Amdahl arithmetic, and even names the hot function (r1cs_gg_ppzksnark_prover in libsnark) plus NTT at up-to-90% of GPU time, but the chapter never shows a perf/timer workflow the student would run themselves.
[9/10] Reproduce the shape of the Zcash Groth16 timing attack:… — The dedicated section gives the replicable experimental design (vary 1.000 vs 1.337 ZEC, time the prover function, correlate Hamming weight), reports R=0.57 against Monero's R=0.04 with the architectural reason (complement decomposition), and states the constant-time requirements as a five-item defensive checklist.
[7/10] Configure streaming witness generation (or simulate it by chunking)… — Streaming (O(sqrt(KT)) space, <2x overhead, ~100GB for 2^35 cycles), BatchZK pipelining (0.08-0.44 GB/proof), and the naive-materialization numbers (Jolt 128GB, Groth16 2^25 at ~200GB, >100GB Ethereum block witnesses) are all quantified with citations, but there is no configuration recipe or peak-RSS measurement procedure.
[9/10] Do the Privacy as a Luxury Good math for… — The five-tier hardware ladder with real prices ($200 phone to $1M cluster), GSMA-sourced population math (>90% of users cannot prove client-side), Midnight's measured 20-60s desktop proving, and the constituency memo ("a system that provides privacy only to users with $4,000 workstations has made an implicit choice") deliver the exercise nearly complete, lacking only an actual phone-class measurement.

Dr. Marisol Chen — Assessment Designer — 9.5/10

[9/10] Construct the complete witness and execution trace for the 4x4… — The chapter supplies the solved grid, a model trace table (the x²+x=12 example), and the full accounting of checks (16 cells + 72 pairwise comparisons ≈ 88 elements), though the Sudoku trace table itself is described rather than worked row by row.
[10/10] Demonstrate why the Witness Gap consumes 50-70% of total proving… — The before/after arithmetic (2s/8s at 20% versus 2s/0.8s at 71%), the Amdahl's Law framing, and the sequential-versus-parallel structural explanation give everything needed to annotate a supplied pipeline profile.
[10/10] Apply constant-time proving principles to a short prover routine by… — The five-item defensive checklist plus three concrete leak mechanisms (zero-skipping MSM, secret-indexed lookup tables, Goldilocks conditional reduction) let a student flag each secret-dependent branch or access and propose the matching fix.
[9/10] Illustrate the Zcash Groth16 timing attack (R=0.57) by computing… — The attack mechanics, the R=0.57 figure, and the Hamming-weight-to-timing relation are fully explained (round 1.000 ZEC versus dense 1.337 ZEC), but the chapter gives no quantitative timing model, so the numerical inference in a worked scenario relies on grader-supplied numbers.

Prof. David Lindqvist — Political Economist of Trust — 7.5/10

[8/10] Students must be able to identify witness generation as the moment… — The chapter treats the witness as "the most sensitive artifact in the system," makes delegation an explicit act of trusting someone else's hardware with your secrets, and closes with "expensive, fragile, and surveilled" — the absolutist claim that no downstream cryptography can claw back machine-level trust is enacted throughout, though never stated as a principle.
[6/10] Students must be able to analyze the Zcash Groth16 timing attack… — The R=0.57 attack is dissected superbly (mechanism, Monero's R=0.04 contrast, the GPU thread-divergence tension), but the chapter forecloses my economic question by declaring constant-time "a security requirement, not a performance optimization" — it names the tax without ever arguing who should pay it or when a prover facing no realistic adversary rationally skips it.
[7/10] Students must be able to work the "Privacy as a Luxury Good" argument… — The luxury-good half is worked end-to-end with named prices (Tier 0-4 hardware ladder, GSMA's 90%+ delegation figure, the Crypto Wars parallel, the "constituency" point), but the proving service's own incentives — data monetization, subpoena exposure, uptime economics — are never analyzed, and only TEEs (with their vulnerability history) appear among the substituted non-cryptographic institutions; contracts and regulation are absent.
[9/10] Students must be able to argue how streaming witness generation, BatchZK… — The trust-redistribution reading is delivered explicitly: ZKPoG's deliberate RTX 4090 targeting is framed as democratization, the roadmap goal is recast as "proofs on cheaper hardware" rather than faster proofs, and the closing observation that every hardware-floor change moves users on or off the delegation ladder is "where the technical and the political converge" — with ZKPoG, BatchZK, and streaming all carrying real quantitative content, and Midnight's unexamined runtime side-channel surface honestly flagged.

Chapter 5: Encoding the Performance (Layer 4 -- Arithmetization)

Chapter mean: 7.8/10

Prof. Elena Vasquez — Theoretical Cryptographer — 7.0/10

[7/10] Define R1CS (deg 12), AIR, and PLONKish as satisfiability… — All three are defined as genuine satisfiability relations with worked micro-examples, the CCS equation is stated in full, and the R1CS embedding is actually proven (q=2, S1={1,2}, S2={3}, c1=1, c2=-1), but the AIR ("shift matrices") and PLONKish ("selector-weighted matrices") containments are structural sketches, not carried-through proofs, despite the chapter's own claim "This is not a metaphor. It is a theorem."
[4/10] State and prove soundness of the Sumcheck Protocol (deg 12)… — The protocol mechanics are excellent (round structure, the p(0)+p(1) checks, a worked two-variable example, LFKN cited with journal details), but the soundness proof — per-round error d/|F| via Schwartz-Zippel plus the union bound over rounds, the one proof I said a student must reproduce cold — is entirely absent.
[8/10] Define the lookup relation and trace the edge chain… — LogUp's fractional-sum identity $\sum_i 1/(X-f_i) = \sum_j m_j/(X-t_j)$ is stated with a worked honest/cheating example, the full Plookup→LogUp→LogUp-GKR→Lasso genealogy is tabulated, and Lasso's MLE-decomposition contribution is precise; the only lapse is a section titled "The Lookup Singularity Realized" where I demanded it be read as a conjecture, though alpha-status caveats partially recover it.
[9/10] Decompose The Overhead Tax (10,000x-50,000x): attribute it to… — The three-source decomposition (field encoding, constraint expansion, polynomial commitment with NTT at 40-60% and MSM at 15-30%), the multiplicative composition warning, Jolt's 50-80-constraints-to-18-field-elements move, and the per-system normalized table (SP1/Stwo/Airbender with field and baseline held fixed) do exactly what I asked.

Dr. Sam Okafor — Mathematics Educator — 7.0/10

[7/10] Own the move from rules to polynomials with one fully worked object… — The Sudoku box does deliver constraints (degree-4 range polynomial, 96 constraints, ~130 R1CS rows), but the "Same Computation, Three Encodings" comparison is worked on x*(x+1), not the Sudoku row-uniqueness check, no AIR version of the Sudoku appears, and the chapter even opens by disparaging its own running example ("The Sudoku comparison... misleads precisely because it implies uniqueness").
[6/10] Own Schwartz-Zippel as the engine of everything: two distinct low-degree… — Schwartz-Zippel is correctly installed as the engine ("One random check is almost as good as checking everywhere") with the d/q bound stated repeatedly, but it is never worked numerically over a small field, so students never compute a soundness error as an actual fraction.
[8/10] Own lookup arguments through the smallest possible table: the Sudoku range check… — The Plookup-to-LogUp-to-Lasso-to-Jolt genealogy is complete and the LogUp identity IS worked on a genuinely tiny table ({1,2,3} with lookups {2,3,2}, then a cheating {2,3,5}), but the promised 4-entry Sudoku range table never appears — range checks are anchored on 8-bit XOR and 16-bit tables instead.
[7/10] Stuck-point: students must be able to articulate why arithmetization is NOT the proof… — The scorecard/certificate handoff is stated ("The constraint system is the scorecard. But a scorecard means nothing until someone seals it") and the Overhead Tax gets its own section with the 10,000x-50,000x decomposition, but the "proof core" collapse discussion and the attribution of the largest wall-clock cost to polynomial commitment (Layer 5/6 machinery) blur the very Layer 4/5 boundary my stuck-point needed drawn sharply.

Priya Raghavan — ZK Systems Engineer — 8.3/10

[8/10] Hand-compile the 4x4 Sudoku into R1CS, PLONKish, and… — The Sudoku is decomposed into 96 constraints (16 range + 8 given + 72 pairwise) with the R1CS expansion to ~130 vs CCS staying at 96, the same-computation-three-encodings walkthrough plus a description-size/trace-work table does the comparison, and CCS subsumption is shown constructively (q=2 for R1CS, shift matrices for AIR, selector-weighted for PLONKish) — only the full Sudoku trace layout in AIR/PLONKish specifically is left undone.
[7/10] Implement the Sumcheck Protocol from scratch (it's deg 12… — The round-by-round protocol with a worked two-variable example and the exact d/q Schwartz-Zippel bound is complete enough to implement from, but there is no code, no measured verifier benchmark, and no computed soundness error for a concrete small field (the BabyBear/M31 extension-field soundness subtlety is not raised here).
[9/10] Replace a bit-decomposition range check with a lookup argument… — The 17-constraints-vs-1-lookup range check, XOR at ~32 constraints, SHA-256's 25,000 vs Poseidon's 300, the full Plookup→LogUp→LogUp-GKR→Lasso→Jolt genealogy table, a worked LogUp cheat-detection example, and the Whitehat Lookup Singularity thesis realized in Jolt (18 commitments vs 70-100 constraints per ADD, with honest alpha/no-recursion caveats) cover the goal almost entirely except the self-run measurement.
[9/10] Measure The Overhead Tax empirically: run a program natively,… — The 10,000-50,000x band is decomposed into three multiplying sources with a wall-clock attribution table (NTT 40-60%, commitment 15-30%, witness 10-20%), per-system Ethereum-block overheads (Hypercube ~70x to Airbender ~350x, with the honest correction that the old ~8,000x Airbender figure used a different baseline), GPU dollar costs ($0.30-0.50/block), and three worked examples spanning 60x to 1,000,000x — everything except the reader-run experiment.

Dr. Marisol Chen — Assessment Designer — 9.8/10

[9/10] Translate the 4x4 Sudoku uniqueness and range constraints into R1CS… — The chapter gives the full constraint inventory (16 degree-4 range checks, 72 pair-difference checks, 8 givens, ~130 R1CS rows) plus a worked matrix example with z-vector, though the auxiliary-inverse nonzero gadget is stated in one clause rather than worked, leaving one small step to the student.
[10/10] Execute one full round of the Sumcheck Protocol on a supplied… — The protocol's round mechanics (send p1, check p1(0)+p1(1)=T, bind random challenge, recurse) are stated in full and demonstrated on a two-variable example, so a three-variable execution is directly producible.
[10/10] Compare R1CS, PLONKish arithmetization, AIR, and CCS on expressiveness and… — Multiple comparison tables, the same computation encoded three ways, and the "Three Dialects, One Grammar" theorem that each system embeds in CCS without overhead supply the entire comparison matrix, including CCS as the generalization.
[10/10] Analyze how the lookup-argument lineage (Plookup, LogUp, Lasso) attacks… — The genealogy table plus per-scheme sections state exactly which cost term each generation removes (Plookup: constraint expansion for bitwise ops; LogUp: the O(n log n) sort; Lasso: table-size dependence), and the overhead-tax section supplies the 10,000x-50,000x decomposition to trace against.

Prof. David Lindqvist — Political Economist of Trust — 7.0/10

[8/10] Students must be able to analyze the Overhead Tax (10,000x-50,000x)… — The tax is decomposed into three multiplying sources with worked incidence cases (single addition at 100,000x, Ethereum block at 60-350x, Midnight at an honestly stark 1,000,000x-vs-1,000x double baseline) and real dollar costs per proof, and the batching/amortization argument genuinely answers which computations clear the tariff — though the prover-pays/relying-parties-collect incidence framing stays implicit.
[7/10] Students must be able to identify the new trusted party this layer creates… — The quasi-constitutional half is delivered exactly ("the constraint system choice was a one-way door" with Polygon's years-long Hermez rewrite and Scroll's lock-in as priced evidence, and CCS as the coupling-breaker), but the arithmetizer as an invisible trusted translator is only gestured at through ZKIR's constrain_eq/test_eq trap and "invisible to the Compact developer" rather than analyzed as a trust seat.
[7/10] Students must be able to explain the Lookup Singularity (Plookup, LogUp, Lasso…)… — The economic substitution is superbly worked (32-constraint XOR to one membership test, Jolt's 18 commitments vs 70-100 constraints per ADD, the paradigm shift to verification-by-membership), but the trust consequence I demanded is stated as a premise — "because the table was constructed correctly" — and never interrogated as a new silently-assumed auditable artifact.
[6/10] Students must be able to read the Schwartz-Zippel lemma and the sumcheck protocol… — The d/q soundness probability and sumcheck's exponential reduction are taught with unusual clarity and the field-size dependence is explicit, but the actuarial reading — soundness as a priced premium, trust reallocated from human parties to field size and randomness-source integrity as precisely what makes verification cheap — remains my framing, not the chapter's argument; Midnight's ZKIR section, by contrast, is honest to the point of self-damage on the BLS12-381 performance cost.

Chapter 6: Layer 5 -- The Sealed Certificate

Chapter mean: 8.2/10

Prof. Elena Vasquez — Theoretical Cryptographer — 6.5/10

[7/10] Define IVC (Incrementally Verifiable Computation) and a folding scheme… — IVC is attributed to Valiant 2008, relaxed R1CS is stated as $Az \circ Bz = u \cdot Cz + E$, and the cross-term derivation I demanded is genuinely made ("cross-terms… are absorbed into the error vector E" after expanding the random linear combination), though knowledge soundness is asserted via the decider argument rather than stated as a theorem with an extractor.
[5/10] Compare Groth16 (192-byte proofs) and PLONK (both deg 9)… — Setup type, proof sizes (192 B vs 400 B-20 KB by variant), verifier cost, and KZG-vs-IPA trade-offs are compared carefully, but the assumption column stops at "discrete log": neither the pairing-based knowledge assumptions nor any AGM analysis is ever named — precisely the omission I told students to distrust.
[6/10] Dissect the Frozen Heart Vulnerability Class (2022): identify exactly… — Frozen Heart, the gnark Last Challenge Attack (batching challenge sampled "before all evaluation proofs had been included"), and both 2025 Solana ElGamal omissions are cataloged with citations and the sharp framing "the transcript is the contract," but no forgery is actually constructed and the omitted elements are described generically ("a public input or commitment") rather than exactly.
[8/10] Follow the lattice folding lineage LatticeFold (ASIACRYPT 2025)… — The full lineage is traced with ePrint numbers and four generality axes, Ajtai commitments are stated ($A \cdot [m;r] \bmod q$), Module-SIS is named as the binding assumption, and the norm-growth problem appears concretely in Nightstream's Pi_DEC ("witness values stay within the norm bounds… that make Ajtai commitments binding"); only formal theorem statements themselves are missing.

Dr. Sam Okafor — Mathematics Educator — 9.5/10

[10/10] Own the proof system as the machine that consumes an arithmetized claim… — The wax-seal/certificate framing runs the whole chapter with Groth16 as the extreme point ("the smallest possible envelope") and PLONK/Halo 2 as the universal middle, and "The Proof Core" section names the Layer 4-to-5 handoff explicitly ("The abstract polynomial constraints from Layer 4 are sealed into a tamper-evident certificate").
[8/10] Own folding as the snowball: Nova does not prove each step… — The snowball is delivered exactly as demanded, including relaxed R1CS with the error vector absorbing cross-terms ("fold cheaply at every step, prove expensively only once at the end") and even "The Snowball Does Not Fall Apart" — but the Sudoku anchor (folding the four row-check claims) never appears, and the chapter's Sudoku box drifts to "72 constraints" after Chapter 5 established 96.
[10/10] Distinguish recursion (Russian doll: a proof verifying a proof) from folding… — "Russian Dolls and Snowballs" is a titled section using both of my metaphors verbatim, the hybrid pipeline is traced concretely (1,000 transactions to a 192-byte proof in five steps), and real-time Ethereum proving (SP1 Hypercube, 99.7% of blocks under 12 s) is shown to depend on exactly this machinery, cashing Chapter 2's preview.
[10/10] Stuck-point: students must be able to articulate why Fiat-Shamir is NOT a mechanical… — Addressed head-on ("The transcript is the contract between the two parties. Omit a single term, and the prover can retroactively choose commitments") with Frozen Heart, gnark's Last Challenge Attack, and both 2025 Solana ElGamal omissions catalogued, and the class memorably tagged "the 'SQL injection' of zero-knowledge cryptography."

Priya Raghavan — ZK Systems Engineer — 8.3/10

[8/10] Prove the same circuit under three regimes — Groth16… — The three-family table is effectively all there: Groth16 at 192B/~250k gas/3 pairings/per-circuit ceremony, PLONK variants spanning 400B-20KB by commitment choice, STARKs at hundreds of KB transparent, plus a Midnight-vs-Neo-vs-SP1 comparison with measured proof times (17-18s Halo 2 vs sub-second) — but no single circuit is actually proved under all three regimes side by side.
[9/10] Build a toy folding step: implement Relaxed R1CS… — Relaxed R1CS is derived properly (Az∘Bz = u·Cz + E with cross-term absorption and E's linear growth), CycleFold's 10,000→1,500-gate reduction is quantified, and the Nightstream/Neo section reads the 15 Rust crates in genuine depth (bus layout, Pi_CCS/Pi_RLC/Pi_DEC, two-lane soundness at d/|K|^2 < 2^-127, the Lean-vs-Rust fidelity gap) — only the measured fold-vs-monolithic timing is missing.
[7/10] Dissect the Frozen Heart vulnerability class: take a Fiat-Shamir… — Frozen Heart (six implementations), gnark's Last Challenge Attack (batching challenge sampled before evaluation proofs absorbed — the exact unbound element), and both 2025 Solana ElGamal omissions are cataloged with advisories, and the binding principle is well stated, but no PLONK transcript is actually walked round-by-round and the forgery construction is deferred to Chapter 8.
[9/10] Run Stwo (StarkWare's Circle STARK prover) over M31… — The why-Circle-STARKs-exist question is answered exactly (M31's multiplicative group has a power-of-2 subgroup of order only 2; the circle group's p+1 = 2^31 restores the FFT domain, with the (2x^2-1, 2xy) doubling map), the 940x/50x/ICICLE figures carry an honest single-source caveat, and the real-time race is quantified (99.7% of blocks under 12s on 16 RTX 5090s at ~$32k; Airbender 21.8M cycles/s) — though the comparison baseline is SP1/BabyBear rather than the requested Plonky3 run.

Dr. Marisol Chen — Assessment Designer — 10.0/10

[10/10] Differentiate folding (Nova, relaxed R1CS) from recursive proof composition… — The Russian Doll versus snowball sections give the relaxed-R1CS mechanics, the "fold cheaply at every step, prove expensively only once" cost argument, and the O(|F|) versus O(|F|+|V|) per-step comparison needed for both the diagram and the cost analysis.
[10/10] Analyze the Groth16-versus-PLONK trade-off — 192-byte circuit-specific proofs… — The Three Families and Three Envelopes sections attribute Groth16's 192 bytes to its per-circuit ceremony and PLONK's 400-byte-to-kilobyte range to its universal SRS explicitly, exactly the Layer 1 attribution the analysis requires.
[10/10] Deconstruct the Frozen Heart vulnerability class into its root cause… — The Fiat-Shamir section states the root cause (an omitted public input or commitment lets the prover bias the challenge) with three production incidents, giving a student the mechanism needed to trace a supplied broken transcript to its omission.
[10/10] Examine how HyperNova and the lattice-folding line (LatticeFold, Neo, Symphony)… — The Folding Genealogy orders every scheme chronologically with an explicit per-scheme "axes advanced" annotation (HyperNova: CCS generality; LatticeFold: post-quantum; Neo: small fields and pay-per-bit; Symphony: production-grade high arity), which is the lineage map itself.

Prof. David Lindqvist — Political Economist of Trust — 6.5/10

[9/10] Students must be able to explain why Groth16's 192-byte proofs keep winning… — The argument is made exactly as demanded: Groth16 "persists for on-chain verification cost reasons rather than security reasons," the envelope supply-chain analogy prices the postal system by weight, the worked 1,000-transaction pipeline lands at under $1.00 per batch, and the quarantine logic ("you only need one ceremony for the wrapping circuit, and that circuit does not change") is stated explicitly.
[8/10] Students must be able to analyze the Frozen Heart vulnerability class (2022)… — Frozen Heart, gnark's Last Challenge, and both 2025 Solana ElGamal incidents are dissected with mechanism-level content, and "the gap between mathematical specification and implementation is where real-world attacks live" makes the implementer the real counterparty — though the governance prescription (fund code audits, not proof admiration) surfaces only as a nod to formal verification, not as a funding argument.
[4/10] Students must be able to argue the market-structure consequence of folding and recursion… — Every named artifact (Nova through CycleFold, LatticeFold, Neo, Symphony) carries genuine analytical content along four generality axes, and Real-Time Ethereum Proving is documented with hardware bills — but the chapter never draws the concentration conclusion: scale economics, prover oligopoly, and the re-centralization irony that were the entire point of my goal are absent.
[5/10] Students must be able to read the Ethereum Foundation Security Pivot (Dec 2025)… — The pivot appears twice with its full target list (<10s, <$100K, <10kW, 128-bit provable security), but it is narrated as a roadmap milestone ("the speed race won") rather than analyzed as a governance body correcting the market's undersupply of a public good, and the question of whether the correction mechanism generalizes is never asked; the Midnight case study, in fairness, is honest to the point of tabulating its own 17-24 second latencies against sub-second rivals, though the extended Nightstream tour gives an IOG-ecosystem research prototype generous space.

Chapter 7: Layer 6 -- The Deep Craft

Chapter mean: 8.4/10

Prof. Elena Vasquez — Theoretical Cryptographer — 7.8/10

[6/10] Define a Polynomial Commitment Scheme (deg 9) via its… — The four families are instantiated with correct assumption pairings (KZG's verification equation $e(C - yG, H) = e(\pi, H_s - zH)$ is given, q-SDH is even named in the Midnight table, IPA under DL via Pedersen, FRI under CRHF) and every family is annotated for Shor/Grover/BHT status — but the binding/hiding/evaluation-binding games I demanded as the definition are never written down.
[8/10] Module-SIS is the highest-degree node in this chapter's… — Module-SIS is defined precisely ("find a short nonzero vector z such that M·z = 0"), the binding reduction is correctly argued ("two different (m,r) pairs… requires finding a short element in the kernel of M"), and Greyhound (50 KB, sublinear verification) plus FIPS 203/204/205 sit on that foundation — marred only by an early sentence lumping hash-based FIPS 205 in with "lattice problems" and by the reduction remaining an argument rather than a stated theorem.
[9/10] Read the Cryptographic Primitives Trilemma adversarially -- the digest… — The chapter does my adversarial reading for me: it self-flags ("my own framing, not a result from the literature"), tests the snapshot against Greyhound and the LatticeFold→Neo→Symphony line, and concludes "as a statement of permanent truth, it is increasingly wrong… an artifact of our current engineering, not a law of mathematical nature," even noting no impossibility proof exists.
[8/10] Quantify concrete security and its consequences: BN254 at ~100… — BN254 at ~100 bits carries the Kim-Barbulescu citation, the small-field material is exemplary (BabyBear's degree-4 extension rationale, M31's circle group, Goldilocks's 2-adicity), and the Cascade Effect is derived rather than asserted via Neo's parameter cascade ("this is not optional coupling -- it is algebraic necessity"); the one gap is that "crypto-agility is largely fiction" is substantiated but never stress-tested against the hybrid pipeline's own demonstrated outer-wrapper swappability.

Dr. Sam Okafor — Mathematics Educator — 8.8/10

[8/10] Own the polynomial commitment scheme as the load-bearing primitive of the whole edifice… — "Four Families of Commitment Schemes" delivers commit-then-open for KZG, FRI, IPA, and Ajtai as four ways to bind one promise (the KZG ruler from Chapter 2 returns explicitly), but the Sudoku-trace polynomial never appears — the running example is entirely absent from this chapter.
[10/10] Own the Cryptographic Primitives Trilemma -- algebraic functionality, post-quantum security… — "The Trilemma -- And Its Dissolution" states the three properties, places all four families on the triangle, prices KZG's corner against "the ceremony for Ethereum's EIP-4844... described in Chapter 2," and honestly flags the trilemma as a compressing spectrum rather than a law.
[10/10] Own the Cascade Effect: the Layer 6 field choice propagates upward with algebraic… — "The Cascade Effect" section traces Neo's full parameter cascade (field to ring to commitment to norm bound to guard condition), walks the four-field decision tree, and states the thesis verbatim: "'crypto-agility'... is largely a fiction for zero-knowledge systems."
[7/10] Stuck-point: students must be able to articulate why "post-quantum soundness" is NOT… — HNDL is treated seriously ("a future CRQC could retroactively de-anonymize the entire transaction history") and Chapter 2's Quantum Shelf Life prerequisite is real, but the precise temporal asymmetry I demanded — hiding breaks reach backward while soundness breaks only enable future forgeries — is never drawn as an explicit contrast, and "every Groth16 proof ever verified becomes suspect" partially re-blurs it.

Priya Raghavan — ZK Systems Engineer — 7.5/10

[5/10] Implement one FRI folding round and the query phase,… — FRI's folding intuition (proximity testing, bump amplification, Merkle commitment, domain halving) is explained well enough to orient an implementation, but the concrete tradeoff my goal centers on — query count at a given blowup factor for a target security level, and its proof-size consequence — never appears; only the generic 50-200KB / O(log^2 n) figures do.
[7/10] Microbenchmark field multiplication throughput for Goldilocks (64-bit), BabyBear (31-bit),… — The chapter holds the small-field claim to instruction-level numbers (M31 at 2 instructions vs BN254's 20-30, SIMD packing of 4/8/16 elements, cited 100x figures) and nails the extension-field security arithmetic (BabyBear degree-4 for ~124 bits, Goldilocks F_q^2 for 128), but provides no measured throughput table or benchmark procedure the student would run.
[8/10] Verify the "BN254 ~100-bit security after Tower NFS"… — The claim is sourced to Kim-Barbulescu CRYPTO 2016 (with ch02's Barbulescu-Duquesne 100-110-bit refinement), honestly qualified as eroded-not-broken, and the deployment question is answered concretely: BN254 persists in EVM precompiles for cost reasons, migration needs a hard fork (EIP-2537), and BLS12-381 is unaffected.
[10/10] Trace The Cascade Effect / One-Way Door for two… — Fully delivered: the four-path field decision tree spells out what BLS12-381 vs BabyBear each algebraically forces, Neo's parameter cascade is given with real numbers down to the guard condition (2,808 < 4,096), Midnight-vs-Neo occupies opposite corners in a dimension-by-dimension table, and the trilemma (explicitly flagged as the author's own framing) is tested against Greyhound/LaBRADOR/LatticeFold+/Neo (50-60KB, sublinear verification) with the verdict that it is a compressing spectrum, not a law.

Dr. Marisol Chen — Assessment Designer — 9.8/10

[10/10] Analyze the Cryptographic Primitives Trilemma by placing KZG, FRI… — "The Trilemma -- And Its Dissolution" places all four families on the three named axes explicitly (KZG: functionality + succinctness; FRI: PQ + moderate succinctness; IPA: moderate functionality only; Lattice: functionality + PQ), giving the placement diagram and its justifications directly.
[9/10] Organize the Cascade Effect into an explicit dependency chain… — The Cascade Effect section states the four-link chain and provides full decision-tree traces for BLS12-381, BabyBear, Goldilocks, and M31/Circle STARK, though BN254 specifically gets only a one-row "legacy" treatment, so the BN254/KZG/PLONK trace borrows partly from the BLS12-381 path.
[10/10] Attribute the post-quantum status of each major polynomial commitment scheme… — The four-families table carries a post-quantum row keyed to each hardness assumption, and the lattice section explains mechanistically why Shor's periodicity-finding breaks DLP but not the geometric lattice problems, fully supporting the attribution table.
[10/10] Examine the Small-Field Revolution by comparing Goldilocks, BabyBear, and… — The Small Fields section compares all three named fields against BN254/BLS12-381, quantifies the ~100x hardware arithmetic gap (single machine word versus multi-limb), and ties 2-adicity and the M31 circle group to FRI/NTT domain requirements.

Prof. David Lindqvist — Political Economist of Trust — 8.0/10

[6/10] Students must be able to articulate what trust at the bottom layer… — The conditional nature of every guarantee is stated crisply and BN254's Tower-NFS depreciation from 128 to ~100 bits is documented with the hard-fork migration friction, but the institutional half of my goal — assumptions as wasting assets needing a monitoring-and-migration budget that no one is contractually obliged to fund — is never argued; the erosion is reported as fact, not as an unfunded liability.
[8/10] Students must be able to apply the author's Cryptographic Primitives Trilemma… — The trilemma is honestly flagged as the author's own framing (and then honestly undermined as "increasingly wrong" under the lattice line through Greyhound and Symphony), and the four-path decision tree plus the Midnight-vs-Neo table genuinely function as a procurement exercise matched to time horizon, though stakeholders are matched to paths rather than named as the sacrifice at each corner.
[9/10] Students must be able to argue the Cascade Effect / One-Way Door as a governance… — Delivered nearly verbatim: "crypto-agility is largely a fiction," Neo's full parameter cascade drawn as a derivation chain, the once-only constitutional character of field choice stated twice, and FIPS 203/204/205 with the NIST 2035 deadline standing as the institutional hedge — including the honest gap that no lattice-ZK standard yet exists.
[9/10] Students must be able to price the quantum question as an insurance decision… — The insurance argument is worked to my specification: HNDL as "deferred revelations," the three-option menu with "defer" flagged as most dangerous, the premium quantified (48 bytes vs 50-60 KB), and deployments explicitly matched — public rollups may accept the expiration date while decades-long privacy systems must buy the policy — capped by a strikingly severe audit of the author's own Midnight ("a post-quantum migration would not be an upgrade. It would be a new system").

Chapter 8: Layer 7 -- The Verdict

Chapter mean: 8.9/10

Prof. Elena Vasquez — Theoretical Cryptographer — 8.0/10

[8/10] Define Data Availability (deg 5) as an assumption orthogonal… — The orthogonality argument is made exactly as demanded ("the ZK proof will happily prove that the transition from S_fake was computed correctly… Without DA, nobody can verify the starting point"), and EIP-4844/Pectra/Fusaka and Celestia/EigenDA are placed with their inherited assumptions; the DA-Saturation attack has concrete costs (0.87 ETH/hr on Linea) but is narrated as a playbook, never stated as a game.
[7/10] Analyze the Last Challenge Attack (gnark, 2023/24) and the… — Both are explicitly filed under the Frozen Heart class ("same class of error… the same lesson, unlearned for the third time"), the LCA forgery mechanism is sketched ("solves a linear system for the missing evaluation proofs… accepts the forged proof with probability 1"), and the completeness rule is stated — but the "complete set of values" remains the generic rule rather than an enumerated per-protocol list, and nothing is proven.
[9/10] Translate the L2Beat Stages Framework (Stage 0/1/2) into… — Stages 0/1/2 are rendered with concrete override powers (6-of-8 multisig, 7-day delay, 30-day exit) plus the load-bearing statement "a Stage 0 rollup with 256-bit proof security is… only as secure as the governance multisig," and both attacks are reconstructed in forensic detail culminating in "Beanstalk was a heist. Tornado Cash was a coup" — the composition lesson stated as "six layers of mathematical elegance, and the seventh is a multisig."
[8/10] Separate liveness from soundness in the proving market: state… — The Prover-Killer analysis lands the liveness point precisely ("technically still functioning, but… unproven claims, not verified facts… more like an optimistic rollup"), and aggregation's added trust is flagged ("commitments… not automatically inherited from the underlying proof system's soundness"), though the positive claim — that correct aggregation preserves per-statement soundness — is never affirmatively stated.

Dr. Sam Okafor — Mathematics Educator — 9.0/10

[9/10] Own the intuition that a valid proof is a sentence, not a verdict… — The chapter's opening delivers the intuition ("the audience can be replaced... The math does not protect you from the admin key") and structures Layer 7 around exactly my three nullifiers (verifier contract, governance, DA), with "The Deepest Symmetry" closing Chapter 1's social-mathematical sandwich — though the explicit re-drawing of the map with each layer's trust assumption filled in is deferred to Chapter 10 rather than performed here.
[8/10] Own data availability through the Sudoku: a checker attesting "a valid solved grid exists…" — The DA insight is nailed in the abstract ("the ZK proof will happily prove that the transition from S_fake was computed correctly... Data availability is the anchor") with EIP-4844, Celestia/EigenDA/Avail, and the DA-Saturation Attack all industrialized as promised, but the Sudoku grid-withholding anchor never appears — the running example is absent from the chapter.
[10/10] Stuck-point: students must be able to articulate why "verified on-chain" is NOT "secure."… — Both attacks are narrated forensically with the thesis stated head-on ("The system was not broken. The system was used." and "Six layers of mathematical elegance, and the seventh is a multisig"), and L2Beat's stages make the seventh assumption operational: "Below Stage 2, they are advisory."
[9/10] Connect the Last Challenge Attack (gnark) and the Solana ZK ElGamal Fiat-Shamir bugs… — "When the Transcript Lies" explicitly bridges from Chapter 6's binding requirement and unifies all three incidents as one class ("Same class of error... The same lesson, unlearned for the third time"), though the diagnose-the-gnark-bug-yourself exercise I wanted is narrated at the reader rather than staged as a challenge.

Priya Raghavan — ZK Systems Engineer — 8.0/10

[8/10] Cost out on-chain verification for real: measure gas for… — The Groth16 gas breakdown is real engineering (181k pairing + 7,160/input formula, FFLONK at 236k, 160-verifications-per-block ceiling), the raw-STARK 2-5M figure is honestly reframed as obsolete ("nobody posts raw STARKs"; true differential ~2x after wrapping), and aggregation economics land ($1 to $0.01 at 100-proof batches via SHARP/Aligned/NEBRA) — though the exact break-even batch size is implied rather than computed.
[7/10] Take one live rollup and classify it yourself against… — The Stages framework is defined operationally (6-of-8 multisig with 7-day delay, 30-day exit windows, Security Council scope) with the blunt who-steals-funds verdict ("six layers of mathematical elegance, and the seventh is a multisig") and the proxy-pattern attack surface cataloged, but no specific live rollup is actually classified with its real upgrade keys — Midnight's immutable-verifier counter-model substitutes for the exercise.
[8/10] Walk the Last Challenge Attack on gnark's PLONK verifier… — The gnark walkthrough identifies the exact unbound element (batching challenge computed from a transcript excluding the evaluation proofs, letting the attacker solve a linear system for forgeries that pass with probability 1) and the Solana ElGamal omission is named, with the audit rule stated ("transcript completeness as the first check") — but the checklist stays a principle rather than the itemized challenge-derivation list I wanted.
[9/10] Model the availability attacks that page you: simulate a… — Both attacks come with measured production numbers: DA-saturation at 0.87 ETH/hr (Linea) and 2 ETH/30min (Optimism) with 1.45-2.73x finality degradation, prover-killer with a cycles-per-gas table (MODEXP 2,961, JUMPDEST 1,039), the 94x/8-hour finality delay and a prover crash at 10,266s, plus the multidimensional-pricing defense and Celestia-vs-blob cost data ($0.07 vs $3.83/MB) — everything except the reader running the simulation.

Dr. Marisol Chen — Assessment Designer — 10.0/10

[10/10] Evaluate a given rollup's deployment against the L2Beat Stages framework… — The L2Beat section states each stage's qualifying criteria concretely (permissionless verification, forced exits, Security Council constraints, 30-day upgrade notice), which is exactly the rubric a student needs to assign and defend a stage for a supplied rollup.
[10/10] Judge whether a system's data availability choice (Ethereum EIP-4844 blobs… — The chapter supplies both sides of the memo: cost figures ($0.07/MB Celestia versus $3.83/MB blobs), the explicit trust trade ("inherits Celestia's security assumptions"), and a full DA-Saturation attack playbook with per-hour attack costs.
[10/10] Critique the claim that a sound proof system implies a… — Both attacks are narrated forensically with the chapter's own thesis stated ("The system was not broken. The system was used"; "six layers of mathematical elegance, and the seventh is a multisig"), locating each squarely at Layer 7 outside the proof core.
[10/10] Assess the verifier-side attack surface by ranking the Last Challenge… — Each of the three named attacks gets a dedicated section with severity-relevant facts (probability-1 forgery for Last Challenge, 94x finality delay and prover crash for Prover-Killer, forged confidential-transfer amounts for Solana), fully enabling a justified ranking.

Prof. David Lindqvist — Political Economist of Trust — 9.5/10

[10/10] Students must be able to expose the last trusted party in the stack… — Delivered almost verbatim: "the math does not protect you from the admin key," "six layers of mathematical elegance, and the seventh is a multisig," and L2Beat's stages read exactly as a governance-trust audit — "below Stage 2, they are advisory," making the Stage 0 proof explicitly "decorative."
[10/10] Students must be able to analyze the Beanstalk flash-loan governance attack… — Both incidents are worked forensically as institutional failures with the rental economics made explicit ("he rented it for the cost of a flash loan fee," "for the thirteen seconds that matter, anyone with gas money is a supermajority stakeholder"), the heist/coup distinction drawn, and the lesson wired directly to upgradeable ZK verifier proxies.
[9/10] Students must be able to argue why proofs guarantee validity but never availability… — "Data availability is the anchor; the ZK proof is the chain" states the validity/availability split precisely, both attacks are priced in gas and hardware (0.87 ETH/hr DA-saturation, MODEXP's 94x finality delay at $42.26/block with the cycles-per-gas table), and Celestia at $0.07/MB versus Ethereum blobs is a genuine market pricing DA as a separate trust product — only the user's exit-risk allocation under withheld data stays implicit.
[9/10] Students must be able to treat verifier implementations as the trusted computing base… — The gnark Last Challenge (probability-1 forgery mechanics) and both Solana ElGamal bugs carry full analytical weight, "Who Verifies the Verifier?" does the supply-chain analysis (FOOM Club's delta_2=gamma_2, the XZ Utils analogy), and aggregation is priced as the classic scale bargain ($1 to $0.01 per proof against "a single point of failure at Layer 7") — with Midnight's own governance gaps ("the most significant gap," no emergency procedures) honestly listed rather than hidden.

Chapter 9: Privacy-Enhancing Technologies

Chapter mean: 7.4/10

Prof. Elena Vasquez — Theoretical Cryptographer — 6.0/10

[6/10] Place ZK among the Privacy-Enhancing Technologies (deg 7)… — Each PET gets a distinct question, MPC's trust models are tabulated (honest vs dishonest majority), and the information-theoretic/computational/heuristic tier scheme ("determines what you are actually trusting") does real adversary-model work — but not one security game is actually written, for any of the five.
[6/10] State what Verifiable FHE (zkFHE) composes: FHE gives… — The composition semantics are stated exactly right ("FHE guarantees confidentiality… It does not guarantee integrity… ZKPs close this gap") with SherLOCKED/Bonsai as evidence, but the composed assumption stack — the union of lattice and ZK assumptions, not their intersection — is never derived.
[7/10] Define Zexe's function privacy formally as hiding which relation… — Function privacy is captured in substance ("an observer cannot distinguish a token transfer from a governance vote… all transactions look identical") and Kachina's leakage function Lambda is presented precisely as the privacy-as-a-parameter framework with a comparison table separating data from function privacy, but the strictly-stronger-than-ZK claim is implied by table rows rather than argued.
[5/10] Read Privacy Pools (0xbow) against GDPR and eIDAS… — Privacy Pools' association-set predicate is described (ASP screening plus a withdrawal proof of compliant provenance) and the EDPB 02/2025 erasure analysis is thorough, but the chapter blesses the orphaned-hash architecture ("This is not a workaround. It is good architecture") instead of doing my assigned critique — whether key-severing legally constitutes erasure and where "minimization" maps to no cryptographic definition go unexamined.

Dr. Sam Okafor — Mathematics Educator — 9.3/10

[10/10] Own the PET matrix as a division of labor, not a ranking: ZK proves statements… — "The Four Pillars" frames each PET by the distinct question it answers, each with a canonical worked case (Yao's Millionaires for MPC, Gentry's glovebox for FHE, Apple/Census epsilon for DP, TEE attack history for silicon trust), and the closing insists "not competing technologies... complementary tools in a single toolkit."
[8/10] Stuck-point: students must be able to articulate why zero-knowledge is NOT anonymity… — The opening thesis ("ZKPs alone will leak through side channels, metadata, composition boundaries") and Zexe's function privacy ("all transactions look identical on-chain") carry the substance, but the head-on articulation — that ZK says nothing about who submitted the proof, when, or from where — is never stated as its own contrast, so the anonymity conflation is deflected rather than confronted.
[10/10] Understand composition as the frontier: verifiable FHE (zkFHE) staples ZK's integrity… — zkFHE gets a full structural treatment ("FHE guarantees confidentiality... It does not guarantee integrity... ZKPs close this gap," the camera-in-the-glovebox), and Kachina's leakage function Lambda is explained precisely as "privacy as a parameter, not a binary choice," with Midnight's disclose() named as its practical instantiation.
[9/10] Read eIDAS 2.0 and GDPR as demand-side forces: regulators are mandating selective… — "The Regulatory Intersection" delivers the demand-side reading emphatically ("a major regulatory framework is not just permitting but requiring selective disclosure... The law now demands the trick"), with the zKYC bar scenario reprising Chapter 1 — though the explicit "this is disclose() from Chapter 3 elevated to law" bridge is left for the reader to draw.

Priya Raghavan — ZK Systems Engineer — 6.5/10

[7/10] Build the PET decision matrix with measured numbers, not… — The matrix exists with genuinely sourced numbers (FHE's 32KB ciphertexts and 10M:1 bootstrapping ratio, MPC's 4-ciphertexts-per-gate communication bound, TEE's <5% vs 50% Downfall-mitigation overheads, the €50 Battering RAM attack) and the three-tier trust taxonomy is sharp, but it is never anchored to one concrete task like private set membership benchmarked across all four.
[5/10] Prototype the Privacy Pools (0xbow) mechanism: prove Merkle… — Privacy Pools gets accurate reporting (April 2025 launch, ASP-screened association sets, $6M/1,500 users, the compliance-through-ZK design thesis) but zero build guidance: no Circom, no Merkle-membership circuit mechanics, nothing connecting to Chapter 3's foundation.
[8/10] Analyze where Verifiable FHE (zkFHE) composition actually breaks:… — The cheating party is named (the compute server, whose wrong function is undetectable behind encryption), the ZK attestation target is specified (homomorphic op sequence vs input/output ciphertexts and function spec), the overhead is honestly estimated (prototypes cap at a few hundred multiplication gates, an order of magnitude atop FHE), and the Kachina-vs-Zexe table with the Midnight/Aztec instantiation mapping effectively answers the deployability question.
[6/10] Map one eIDAS 2.0 selective-disclosure requirement onto a concrete… — The regulation, deadline, 450M scale, ARF, and Large Scale Pilots are all covered, and the zKYC bar example sketches the witness/disclosure split (DOB as witness, one age bit disclosed against a government signature), but the issuer key-rotation 3am failure is absent — revocation gets one passing phrase.

Dr. Marisol Chen — Assessment Designer — 9.3/10

[10/10] Evaluate the fit of ZK proofs, FHE, MPC, TEEs… — "The Decision Matrix" section organizes exactly the four discriminating questions (trust model, data holder, performance, regulation) with per-PET answers and quantified overheads, and TEEs get their own heuristic-security treatment, fully enabling the scenario matrix.
[9/10] Judge whether a given credential design satisfies eIDAS 2.0 and… — The eIDAS 2.0 selective-disclosure mandate, the zKYC bar example, and the GDPR off-chain-hash erasure pattern give the compliance argument in substance, though GDPR's data-minimization principle is never named as such, so the student must map the chapter's "reveal only what the audience needs" framing onto the legal term.
[8/10] Critique Privacy Pools (0xbow) as a resolution of the privacy-versus-compliance… — The mechanism (association-set proofs, ASP screening) and its strongest guarantee are described well, but the chapter offers no critical treatment of the ASP as the weakest residual assumption — the trust placed in the Association Set Provider must be inferred by the student rather than found in the text.
[10/10] Defend or refute the composability claim behind verifiable FHE (zkFHE)… — The ZKP+FHE composition section states the claim, names the added cost explicitly (proving overhead an order of magnitude atop FHE, prototypes capped at a few hundred multiplication gates), and explains why neither confidentiality nor integrity alone suffices.

Prof. David Lindqvist — Political Economist of Trust — 6.0/10

[8/10] Students must be able to map the PET family by counterparty structure… — The three-tier security taxonomy (information-theoretic/computational/heuristic) is precisely a counterparty analysis, the MPC trust-model table and the TEE vulnerability history (down to 2025's €50 Battering RAM) name who is trusted and how they fail, and residual exposures are priced in performance terms — though capex/opex vocabulary is absent and the map is organized by question-answered rather than counterparty-first.
[4/10] Students must be able to analyze Privacy Pools (0xbow) as a negotiated settlement… — The settlement framing is present ("pragmatic privacy," the Tornado Cash tension), but the Association Set Provider is described neutrally as a screening mechanism and the chapter never asks my central question: who governs the allowed set, what listing power the ASP accumulates, and why its decisions are the real locus of power.
[5/10] Students must be able to argue how eIDAS 2.0 and GDPR act as demand-side… — The demand-side mechanics are excellent (450M citizens, "the law now demands the trick," the issuer trust framework flagged as the hard engineering), but the chapter is celebratory about regulation "pulling in the same direction" and never evaluates the trust relocation to states — what citizens newly owe government-anchored issuers, their revocation leverage, or the issuer as new root of the trust graph.
[7/10] Students must be able to run the composition economics of hybrid designs… — Kachina's leakage-function parameter and Zexe's 968-byte function privacy carry real content, zkFHE's order-of-magnitude-on-top-of-FHE cost is stated, and "each composition point requires protocol engineering harder than the individual PETs" is genuine composition economics — but the when-does-a-cheap-TEE-rationally-beat-zkFHE argument stays implicit in the decision matrix, and the flattering Kachina-grounds-Midnight claim quietly links the author's company's paper to the author's company's product without noting the shared provenance.

Chapter 10: The Synthesis -- Three Paths, Not Two

Chapter mean: 8.3/10

Prof. Elena Vasquez — Theoretical Cryptographer — 6.8/10

[7/10] State each path as an assumption profile, and prove… — The Three-Path Table is a genuine assumption-profile matrix and the weakest-link rule is stated in exactly my terms ("the outer Groth16 wrapper is not post-quantum… The chain of trust is only as strong as its weakest link"), but the composition rule is asserted with imagery ("the envelope has an expiration date") rather than proven — the wrapper circuit's own soundness dependency is never formalized.
[6/10] Contrast Path Two: Pure Transparent (hash assumptions only, larger… — Both paths get careful assumption treatment (Grover/BHT degradation for Path Two, Module-SIS anchored to FIPS 204 for Path Three, Pico Prism and the EF's no-trusted-setup mandate as evidence), but the specific layer-by-layer accounting of which of the seven layers each path eliminates versus merely relocates is never performed.
[6/10] Evaluate the rationale's claim that the SNARK-vs-STARK debate "was… — The chapter supplies the ammunition for my critique — it concedes the hybrid "inherit[s] quantum vulnerability from their verification wrapper," i.e., chooses SNARK assumptions at the final layer — but never turns that concession back on its own headline "that binary is dead," leaving the dissolution claim unexamined against its own admission.
[8/10] Reconstruct the Seven-Layer Causal DAG (14 Edges) and… — All fourteen edges are enumerated with an explicit acyclicity argument (design-time constraints vs runtime flow), one edge is genuinely necessity-audited ("choosing Circle STARKs… does not force M31 — any Mersenne prime could do"), and the Cascade Structure section maps failure propagation per layer — though the cryptographic-versus-procedural labeling of edges stays implicit (7→6 "gas forces BN254" is an economic convention the chapter never flags as such).

Dr. Sam Okafor — Mathematics Educator — 9.8/10

[10/10] Own the Seven-Layer Causal DAG (14 edges) well enough to re-derive it… — The DAG is drawn, then every one of the fourteen edges is enumerated and justified ("Consider the full edge set..."), with worked forcing chains (M31 forces Circle STARKs; gas forces BN254 and wrapping) and the why-no-cycles argument that makes re-derivation teachable.
[10/10] Own why "SNARK vs STARK" was a false dichotomy: the hybrid STARK-to-SNARK… — "The Binary That Broke" declares it dead in the opening paragraphs, Path One is documented as the dominant production default with named systems, and Paths Two (Ethereum L1's no-trusted-setup mandate, Pico Prism) and Three are presented as live competitors, cashing Chapter 2's preview and Chapter 6's recursion mechanism.
[10/10] Stuck-point: students must be able to articulate why trust decomposition is NOT… — "When Each Thread Snaps" gives a named historical failure for every one of the seven assumptions, and "'Trustless' versus 'Trust-Minimized'" asks the wall-poster question and answers head-on ("The answer: nowhere"), even improving my weakest-link framing with the cascade-containment analysis of which failures propagate.
[9/10] Place Path Three (post-quantum folding) as a coherent research program rather than a grab… — LatticeFold, LatticeFold+, Neo/SuperNeo, and Symphony are presented as one program built on Module-SIS ("It does not merely survive the quantum era. It was built for it") and tied back to Chapter 7's trilemma explicitly — though the exercise of naming which DAG layer each paper innovates at is left implicit rather than performed.

Priya Raghavan — ZK Systems Engineer — 7.3/10

[7/10] Reconstruct the Seven-Layer Causal DAG (14 Edges) for… — The DAG is fully drawn (ASCII diagram, all 14 edges enumerated with concrete instances: gas forces BN254, Cairo's 4→2, Jolt's 3→4 collapse) and the design-time-vs-runtime acyclicity argument is genuinely good, but no causality is demonstrated by experiment — the change-the-field-and-watch-it-break exercise never happens (ch5's RISC Zero migration story is the closest evidence, and it is referenced only conceptually).
[8/10] Run the path-selection exercise as an architecture review: given… — The three paths are laid out with a decision table and defended with real numbers (250K-gas Groth16 wrapping, Greyhound 50KB / LaBRADOR 58KB lattice proofs, EF's no-trusted-setup mandate and 128-bit-by-Dec-2026 targets, Pico Prism's 99% of 45M-gas blocks under 12s on 16 RTX 5090s), matching my three requirement sets implicitly even though the exercise is never framed as an explicit review.
[7/10] Build the smallest possible hybrid pipeline yourself: take a… — The wrap stage is precisely located (three layers pierced at once) with ch6 supplying the measured 5-10s wrap latency and 192-byte output, and the Seven Weaker Assumptions are cataloged with excellent per-layer failure scenarios and the cascade structure, with the assumption split between halves stated at path level (inner: hash soundness; outer: ceremony plus BN254 pairing with its "expiration date") — but the student never builds or times the pipeline.

Dr. Marisol Chen — Assessment Designer — 10.0/10

[10/10] Evaluate the book's claim that the SNARK-versus-STARK debate was… — "The Binary That Broke" states the false-dichotomy claim outright and Path One supplies the central exhibit (SP1, Stwo, RISC Zero, Airbender, ZisK, Pico Prism all wrapping STARK in Groth16, with the ~250K-gas economic driver), giving the argument its evidence directly.
[10/10] Justify a choice among the three paths (hybrid pipeline, pure… — The Three-Path Table scores each path on exactly the objective's three criteria (setup, PQ status, verification cost) plus production status, and each path's section adds the failure-profile detail a recommendation memo needs.
[10/10] Critique the Trust Decomposition thesis by testing the Seven-Layer Causal… — The chapter enumerates all fourteen edges individually (six upward, eight downward/cross), justifies acyclicity, and ties each edge to evidence from earlier chapters (Cairo, Jolt, gas economics), which is precisely the artifact a student must defend or amend.

Prof. David Lindqvist — Political Economist of Trust — 7.5/10

[9/10] Students must be able to defend the Hybrid STARK-to-SNARK Pipeline… — Path One is defended exactly as an economic settlement ("Why did this happen? Economics," with even StarkWare wrapping because "gas economics demand it"), and the residual trust surviving in the wrapper is named precisely: the BN254 pairing's quantum vulnerability and its ceremony — "the glass wall is strong; the envelope has an expiration date."
[7/10] Students must be able to present the three paths as portfolio strategies… — Each path is priced as a distinct trust bet (contained ceremony, no-ceremony L1 mandate, lattice novelty on a 3-5 year horizon) and Ethereum's base-layer mandate functions as a deployer profile, but the systematic matching to time horizon, threat model, and balance sheet is thinner here than Chapter 7's version — the three-path table is technical, not actuarial.
[8/10] Students must be able to interrogate Trust Decomposition (Seven Weaker Assumptions)… — The 14-edge DAG is drawn and enumerated, and "The Cascade Structure" genuinely traces correlated failure ("a quantum computer breaks Layers 1, 5, and 6 simultaneously for pairing-based systems") with the sharp inverted-threat-landscape insight — though the chapter first asserts "because the assumptions are independent" before qualifying it, and never does the explicit seven-collapse-to-three arithmetic my goal demanded.
[6/10] Students must be able to state the economic core of the book's thesis… — Replaceability is argued well ("fix the circuit, redeploy the verifier, and the system recovers"; graceful degradation as resilient engineering), but the price side — the larger audit surface and coordination cost of seven surfaces instead of one — is cataloged rather than weighed: "the combination is far more resilient than any single point of trust" is asserted, not argued against its cost.

Chapter 11: zkVMs -- The Universal Stage

Chapter mean: 7.4/10

Prof. Elena Vasquez — Theoretical Cryptographer — 6.8/10

[5/10] Define a zkVM precisely: the proven relation is "this… — The universal-stage concept is well conveyed and SP1's 62 opcodes-verified-against-Sail figure appears, but the proven relation ("this trace is a valid run of program P on input x") is never stated, and the concentration of the soundness burden into a one-time-audited ISA constraint system — the single point of failure I demanded be named — stays implicit.
[8/10] State Jolt zkVM's central thesis (deg 10, spanning Chapters… — The thesis lands with unusual clarity ("proving a computation means looking it up… The trace is the constraint"), the Lasso subtable decomposition and its sumcheck consistency proof are connected, and the AIR contrast is sharp ("does this answer satisfy the question?" vs "is this answer in the book?") — only the formal theorem chain (sumcheck soundness → Lasso → instruction correctness) remains narrative rather than stated.
[5/10] Impose benchmark hygiene on the prover comparisons (SP1 Hypercube… — The landscape table does hold ISA, field, and hardware visible, and the prose flags baseline traps (Stwo's 125x-arithmetic vs 100x-pipeline distinction, Airbender's single-GPU normalization), but targeted security bits and recursion depth are absent from every table and the rejection rule itself — a speed claim is meaningless without all four — is never articulated.
[9/10] Trace the cross-layer consequences: a zkVM's arithmetization commitment (small… — The Proof Core Triad section does exactly what I asked, concretely for both routes: the substitution thought experiments ("keep M31 but use Hyrax… no standard curve has a 31-bit scalar field"; "keep BN254 but switch to AIR… 100x slower") demonstrate the cascade's rigidity, and the three-triad clustering of the whole 2026 landscape is the empirical payoff.

Dr. Sam Okafor — Mathematics Educator — 8.3/10

[8/10] Own the zkVM inversion: prove the CPU once, not each program… — The universal-stage inversion is the chapter's opening move ("Before zkVMs, every zero-knowledge application required building a custom stage... The stage is universal; the performances are infinite") with explicit ties to Chapter 3's taxonomy and Chapter 4's traces, but the promised payoff — your Sudoku checker as ordinary Rust — never appears; the running example is absent.
[9/10] Own how Jolt realizes the Lookup Singularity: instruction semantics become giant… — The Jolt section is a standout ("proving a computation means looking it up... a different epistemology of computation"), with the 2^32 addition table, Lasso subtable decomposition, and the trace-is-the-constraint collapse of Layers 3/4 — only the scale-up from Chapter 5's 4-entry Sudoku range table is missing, because that table never existed.
[6/10] Stuck-point: students must be able to articulate why a zkVM's generality is NOT free… — The arithmetization tax is named (Gassmann's 40% LLVM finding, "Cairo avoids this overhead by design"), but the chapter's verdict "the ISA war is over... the language question from Chapter 3 has a default answer" leans against my claim that the four philosophies remain a live choice, and the assertion that a fixed-workload hand-built circuit still wins by orders of magnitude is never made head-on.
[10/10] Read the performance race -- SP1 Hypercube, Airbender, ZisK, Pico Prism, Plonky3… — All named systems are benchmarked against the real-time target (the four-team sub-12-second table), and the which-layer-did-it-change discipline is actively practiced via the three seven-layer walkthroughs and the proof-core clustering analysis ("Change one cell in the table, and every other cell in that row must adapt").

Priya Raghavan — ZK Systems Engineer — 6.8/10

[6/10] Run the same Rust guest program (a SHA-256 loop… — The landscape and real-time tables carry real numbers (SP1 6.9s/16 GPU, ZisK 6.6s/24 GPU, Airbender 35s/1 H100 at 21.8M cycles/s), but the benchmark workload is Ethereum blocks rather than one guest program with cycles/memory/proof-size columns, and the precompile-ablation experiment — my "where zkVM benchmarks go to lie" test — is never run, with precompiles mentioned only as SP1 architecture.
[5/10] The graph's edge for Airbender (ZKsync) is ambiguous about… — RECORDED ASSERTION: the chapter's table states Airbender's base field is Mersenne-31 (31-bit) and ZisK's is Goldilocks (64-bit); both assertions are plausible and match my prior on the repos, but the chapter presents them unsourced in a table without flagging any ambiguity or citing zksync-airbender for the field claim — the never-trust-a-graph-over-a-repo verification drill is not modeled.
[8/10] Explain, at the constraint level, how Jolt's Lasso-lookup-centric design… — The paradigm contrast is done properly: 32-bit ADD as a 2^32-entry table decomposed into ≤2^16 subtables with the ~60-constraint R1CS control-flow wrapper, versus SP1's per-opcode AIR chips bound by LogUp-GKR, framed as "satisfy the equations" vs "is this answer in the book" with honest scaling limits (lookup tables explode on hashes) — only the full AIR-side column trace for the same single instruction leans on Chapter 5's earlier ADD breakdown.
[8/10] Evaluate the newest entrants with production skepticism: for SP1… — Hardware and invoices are present: 16x RTX 5090 (~$32K) for SP1/Pico Prism, the $60-100K full-cluster figure, ~$0.04/block from Ethproofs/CastleLabs trackers with the intra-2025 42x drop, and Pico Prism's primary source (the Brevis 64-to-16-GPU blog post, URL included) — a genuinely skeptical treatment lacking only an explicit per-block dollar computation done from first principles.

Dr. Marisol Chen — Assessment Designer — 9.3/10

[10/10] Evaluate Jolt, SP1 Hypercube, RISC Zero, Airbender, and ZisK… — The March 2026 landscape table carries all five named systems with rows for arithmetization, field, proof system, SNARK wrap, block-proving performance, and maturity, so the ranked report needs only the student's weighting scheme on top of supplied data.
[10/10] Judge the lookup-centric bet of Jolt — that Lasso-style lookups… — The Jolt sections argue both sides explicitly: the lookup-singularity epistemology ("is this answer in the book?") for, and the overhead evidence against (100x BN254 per-operation cost, combinatorial table explosion for hashes, the residual R1CS control-flow layer, no production verifier).
[9/10] Recommend one zkVM for a specified RISC-V workload, with mastery… — "Three zkVMs Through Seven Layers" models the exact seven-layer defense for SP1, Stwo, and Jolt, plus a goal-based recommendation rubric; a recommendation landing on RISC Zero or Airbender would rest on table rows rather than a full worked trace.
[8/10] Formulate a benchmark protocol that would fairly compare two zkVMs… — The chapter supplies the confounds a fair protocol must control (heterogeneous GPU counts across the table, single-GPU versus cluster results, the 125x raw-arithmetic versus 100x end-to-end distinction) but never discusses benchmarking methodology as such, so the protocol must be synthesized from scattered cautions.

Prof. David Lindqvist — Political Economist of Trust — 5.8/10

[7/10] Students must be able to analyze the zkVM as a trust wholesaler… — The universal-stage-versus-bespoke-production contrast, SP1's 62 Sail-verified opcodes as the audit anchor, and SHARP's explicit "economic aggregation, not just cryptographic recursion" carry the amortization substance, but the wholesale-versus-retail trust framing — one enormous audit capex spread across every program ever proven — is never argued as audit economics.
[8/10] Students must be able to argue the governance meaning of the RISC-V convergence… — The open-standard case is made ("open and royalty-free... no licensing costs and no vendor lock-in") with an unusually fair weighing of the ZK-native counter-case (Cairo's avoided 40% LLVM arithmetization tax against StarkWare's recruit-and-train ecosystem lock-in and the Kakarot hedge), though the standards-body-in-the-trust-graph framing stays implicit.
[5/10] Students must be able to critique the zkVM benchmark race as marketing… — The chapter documents the race lavishly and notes the EF pivot rotating the axis "from who can prove fastest to who can prove most securely," and its rubric does elevate formal verification — but it never critiques the benchmark race as marketing in a market that fails to price soundness, never invokes bug-bounty economics, and never explains why buyers currently weight cycle counts.
[3/10] Students must be able to connect the universal stage back to Layer 3 economics… — The Layer 3 connection made is purely performance (the Witness Gap); the fact that the zkVM prover sees the full execution, the industrial-scale concentration of proving-as-a-service, operator incentives, and contestability are all absent — the Succinct Prover Network appears once without analysis, and the $60-100K cluster figure that bears directly on contestability is left unexamined.

Chapter 12: Midnight -- The Privacy Theater

Chapter mean: 4.8/10

Prof. Elena Vasquez — Theoretical Cryptographer — 4.3/10

[6/10] Read this chapter under an explicit conflict-of-interest discount… — The chapter grounds claims in citable documentation (Developer Guide p.8, Wallet SDK §4.2) and earns credibility through an honest gap inventory (side channels unexamined, a compiler bug in > and <=, cross-contract transfers failing, "approximately Stage 0-1"), but it never restates the COI itself nor classifies claims into checkable-versus-insider — and its sources are IOG's own documents, a circularity left unflagged.
[2/10] Define the Nullifier mechanism formally: a deterministic, key-derived tag… — Nullifiers appear only in passing ("producing the unique identifier that prevents double-spending of shielded UTXOs"); the two games, the unlinkability claim, and the analysis of what fails under malleable or non-deterministic derivation are entirely absent from the chapter that was supposed to carry them.
[1/10] Specify what Zswap adds over a Zerocash-style shielded transfer… — Zswap is never even named in this chapter; the atomic multi-asset swap semantics and the additional binding property a swap requires over a single-asset pool appear nowhere, with only stray mentions of "Zswap" surviving in Chapters 2 and 7.
[8/10] Use Midnight as the seven-layer integration exam: instantiate every… — The full seven-layer mapping is genuinely executed (Compact and disclose() at L2/L3, ZKIR's 24 opcodes at L4, Halo 2's four-phase pipeline at L5, Jubjub/Poseidon at L6, three tokens at L7), with a validates/challenges table and layers 3 and 6 honestly shown to resist clean mapping — though no single layer is explicitly crowned weakest, with the governance gap only called "the theater's most conspicuous gap."

Dr. Sam Okafor — Mathematics Educator — 5.0/10

[8/10] Walk one shielded transaction through all seven layers of a shipping system… — The "Full Seven-Layer Mapping" audits every layer with concrete artifacts (even compiling Chapter 3's verify_sudoku to "200-300 instruction nodes"), and the four-phase callTx/proveTx/balanceTx/submitTx pipeline traces a real transaction with measured latencies — but the walk is layer-by-layer sampling rather than one continuous shielded transaction, and the annotate-with-three-paths-and-DAG-edges exercise appears only as scattered asides ("a tradeoff that Chapter 7's cascade effect predicts").
[3/10] Stuck-point: students must be able to articulate why a nullifier is NOT a pointer… — Nullifiers get only passing mentions ("nullifier computation (producing the unique identifier that prevents double-spending)"); the deterministic-yet-unlinkable tension is never posed, and "double-spend prevention is soundness wearing a privacy costume" has no counterpart here — the closest treatment is back in Chapter 4's voting example, not in this chapter.
[2/10] Own Zswap's atomic private swap as Kachina's "privacy as a parameter" made concrete… — Zswap does not appear in the chapter at all (its only substantive mention is Chapter 7's stack listing), and the maturity assessment even reports "cross-contract token transfers fail with SDK errors," leaving the atomic-private-swap payoff and its Chapter 9 Kachina bridge entirely undelivered.
[7/10] Practice reading a biased source: the author founded IOG, flags the conflict… — The chapter is built for independent checking (per-claim citations to five named reference documents with page/section numbers) and is honestly self-critical ("It is the theater's most conspicuous gap," a documented compiler bug, Stage 0-1 rating), but the IOG conflict flagged in Chapter 1 is never restated here and no verify-one-claim exercise is staged.

Priya Raghavan — ZK Systems Engineer — 5.0/10

[5/10] Trace one shielded Zswap transaction end-to-end through the stack… — The four-phase pipeline is traced with measured latencies and the nullifier's double-spend role gets one clause (Layer 6, Jubjub-computed), but Zswap itself barely appears, the commitment-in/nullifier-out/Merkle-root-update mechanics are never walked, and linkability prevention is never attributed to a specific component.
[2/10] Break the nullifier on paper: design two flawed nullifier… — The exercise is absent: no flawed derivation is designed, no double-spend or linkability failure is constructed, and no layer attribution is made — only the correct nullifier's existence is mentioned, with the domain-separation seed left back in Chapter 4.
[4/10] Apply the author's own bias disclosure as an exercise:… — The chapter shows real candor from IOG's own documentation (the documented >/<= compiler bug, failing cross-contract transfers, unspecified governance, a Stage 0-1 maturity verdict, an honest "Does Not Solve" column), but every citation is a Midnight reference document — no Zswap paper, independent audit, or any non-IOG source is consulted, so the treat-founder-case-studies-like-vendor-benchmarks exercise is not modeled.
[9/10] Map Midnight's full stack onto the seven layers --… — This is the chapter's spine and it is genuinely ls-listing-grade: per-circuit key files with sizes (13.7KB prover / 1.3KB verifier), Compact's track-witness-data pass at L2, ZKIR's 24 opcodes in 8 categories at L4, Halo 2/UltraPlonk over BLS12-381 with 17-24s measured latencies at L5-6, localhost:6300, SPECK-denominated fees, and the immutable verifier-key lifecycle at L7 — all pinned to versioned doc sections (though IOG-sourced throughout).

Dr. Marisol Chen — Assessment Designer — 6.0/10

[7/10] Evaluate Midnight's full stack layer by layer against the seven-layer… — The chapter delivers a complete seven-layer mapping with trust commentary for Compact (L2) and ZKIR (L4), but "Zswap" — which my audit table names as the third artifact — never appears anywhere in this chapter (re-verified by search; it occurs only in Chapters 2, 3, and 7), so one of the table's three required assignments cannot be sourced here.
[3/10] Judge whether Zswap's nullifier mechanism prevents double-spending without creating… — The chapter never mentions Zswap and reduces the nullifier mechanism to a single clause ("producing the unique identifier that prevents double-spending of shielded UTXOs"); the commitment-spend-nullifier transaction trace and any linkability analysis are absent, leaving the verdict essay without its evidentiary spine.
[8/10] Critique the author's disclosed conflict of interest — having founded IOG… — The chapter's systematic per-claim citation practice (Developer Guide page numbers, SDK section references) and its candid gap list ("documentation is silent," compiler bug §4.8) supply the verifiable-versus-needs-audit sorting, though the IOG disclosure itself lives back in Chapter 1 rather than being restated here.

Prof. David Lindqvist — Political Economist of Trust — 3.5/10

[4/10] Students must be able to treat the author's disclosed conflict… — Chapter 1's disclosure and verifiability promise are never re-engaged here: the conflict goes entirely unmentioned in the chapter itself, the claim-partition exercise is absent, and the "473 pages of verified documentation" grounding every claim is Midnight's own documentation — the vendor's word citing the vendor's word, with no third-party audit or external measurement in sight; even the title's obvious critical reading ("privacy theater" as fake privacy) is left unexamined.
[2/10] Students must be able to analyze the nullifier as an institution of permanent… — Nullifiers appear only as a mechanism (Jubjub computation, double-spend prevention); the ever-growing ledger liability, its perpetual storage cost, and the question of who underwrites that memory forever are never raised.
[1/10] Students must be able to read Zswap as a market-design choice… — Zswap does not appear in this chapter at all; the front-running, censorship, and liquidity-provider economics my goal demanded are nowhere in the book's dedicated Midnight treatment.
[7/10] Students must be able to conduct a full seven-layer trust audit of Midnight… — The seven-layer mapping is genuinely executed with every named artifact (disclose(), ZKIR's 24 opcodes, the three-token model) and the audit is honest where it counts — Stage 0-1 L2Beat placement, the "most conspicuous gap" of unspecified circuit-upgrade governance, documented compiler bugs, broken cross-contract transfers, unexamined side channels — but the who-is-trusted/why-they-comply/replacement-cost ledger is delivered only piecemeal, and the extended theater-analogy and DUST sections drift into promotional lyricism that an audit chapter cannot afford.

Chapter 13: The Market Landscape

Chapter mean: 7.7/10

Prof. Elena Vasquez — Theoretical Cryptographer — 6.5/10

[6/10] Define a ZK Rollup (deg 10) exactly: validity proofs… — The governance residue is enumerated relentlessly ("a committee can still replace the audience"; every major rollup at Stage 0-1; the per-segment "Trust relocated from/to" ledger lines), and Starknet's no-wrap transparency tradeoff is concrete, but DA and sequencer liveness are never listed as outside-the-theorem for the rollups themselves, and the validity-proof definition stays informal.
[7/10] Formalize the trust that Proving-as-a-Service reintroduces: the delegated… — The Chapter 4 connection is explicit ("the privacy tradeoff from Chapter 4 returns with full force… the person who proves for you sees your data") and TEEs/MPC-assisted proving are named with the correct verdict ("each moves the trust, none eliminates it"), plus the sharp trust-financialized observation ("you trust the prover's financial exposure") — but the definitional voiding of ZK against the delegated prover and the per-option added assumptions are stated in substance, not formalized.
[8/10] State what ZKML (Provable Machine Learning) actually proves… — The central distinction is made exactly and repeatedly ("ZKML proves the inference was correct given the model. It says nothing about whether the model is fair, whether it was trained on representative data…"), with commendable benchmark hygiene on DeepProve's 700x ("Lagrange's own reported benchmark… pending external validation"); only the committed-versus-advertised-model gap goes unnamed.
[5/10] Write ZK Identity / Selective Disclosure as a predicate… — eIDAS 2.0's mandate and the enrollment trust surface are handled well ("the proof is trustless. The enrollment is not"), but the predicate-over-signed-credential is never written, and the provably-minimal versus policy-minimal distinction I demanded is entirely absent — the section instead declares identity "the clearest win."

Dr. Sam Okafor — Mathematics Educator — 7.0/10

[6/10] Own the mapping from products to layers: a ZK rollup is Layers 5-7 industrialized… — ZKML is explicitly tied to Chapter 5's Overhead Tax ("runs even steeper for ML workloads") and rollups to Layer 7 governance, but the chapter's organizing lens is trust-relocation rather than locate-on-the-DAG, and coprocessors are declared "a category that the original seven-layer framework entirely missed" instead of being mapped onto it.
[3/10] Stuck-point: students must be able to articulate why the "ZK" in ZK rollup is NOT… — The rollup section frames the product as correctness-plus-compression ("generate a ZK proof of correct execution") and contrasts Midnight as privacy-first, but it never states head-on that rollups leave the zero-knowledge property largely unused on a fully public ledger — the field's most common outsider conflation goes unconfronted.
[10/10] Own Proving-as-a-Service as the market's answer to Chapter 4's hardware ladder… — The section opens by name-checking the prerequisite ("the privacy tradeoff from Chapter 4 returns with full force, and it returns as a business model"), names the price exactly as demanded ("the person who proves for you sees your data... who sees the witness? -- has no market solution"), and adds a margin analysis where "trust has not been eliminated. It has been priced."
[9/10] Evaluate ZK Identity and selective disclosure against Chapter 9's regulatory pull… — eIDAS 2.0's 450-million-citizen mandate is evaluated as demand creation ("the market does not need to be created. It has been mandated") with the honest enrollment-hardware caveat ("The proof is trustless. The enrollment is not"), though the specific contrast — demand for the ZK property itself rather than for succinctness — stays implicit.

Priya Raghavan — ZK Systems Engineer — 7.0/10

[7/10] Build the Proving-as-a-Service cost model: from your Chapter… — The cost model is genuinely built ($2-3/GPU-hr cloud rates, H100 700W energy at $0.035-0.056/GPU-hr, $200k-500k/yr rollup proving with sourcing caveats, 40-60% owned vs 15-25% rented margins honestly flagged as author estimates, $PROVE slashing as "trust financialized"), but the own-cluster-vs-outsource volume threshold is only implied by the margin gap, and the 3am proving-service outage gets one clause about "prover liveness" rather than a failure analysis.
[5/10] Compare Starknet and ZKsync Era layer-by-layer using the seven-layer… — Both get accurate short profiles (Starknet's native un-wrapped STARK verification and Cairo ISA vs ZKsync's Airbender at 21.8M cycles/s), but the layer-by-layer comparison never happens: fields, on-chain verification costs, and the community-clustering explanation are all absent from this chapter, left scattered in Chapter 11's table.
[9/10] Prototype or paper-design one ZK Coprocessor query (prove a… — Both paper designs are done with the hidden trust point named exactly as my goal demanded: the TWAP coprocessor query (blocks 19.0M-19.2M, archive-node read, $0.10-1.00/query) with "the proof says the computation was faithful, not that the machine was honest about what it was asked," and the Partisia credential flow with the issuer-key concentration ("proving a document is authentic" vs "proving it is true"), plus World's "the proof is trustless; the enrollment is not."
[7/10] Stress-test the ZKML pitch with numbers: find the current… — The numbers are present and skeptically handled (EZKL baseline 300-1000+s per modest inference, DeepProve's 700x explicitly flagged as an unreproduced vendor benchmark, the 100M-parameter extrapolation to seconds), and the verdict effectively lands (regulatory audits near-viable, production-latency AI a decade out, "proven inference" is not "trustworthy AI") — though the per-inference dollar cost is never computed.

Dr. Marisol Chen — Assessment Designer — 9.5/10

[10/10] Evaluate the maturity of the ZK Rollup segment against the… — Every segment carries an explicit maturity label (Production, Growth, Research, Pilot) plus adoption evidence (TVL, revenue shares, pre-revenue flags) and the closing "six venues" verdict paragraph, giving the memo its full adoption-versus-hype substance.
[10/10] Judge the Proving-as-a-Service model against the book's Privacy-as-a-Luxury-Good… — The chapter reopens Chapter 4's tradeoff by name ("the privacy tradeoff from Chapter 4 returns... as a business model"), names the trust cost verbatim ("the person who proves for you sees your data"), and concludes the witness-privacy question "has no market solution."
[8/10] Construct a market map that places Starknet, ZKsync Era, proving… — All five named entrants appear with their technical stacks and trust-relocation summaries, but the chapter never assigns segments to seven-layer positions (it even notes coprocessors are "a category the original seven-layer framework entirely missed"), so the diagram's layer coordinates must be synthesized from earlier chapters.
[10/10] Formulate an adoption thesis predicting which segment reaches product-market fit… — The chapter supplies layer-level constraints in abundance (the Chapter 5 overhead tax hitting ZKML hardest, Stage 0-1 governance capping rollup trust, the Chapter 6 cost collapse, the eIDAS mandate for identity), more than the two the thesis requires.

Prof. David Lindqvist — Political Economist of Trust — 8.3/10

[8/10] Students must be able to work the ZK Rollup income statement… — "This chapter follows the money. But it watches where the trust goes" is the assignment executed: per-rollup proving costs ($200-500K/yr recouped through user fees), the L2Beat lens applied by name to every operator, and the blunt accounting that trust was "minimized at the cryptographic layer and preserved, nearly intact, at the institutional layer" — though sequencer censorship and forced-exit friction are not specifically named among the omitted residuals.
[9/10] Students must be able to analyze Proving-as-a-Service as a re-centralization dynamic… — The full cost and margin structure is worked (hardware/energy/engineering moat, 40-60% owned vs 15-25% cloud margins, the cloud-computing oligopoly equilibrium), the $PROVE slashing mechanism is sharply read as possibly "merely trust-financialized," and "this is an honest market; it is not the market the cypherpunks imagined" is exactly the conclusion my goal demanded — with contestability addressed through margin compression rather than my named forces.
[7/10] Students must be able to evaluate ZK Identity and selective disclosure as a regulation-driven… — The mandated-market argument is explicit ("the market does not need to be created; it has been mandated"), and the enrollment residue is honestly priced ("the proof is trustless; the enrollment is not"), but — as in Chapter 9 — the new leverage accruing to the issuing state is never evaluated; issuers are named as trusted parties without asking what that trust costs citizens.
[9/10] Students must be able to state precisely what a ZKML proof warrants… — Delivered with precision: "ZKML proves the inference was correct given the model" with weights, training data, and deployment wisdom explicitly unproven, DeepProve's 700x flagged as an unvalidated vendor claim, the coprocessor's attestation boundary drawn ("who watches the prover's hardware?"), and the Partisia line — authentic versus true is "the gap that no amount of cryptography can close" — is the exact distinction my goal required.

Chapter 14: Open Questions and the Road Ahead

Chapter mean: 6.9/10

Prof. Elena Vasquez — Theoretical Cryptographer — 5.3/10

[6/10] Classify each of the Seven Open Questions (deg 8)… — Each question carries differentiated hardness signals (Q1 "the bottleneck is not fundamental," Q2 "5-10 years for theoretical resolution," Q7 "Executive Risk: Low… a pedagogical question") plus per-question timelines, but my explicit trichotomy — new theorem vs new assumption vs engineering under settled theory — is never used as a classification scheme, leaving the hardness differences implicit rather than systematic.
[6/10] Map the Three Frontiers (Performance/Security/Privacy) onto the seven… — The mapping is stated outright ("Performance is primarily a Layers 3-5 problem. Security spans Layers 2-6. Privacy… is a property of the entire stack") and the conjunction calculation ($0.99^7 \approx 93.2%$, "a system with six perfect layers and one compromised layer is… compromised") is genuine quantitative work, but the implicit inequality — performance gains that shrink soundness margins are relocated risk — is never stated, let alone proven, with only the soundcalc mention gesturing at soundness margins.
[4/10] Produce one original open problem in the discipline this… — The chapter's most original problems are real and well-posed — the streaming-folding cross-term decomposability barrier (Q5) identifies a precise algebraic obstruction, and the "actuarial science for cryptographic trust" with its Layer-2-plus-Layer-7 conjunction failure mode is a genuinely new framing — but not one is stated as a game with a named adversary and winning condition, which was my explicit bar for calling something a question.

Dr. Sam Okafor — Mathematics Educator — 7.0/10

[7/10] Own the Three Frontiers (performance, security, privacy) as a tension triangle… — All three concrete artifacts land at their corners (side channels at Privacy via Q6's R=0.57, under-constrained circuits at Security via Picus/ZKAP, the Overhead Tax at Performance), and the performance-privacy strain is worked in depth ("The tension between side-channel resistance and hardware throughput has no known resolution") — but the frontiers are framed as a sequential timeline (2023-2025, 2026-2028, 2027+), not the mutual-strain triangle I specified.
[6/10] Map the Seven Open Questions onto the seven layers: each open question is… — Q4 re-enumerates all seven layer assumptions and the Convergence section maps questions to frontiers as blockers, but the questions themselves do not map one-per-layer: Q1, Q5, and Q6 all cluster at Layer 3, no question is dedicated to Layers 2 or 4, and Q4/Q7 are meta-questions — the decomposition-as-research-agenda is gestured at, not executed.
[9/10] Stuck-point: students must be able to articulate why an open question is NOT a missing… — The engineering-versus-possibly-impossible sort is performed explicitly and repeatedly ("the bottleneck is not fundamental" for Q1; "No paper proves that O(1)-size post-quantum proofs are impossible... Either answer would reshape the field" for Q2, with Wee-Wu barrier results; "hardness is a conjecture, not a theorem" for Q4), though the undecidability framing of under-constrained-circuit detection specifically is missing.
[6/10] Leave with the transferable skill: given any new proving system announced after this book… — The closing offers the shared-vocabulary defense of the model and Q4's proposed "actuarial science for cryptographic trust," but the explicit locate-it-on-the-DAG / name-the-assumptions / which-frontier-moved procedure is never handed to the reader as a method — the Coda spends its final pages on the Alice/pharmacy/Madrid vision instead (a skill Chapter 11 actually demonstrated better than the finale teaches it).

Priya Raghavan — ZK Systems Engineer — 6.3/10

[8/10] Map the Seven Open Questions onto the seven layers… — The questions are explicitly wired to the Three Frontiers (Q1 the last Performance blocker, Q2/Q3 Security, Q6 Privacy) with per-question Executive Risk and Timeline lines, and Q1 even carries the falsifiable experiment I asked for — metric (witness share of proving time), hardware (Tier 2 RTX 4090 workstation), and the number that counts as an answer (below 20%) — though only Q1 gets that full treatment.
[6/10] Write the on-call runbook for a production proving stack… — The seven per-layer assumptions are enumerated, the conjunction math is done properly (0.99^7 ≈ 93.2%), and the proposed "actuarial science of cryptographic trust" with empirical per-layer failure rates (67% under-constrained, six Frozen Heart implementations, two governance attacks) plus the L2+L7 conjunction scenario is genuinely runbook-adjacent — but detection signals and mitigations per layer are never written, so the alerting taxonomy stays a sketch.
[5/10] Take one frontier claim from the current literature —… — Primary sources are cited densely (Arguzz's 11 bugs across 6 zkVMs, soundcalc, Nair/Thaler/Zhu, Wee-Wu barrier results) and the book elsewhere models good verification instincts, but no claim is actually reproduced here — and the Convergence section itself misattributes the $97M-to-$7.59B projection to "MarketsandMarkets" after Chapter 13 carefully separated those figures between Chorus One and Grand View Research, committing exactly the source-conflation this goal warns against.

Dr. Marisol Chen — Assessment Designer — 9.5/10

[10/10] Design a research proposal targeting one of the Seven Open… — Each of the seven questions comes with its layer location, named active approaches and teams (ZKPOG, Nair-Thaler-Zhu, Wee-Wu), and measurable resolution criteria (e.g., witness share below 20% on Tier 2 hardware; EF's 100/128-bit targets), which is the proposal's full scaffolding.
[9/10] Hypothesize how resolving one chosen open question would propagate through… — The chapter assigns every question to layers and frontiers and analyzes downstream consequences (bifurcation from Q2, conjunction arithmetic in Q4, Q6 as the Privacy-frontier blocker), though the fourteen-edge DAG itself must be imported from Chapter 10 to draw the cascade diagram.
[10/10] Compose a prioritized three-year roadmap across the Three Frontiers… — The Three Frontiers section supplies dated status, per-frontier evidence lists, explicit blocker mappings, and the sequencing rationale (security as prerequisite for institutional trust), plus the competing-frontier objections a defense must answer.
[9/10] Produce an original seven-layer trust decomposition of a system outside… — Question 4's numbered enumeration of all seven assumptions in independent, testable form is the exact stylistic template the transfer exercise requires, though the chapter never models a non-ZK decomposition, so the student demonstrates transfer entirely unaided (which is appropriate for a Create-level objective).

Prof. David Lindqvist — Political Economist of Trust — 6.5/10

[7/10] Students must be able to reframe the Seven Open Questions as unassigned trust… — Every question carries an "Executive Risk" block that is genuinely a liability statement ("$20B in TVL sits in systems where a multisig can replace the verifier"; deployers "inherit seven trust assumptions they may not have assessed"), but the institutional assignment — which of market, standards body, foundation, or academy has both the incentive and the authority to close each — is done only sporadically (EF for security, named teams for Q1) rather than per question.
[5/10] Students must be able to analyze the Three Frontiers (Performance/Security/Privacy)… — The frontiers are well-evidenced and "you cannot benchmark soundness the way you benchmark throughput" comes close to the market-failure insight, but the portfolio misalignment argument — performance privately captured, security and privacy as under-supplied public goods, systematic underinvestment predicted — is never made, and the EF pivot is cited as evidence rather than evaluated as a correction mechanism.
[6/10] Students must be able to design a migration governance regime for assumption… — Q2's bifurcation analysis ("mandatory replacement, not upgrade") and Q4's proposed "actuarial science for cryptographic trust" (per-layer failure rates from Chaliasos, Frozen Heart, and Beanstalk data, conjunction probabilities per deployment) sketch the monitoring half of my regime, but who holds the authority to force a costly migration before failure — the governance question proper — goes unasked.
[8/10] As a capstone, students must be able to argue both sides of the book's thesis… — The skeptical side is argued with unexpected quantitative teeth (0.99^7 ≈ 93.2%, "adding layers makes the individual layers stronger but the conjunction weaker," "'almost trustless' is a category error," and the undetectable-and-unrecoverable Layer 2 + Layer 7 conjunction scenario), set against the affirmative trajectory and the incident evidence — though the accountability-diffusion framing stays implicit and the Coda's Alice-in-Madrid vision tilts the closing weight to the affirmative.

FilesExpand file tree

learnobjectives-review.md

Latest commit

History

learnobjectives-review.md

File metadata and controls

Achievement Review — Proving Nothing vs its Learning Objectives

Scoring matrix

Findings the panel converged on

Chapter 1: The Promise of Provable and Programmable Secrets

Prof. Elena Vasquez — Theoretical Cryptographer — 4.0/10

Dr. Sam Okafor — Mathematics Educator — 7.5/10

Priya Raghavan — ZK Systems Engineer — 5.8/10

Dr. Marisol Chen — Assessment Designer — 9.8/10

Prof. David Lindqvist — Political Economist of Trust — 6.8/10

Chapter 2: Layer 1 -- Building the Stage

Prof. Elena Vasquez — Theoretical Cryptographer — 5.5/10

Dr. Sam Okafor — Mathematics Educator — 9.0/10

Priya Raghavan — ZK Systems Engineer — 6.0/10

Dr. Marisol Chen — Assessment Designer — 10.0/10

Prof. David Lindqvist — Political Economist of Trust — 8.3/10

Chapter 3: Choreographing the Act (Layer 2 -- Language)

Prof. Elena Vasquez — Theoretical Cryptographer — 5.3/10

Dr. Sam Okafor — Mathematics Educator — 8.5/10

Priya Raghavan — ZK Systems Engineer — 6.5/10

Dr. Marisol Chen — Assessment Designer — 8.8/10

Prof. David Lindqvist — Political Economist of Trust — 7.5/10

Chapter 4: The Secret Performance (Layer 3 -- Witness Generation)

Prof. Elena Vasquez — Theoretical Cryptographer — 6.8/10

Dr. Sam Okafor — Mathematics Educator — 9.8/10

Priya Raghavan — ZK Systems Engineer — 8.0/10

Dr. Marisol Chen — Assessment Designer — 9.5/10

Prof. David Lindqvist — Political Economist of Trust — 7.5/10

Chapter 5: Encoding the Performance (Layer 4 -- Arithmetization)

Prof. Elena Vasquez — Theoretical Cryptographer — 7.0/10

Dr. Sam Okafor — Mathematics Educator — 7.0/10

Priya Raghavan — ZK Systems Engineer — 8.3/10

Dr. Marisol Chen — Assessment Designer — 9.8/10

Prof. David Lindqvist — Political Economist of Trust — 7.0/10

Chapter 6: Layer 5 -- The Sealed Certificate

Prof. Elena Vasquez — Theoretical Cryptographer — 6.5/10

Dr. Sam Okafor — Mathematics Educator — 9.5/10

Priya Raghavan — ZK Systems Engineer — 8.3/10

Dr. Marisol Chen — Assessment Designer — 10.0/10

Prof. David Lindqvist — Political Economist of Trust — 6.5/10

Chapter 7: Layer 6 -- The Deep Craft

Prof. Elena Vasquez — Theoretical Cryptographer — 7.8/10

Dr. Sam Okafor — Mathematics Educator — 8.8/10

Priya Raghavan — ZK Systems Engineer — 7.5/10

Dr. Marisol Chen — Assessment Designer — 9.8/10

Prof. David Lindqvist — Political Economist of Trust — 8.0/10

Chapter 8: Layer 7 -- The Verdict

Prof. Elena Vasquez — Theoretical Cryptographer — 8.0/10

Dr. Sam Okafor — Mathematics Educator — 9.0/10

Priya Raghavan — ZK Systems Engineer — 8.0/10

Dr. Marisol Chen — Assessment Designer — 10.0/10

Prof. David Lindqvist — Political Economist of Trust — 9.5/10

Chapter 9: Privacy-Enhancing Technologies

Prof. Elena Vasquez — Theoretical Cryptographer — 6.0/10

Dr. Sam Okafor — Mathematics Educator — 9.3/10

Priya Raghavan — ZK Systems Engineer — 6.5/10

Dr. Marisol Chen — Assessment Designer — 9.3/10

Prof. David Lindqvist — Political Economist of Trust — 6.0/10

Chapter 10: The Synthesis -- Three Paths, Not Two

Prof. Elena Vasquez — Theoretical Cryptographer — 6.8/10

Dr. Sam Okafor — Mathematics Educator — 9.8/10

Priya Raghavan — ZK Systems Engineer — 7.3/10

Dr. Marisol Chen — Assessment Designer — 10.0/10

Prof. David Lindqvist — Political Economist of Trust — 7.5/10

Chapter 11: zkVMs -- The Universal Stage

Prof. Elena Vasquez — Theoretical Cryptographer — 6.8/10

Dr. Sam Okafor — Mathematics Educator — 8.3/10

Priya Raghavan — ZK Systems Engineer — 6.8/10

Dr. Marisol Chen — Assessment Designer — 9.3/10

Prof. David Lindqvist — Political Economist of Trust — 5.8/10

Chapter 12: Midnight -- The Privacy Theater

Prof. Elena Vasquez — Theoretical Cryptographer — 4.3/10

Dr. Sam Okafor — Mathematics Educator — 5.0/10

Priya Raghavan — ZK Systems Engineer — 5.0/10

Dr. Marisol Chen — Assessment Designer — 6.0/10