feat: emit batch_expiration_block_num as the running-min over transactions

The batch kernel accumulates the minimum expiration_block_num across all
transactions (popped per-tx from the advice stack during Layer 2 header
verification) and emits it as the batch_expiration_block_num output.
BatchExecutor cross-checks the kernel's value against the expiration the
ProposedBatch independently derives, erroring with BatchExpirationMismatch
on disagreement.

Author: claude

CHANGELOG.md

@@ -5,6 +5,7 @@
 ### Changes
 - Added a skeleton batch kernel ([#1122](https://github.com/0xMiden/protocol/issues/1122)) wired through `LocalBatchProver::prove` and attached to `ProvenBatch` as an `ExecutionProof`. It does not yet perform any verification.
 - The batch kernel now verifies the batch's transaction list against its `BATCH_ID`, verifies each transaction header, and computes the batch `INPUT_NOTES_COMMITMENT` ([#2905](https://github.com/0xMiden/protocol/pull/2905)).
+- The batch kernel now emits `batch_expiration_block_num`, the running minimum of its transactions' expiration block numbers, cross-checked against the proposed batch ([#3019](https://github.com/0xMiden/protocol/pull/3019)).
 
 - [BREAKING] Renamed `AccountStorageDelta` to `AccountStoragePatch` ([#3002](https://github.com/0xMiden/protocol/pull/3002)).
 - [BREAKING] Extracted `NullifierTreeBackendReader` and `AccountTreeBackendReader` traits from existing `NullifierTreeBackend` and `AccountTreeBackend` traits ([#2755](https://github.com/0xMiden/protocol/pull/2755)).

crates/miden-protocol/asm/kernels/batch/lib/memory.masm

@@ -7,6 +7,8 @@
 # | Address range     | Constant                | Contents                         |
 # +-------------------+-------------------------+----------------------------------+
 # | 0                 | NUM_TRANSACTIONS_PTR    | num_transactions (1 felt).       |
+# | 1                 | BATCH_EXPIRATION_PTR    | batch_expiration_block_num,      |
+# |                   |                         | the running min over all txs.    |
 # | 4..8              | BATCH_HASHER_RATE0_PTR  | RATE0 of the batch-level         |
 # |                   |                         | poseidon2 hasher state.          |
 # | 8..12             | BATCH_HASHER_RATE1_PTR  | RATE1 of the batch-level hasher. |
@@ -39,6 +41,10 @@
 #! Single-felt slot holding `num_transactions` after Layer 1 verification.
 const NUM_TRANSACTIONS_PTR=0
 
+#! Single-felt slot holding `batch_expiration_block_num`: the running minimum of every
+#! transaction's `expiration_block_num`, initialised to `u32::MAX`.
+const BATCH_EXPIRATION_PTR=1
+
 # BATCH HASHER STATE
 # =================================================================================================
 
@@ -107,6 +113,25 @@ pub proc get_num_transactions
     mem_load.NUM_TRANSACTIONS_PTR
 end
 
+# BATCH EXPIRATION BLOCK NUM
+# =================================================================================================
+
+#! Stores `batch_expiration_block_num`.
+#!
+#! Inputs:  [batch_expiration_block_num]
+#! Outputs: []
+pub proc set_batch_expiration_block_num
+    mem_store.BATCH_EXPIRATION_PTR
+end
+
+#! Returns `batch_expiration_block_num`.
+#!
+#! Inputs:  []
+#! Outputs: [batch_expiration_block_num]
+pub proc get_batch_expiration_block_num
+    mem_load.BATCH_EXPIRATION_PTR
+end
+
 # BATCH HASHER STATE
 # =================================================================================================
 

crates/miden-protocol/asm/kernels/batch/lib/prologue.masm

@@ -3,6 +3,12 @@ use miden::core::mem
 use miden::batch_kernel::memory
 use miden::batch_kernel::memory::TX_TUPLES_PTR
 
+# CONSTANTS
+# =================================================================================================
+
+#! Maximum value of `batch_expiration_block_num`, used as the running-min initialiser.
+const MAX_BLOCK_NUM=0xFFFFFFFF
+
 # PROLOGUE
 # =================================================================================================
 
@@ -16,7 +22,8 @@ use miden::batch_kernel::memory::TX_TUPLES_PTR
 #! - Layer 2: for each transaction, pipes the felt sequence hashed by `TransactionId::new` from the
 #!   advice map keyed by the verified `tx_id`, asserting that the sequential hash matches the
 #!   `tx_id`. Each transaction's data is written into [`memory::TX_HEADERS_PTR`] at the appropriate
-#!   per-tx offset.
+#!   per-tx offset. For each transaction, pops its `expiration_block_num` from the advice stack and
+#!   updates the running minimum in [`memory::BATCH_EXPIRATION_PTR`].
 #!
 #! `BATCH_ID` is the batch's `BatchId` value, i.e. the sequential hash of the `(tx_id, account_id)`
 #! tuples committing to the transactions in the batch.
@@ -28,6 +35,7 @@ use miden::batch_kernel::memory::TX_TUPLES_PTR
 #!     For each verified tx_id_i:
 #!       tx_id_i |-> [INIT_i, FINAL_i, INPUT_NOTES_COMMITMENT_i, OUTPUT_NOTES_COMMITMENT_i,
 #!                    FEE_ASSET_i]
+#!   Advice stack: [expiration_block_num_0, expiration_block_num_1, ...]
 #!
 #! Outputs:
 #!   Operand stack: []
@@ -40,6 +48,9 @@ use miden::batch_kernel::memory::TX_TUPLES_PTR
 #! TODO: verify that each transaction's reference block is contained in the chain MMR rooted at
 #!       BLOCK_COMMITMENT.
 #! TODO: verify that the partial-blockchain peaks hash matches the block header's chain commitment.
+#! TODO: assert each `expiration_block_num_i > reference_block_num`.
+#! TODO: derive each `expiration_block_num_i` from data committed-to in the verified transaction
+#!       header rather than from the unverified advice stack.
 pub proc prepare_batch
     # Layer 1: pipe BATCH_ID's mapped value to tx_tuples_ptr + verify.
     # ---------------------------------------------------------------------------------------------
@@ -65,7 +76,12 @@ pub proc prepare_batch
     # Stack: [end_ptr]
     drop
 
-    # Layer 2: for each transaction, pipe + verify its header.
+    # Initialise batch_expiration_block_num to u32::MAX.
+    # ---------------------------------------------------------------------------------------------
+
+    push.MAX_BLOCK_NUM exec.memory::set_batch_expiration_block_num
+
+    # Layer 2: for each transaction, pipe + verify its header, accumulate expiration min.
     # ---------------------------------------------------------------------------------------------
 
     exec.memory::get_num_transactions
@@ -94,6 +110,23 @@ pub proc prepare_batch
         # Stack: [end_ptr, tx_index, num_transactions]
         drop
 
+        # Accumulate the expiration running-min from the advice stack.
+        adv_push
+        # Stack: [expiration, tx_index, num_transactions]
+
+        dup exec.memory::get_batch_expiration_block_num
+        # Stack: [current_min, expiration, expiration, tx_index, num_transactions]
+
+        u32lt
+        # Stack: [is_new_min, expiration, tx_index, num_transactions]
+
+        if.true
+            exec.memory::set_batch_expiration_block_num
+        else
+            drop
+        end
+        # Stack: [tx_index, num_transactions]
+
         add.1
         dup.1 dup.1 neq
         # Stack: [should_loop, tx_index, num_transactions]

crates/miden-protocol/asm/kernels/batch/main.masm

@@ -1,3 +1,6 @@
+use miden::core::sys
+
+use miden::batch_kernel::memory
 use miden::batch_kernel::note_tracker
 use miden::batch_kernel::prologue
 
@@ -9,7 +12,7 @@ use miden::batch_kernel::prologue
 #! A transaction batch groups a set of independently-proven transactions so they can later be
 #! aggregated into a block by the block kernel. This program reconstructs the per-transaction data
 #! from the advice provider, anchoring the reconstruction in the public `BATCH_ID`, and emits the
-#! batch's `INPUT_NOTES_COMMITMENT`.
+#! batch's `INPUT_NOTES_COMMITMENT` and its effective `batch_expiration_block_num`.
 #!
 #! Reconstruction is a recursive unhashing chain. Each layer of advice data is keyed by a hash that
 #! the previous layer's verification produced, so once `BATCH_ID` is anchored to the public input,
@@ -43,12 +46,14 @@ use miden::batch_kernel::prologue
 #! - INPUT_NOTES_COMMITMENT is the sequential hash over every transaction's
 #!   `(NULLIFIER, EMPTY_OR_COMMITMENT)` tuples.
 #! - BATCH_NOTE_TREE_ROOT is currently not wired up (empty word).
-#! - batch_expiration_block_num is currently not wired-up (zero).
+#! - batch_expiration_block_num is the minimum of every transaction's `expiration_block_num`.
 #!
 #! TODO: verify BLOCK_COMMITMENT against block header data via the same pipe-and-verify pattern.
 #! TODO: authenticate unauthenticated input notes against BLOCK_COMMITMENT's chain MMR.
 #! TODO: erase intra-batch unauthenticated notes from INPUT_NOTES_COMMITMENT.
-#! TODO: emit BATCH_NOTE_TREE_ROOT (the batch note tree SMT root) and batch_expiration_block_num.
+#! TODO: emit BATCH_NOTE_TREE_ROOT (the batch note tree SMT root).
+#! TODO: derive batch_expiration_block_num from verified data rather than the unverified advice
+#!       stack (see `prologue::prepare_batch`).
 #! TODO: aggregate per-account updates and emit a separate ACCOUNT_UPDATES_COMMITMENT output.
 #! TODO: recursively verify each transaction's `ExecutionProof`.
 proc main
@@ -64,12 +69,25 @@ proc main
     exec.note_tracker::compute_input_notes_commitment
     # Stack: [INPUT_NOTES_COMMITMENT, pad(16)]
 
-    # Drop the surplus padding word so the stack holds exactly the 16-felt output region
-    # [INPUT_NOTES_COMMITMENT, BATCH_NOTE_TREE_ROOT, batch_expiration_block_num, pad(7)]. The
-    # BATCH_NOTE_TREE_ROOT and batch_expiration_block_num cells stay zero (wired up in follow-up
-    # PRs).
-    movupw.3 dropw
-    # Stack: [INPUT_NOTES_COMMITMENT, pad(12)]
+    # Assemble the output region [INPUT_NOTES_COMMITMENT, BATCH_NOTE_TREE_ROOT, expiration]. The
+    # BATCH_NOTE_TREE_ROOT word stays empty for now (wired up in a follow-up PR).
+    padw
+    # Stack: [BATCH_NOTE_TREE_ROOT, INPUT_NOTES_COMMITMENT, pad(16)]
+
+    exec.memory::get_batch_expiration_block_num
+    # Stack: [batch_expiration_block_num, BATCH_NOTE_TREE_ROOT, INPUT_NOTES_COMMITMENT, pad(16)]
+
+    movdn.8
+    # Stack: [BATCH_NOTE_TREE_ROOT, INPUT_NOTES_COMMITMENT, batch_expiration_block_num, pad(16)]
+
+    swapw
+    # Stack: [INPUT_NOTES_COMMITMENT, BATCH_NOTE_TREE_ROOT, batch_expiration_block_num, pad(16)]
+
+    # batch_expiration_block_num is a single felt, so the output region (9 felts) is not
+    # word-aligned and the surplus padding cannot be dropped in whole words; truncate the operand
+    # stack to the 16-felt output [INPUT_NOTES_COMMITMENT, BATCH_NOTE_TREE_ROOT,
+    # batch_expiration_block_num, pad(7)].
+    exec.sys::truncate_stack
 end
 
 begin

crates/miden-protocol/src/batch/kernel.rs

@@ -111,7 +111,10 @@ impl BatchKernel {
     ///   `TransactionId::input_elements`).
     /// - each per-tx `INPUT_NOTES_COMMITMENT` -> the `(NULLIFIER, EMPTY_OR_COMMITMENT)` tuples.
     ///
-    /// The per-tx output-notes layer and the expiration data are wired up in follow-up PRs.
+    /// It also pushes each transaction's `expiration_block_num` onto the advice stack, from which
+    /// the kernel accumulates the batch-wide running minimum.
+    ///
+    /// The per-tx output-notes layer is wired up in a follow-up PR.
     fn build_advice_inputs(proposed_batch: &ProposedBatch) -> AdviceInputs {
         let mut advice_inputs = AdviceInputs::default();
 
@@ -153,6 +156,13 @@ impl BatchKernel {
             }
         }
 
+        // Advice stack: each transaction's expiration_block_num, in transaction order. The kernel
+        // pops one per transaction and accumulates the running minimum; order is irrelevant to the
+        // resulting minimum.
+        for tx in proposed_batch.transactions().iter() {
+            advice_inputs.stack.push(Felt::from(tx.expiration_block_num()));
+        }
+
         advice_inputs
     }
 }

crates/miden-protocol/src/errors/mod.rs

@@ -1096,6 +1096,13 @@ pub enum ProvenBatchError {
     BatchKernelExecutionFailed(#[source] ExecutionError),
     #[error("batch kernel produced an invalid output stack")]
     BatchKernelOutputInvalid(#[source] BatchOutputError),
+    #[error(
+        "batch kernel computed expiration block number {actual} but the proposed batch expected {expected}"
+    )]
+    BatchExpirationMismatch {
+        actual: BlockNumber,
+        expected: BlockNumber,
+    },
 }
 
 // BATCH OUTPUT ERROR

crates/miden-testing/src/kernel_tests/batch/test_batch_kernel.rs

@@ -113,20 +113,25 @@ fn run_kernel(
 // ================================================================================================
 
 /// The batch kernel reconstructs every transaction's input notes from the advice provider, anchors
-/// them in `BATCH_ID`, and emits the batch's `INPUT_NOTES_COMMITMENT`. The batch note tree root and
-/// expiration outputs are not wired up yet, so they remain empty / zero.
+/// them in `BATCH_ID`, and emits the batch's `INPUT_NOTES_COMMITMENT` and the running-min
+/// `batch_expiration_block_num`. The batch note tree root is not wired up yet, so it remains empty.
 #[test]
-fn batch_kernel_emits_input_notes_commitment() -> anyhow::Result<()> {
+fn batch_kernel_emits_input_notes_commitment_and_expiration() -> anyhow::Result<()> {
     let mut setup = setup_chain();
     let batch = two_tx_batch(&mut setup)?;
     let expected_input_notes_commitment = expected_input_notes_commitment(&batch);
+    // The expected expiration is the minimum over the batch's transactions, which the proposed
+    // batch derives independently of the kernel.
+    let expected_expiration = batch.batch_expiration_block_num();
 
     let executed = BatchExecutor::new().execute(batch).context("batch execution failed")?;
     let output = executed.batch_outputs();
 
     assert_eq!(output.input_notes_commitment(), expected_input_notes_commitment);
     assert_eq!(output.batch_note_tree_root(), Word::empty());
-    assert_eq!(output.batch_expiration_block_num(), BlockNumber::from(0u32));
+    assert_eq!(output.batch_expiration_block_num(), expected_expiration);
+    // Sanity check: the min of the two transactions' expirations (1234 and 800).
+    assert_eq!(output.batch_expiration_block_num(), BlockNumber::from(800u32));
 
     Ok(())
 }

crates/miden-tx-batch-prover/src/batch_executor.rs

@@ -51,11 +51,21 @@ impl BatchExecutor {
             .map_err(ProvenBatchError::BatchKernelExecutionFailed)?;
 
         // Parse and validate the output stack shape (padding cells are zero and the expiration
-        // fits in u32); the actual output values themselves are not checked until the kernel
-        // verifies them.
+        // fits in u32).
         let batch_outputs = BatchOutputs::parse(trace_inputs.stack_outputs())
             .map_err(ProvenBatchError::BatchKernelOutputInvalid)?;
 
+        // Cross-check the kernel's running-min expiration against the value the proposed batch
+        // independently derived from its transactions.
+        let expected_expiration = proposed_batch.batch_expiration_block_num();
+        let actual_expiration = batch_outputs.batch_expiration_block_num();
+        if actual_expiration != expected_expiration {
+            return Err(ProvenBatchError::BatchExpirationMismatch {
+                actual: actual_expiration,
+                expected: expected_expiration,
+            });
+        }
+
         Ok(ExecutedBatch::new(proposed_batch, trace_inputs, batch_outputs))
     }
 }