Glossary

Each entry gives a one-line reminder and links to the chapter that teaches the term.

Accumulation proof: the prover's message that lets a verifier check one accumulation step. See Split Accumulation.
Accumulator: a running object that carries deferred checks from one recursive step to the next. See Accumulation.
Action set indicator: a value used to find out which actions a stamp covers. See Aggregation and Bundles.
Anchor: a hash-chain value that commits to the Tachyon pool state. See Pool State and Anchors.
Anomalous curve: a curve whose number of points equals its field size, which cycles have to avoid. See Curve Cycles.
Atomic accumulation: accumulation in which the accumulator alone is enough to verify each step. See Accumulation.
Autonome, aggregate, adjunct: the three states of a Tachyon bundle: complete proof, merged proof, and stripped input to a merged proof. See Aggregation and Bundles.
Base case: the start of a recursive chain, where no earlier proof exists. See Recursive Proofs.
Batched opening: a reduction of many polynomial evaluation claims to one. See Batched Openings.
Binding: the property that a prover cannot open one commitment to two different values. See Polynomial Commitments.
Binding signature: the signature that enforces a bundle's value balance through homomorphic value commitments. See The Proof Tree.
Bonding polynomial: the wiring polynomial of a circuit with constraints only, satisfying $s (X, 0) = 0$ . See Wiring and the Registry.
Bucket: a group of an epoch's tachygrams that share a quadratic-residue profile. See Oblivious Sync.
Compression: replacing a large proof's polynomials with commitments and openings. See Recursion in Ragu.
Consensus window: the two epochs that validators check for duplicate tachygrams. See Pool State and Anchors.
Cross term (IPA): the off-diagonal points $L$ and $R$ sent in each halving round. See The Inner Product Argument.
Curve cycle (2-cycle): two curves in which each curve's order equals the other's field size. See Curve Cycles.
Decider: the party or step that runs a deferred check. See Accumulation.
Deferred operation: work that one circuit hands to the circuit on the other curve. See Curve Cycles.
Endomorphism: a map from a curve to itself that respects addition, and acts on $j = 0$ curves as multiplication by an eigenvalue. See Endoscalars.
Endoscalar: a short challenge that the curve's endomorphism makes cheap to apply. See Endoscalars.
Epoch nullifier: the value a note publishes for a given epoch. See Notes, Nullifiers, and Tachygrams.
Error matrix: the matrix of all revdot products between claim vectors, whose diagonal holds the claimed values. See Revdot Folding.
Evidence tree: a tree that retains one proof for all of an epoch's buckets. See Oblivious Sync.
Exclusion proof: a proof that a nullifier is absent from closed epochs. See Scaling Zcash.
Faerie gold: an attack in which a sender makes two notes that cannot both be spent. See Notes, Nullifiers, and Tachygrams.
Fiat–Shamir transform: replacing a verifier's random challenges with a hash of the transcript. See Statements and Challenges.
Folding: halving a claim with a random challenge. See The Inner Product Argument.
Folding scheme: a reduction of several instances of a relation to one, with no verifier run inside. See Split Accumulation.
Fuse: Ragu's operation that produces a node's proof from its children. See An Introduction to Proof-Carrying Data.
Gate: one multiplication check $a_{i} b_{i} = c_{i}$ on the witness. See Arithmetization.
Grinding: retrying offline until a hash-derived challenge favors the prover. See Statements and Challenges.
Header: a node's public claim in proof-carrying data. See An Introduction to Proof-Carrying Data.
Hiding: the property that a commitment reveals nothing about the committed value. See Polynomial Commitments.
Hoisting: sharing products between gadget steps to save gates. See Endoscalars.
Incrementally verifiable computation (IVC): a proof that covers a whole chain of steps. See Recursive Proofs.
Indexed factor: the cubic encoding of a pair of epoch and nullifier, used to build multisets. See Oblivious Sync.
Inner product argument (IPA): a short proof of a claim about the inner product of committed vectors. See The Inner Product Argument.
Instance: the public part of a statement. See Statements and Challenges.
Master key: a per-note key derived with Poseidon, from which the note's nullifiers come. See Notes, Nullifiers, and Tachygrams.
Max fee note, fee change note: the values that let a bundle's fee be chosen after signing. See Aggregation and Bundles.
Multi-scalar multiplication (MSM): a sum of many scalar multiples of points, which dominates IPA verification. See The Inner Product Argument.
NARK: a non-interactive proof with a constant-size instance and a linear-size witness. See The Complete Proof.
Nested commitment: a commitment to the coordinates of points from the other curve. See Curve Cycles.
Non-native arithmetic: emulating one field's arithmetic inside a circuit over another field. See Curve Cycles.
Nullifier: a value published on spend to stop double spends. See Scaling Zcash.
Payment key: a hash of the keys $ak$ and $nk$ that a note commits to. See Notes, Nullifiers, and Tachygrams.
Pedersen vector commitment: the point $⟨ a, G ⟩$ , optionally with a blinding term. See Polynomial Commitments.
Polynomial commitment scheme (PCS): a commitment to a polynomial, together with a way to prove its evaluations. See Polynomial Commitments.
Polynomial IOP: a protocol in which the verifier may query polynomial oracles. See QAP and Polynomial Encoding.
Post-processing: Halo's technique for supporting many circuits without verification keys. See Wiring and the Registry.
Proof-carrying data (PCD): a computation structured as a tree of steps, where each step's data carries a proof of all the work behind it. See An Introduction to Proof-Carrying Data.
QAP (quadratic arithmetic program): a polynomial form of R1CS in which the constraints hold when one polynomial divides another. See QAP and Polynomial Encoding.
Quotient fold: Ragu's fuse-time reduction of revdot claims using Lagrange weights and a quotient. See Revdot Folding.
Quotient polynomial: $(p (X) - y) / (X - x)$ , which exists exactly when $p (x) = y$ . See Batched Openings.
R1CS (rank-1 constraint system): constraints of the form $A w \circ B w = C w$ . See Arithmetization.
Random linear combination: merging several claims with random weights. See Statements and Challenges.
Random oracle: an idealized hash function whose outputs behave as independent random values. See Statements and Challenges.
Registry polynomial: a polynomial that interpolates many circuits' wiring over a domain. See Wiring and the Registry.
Revdot claim: an instance $(\overset{ˉ}{A}, \overset{ˉ}{B}, c)$ with witness vectors whose revdot product is $c$ . See Revdot Folding.
Revdot product: the inner product of one vector with the reversal of another, written $⟨ ⟨ a, b ⟩ ⟩$ . See Arithmetization.
Schwartz–Zippel lemma: a nonzero low-degree polynomial is zero at a random point with probability at most $d /∣ F ∣$ . See Statements and Challenges.
Soundness: the property that false statements rarely pass verification. See Statements and Challenges.
Spendable: a proof that certifies a note's position in the pool's history. See The Proof Tree.
Split accumulation: accumulation in which the verifier handles only public instances, while the prover keeps a separate witness. See Split Accumulation.
Stage mask: a gate-free revdot claim that a stage polynomial's forbidden wires are zero. See Staging.
Stage polynomial: a separately committed part of a circuit's trace. See Staging.
Stamp: the proof-bearing part of a Tachyon bundle, containing tachygrams, an anchor, and a proof. See An Introduction to Proof-Carrying Data.
Step: the rule relating a node's input headers to its output header. See An Introduction to Proof-Carrying Data.
Structured vector: a vector arranged so that the revdot product pairs each gate's $a$ and $b$ wires. See Arithmetization.
Succinct verification: in-circuit verifier cost that grows more slowly than the circuit. See Recursive Proofs.
Sync service: an untrusted party that proves nullifier absence without learning which note it serves. See Oblivious Sync.
Tachygram: an opaque field element published for each action, either a note commitment or a nullifier. See Notes, Nullifiers, and Tachygrams.
Transcript bridging: using challenges from one curve's transcript in the circuits on both curves. See Endoscalars.
Trial decryption: a wallet's attempt to decrypt every output to find its own. See Scaling Zcash.
Unified instance: the shared public values of Ragu's internal circuits. See Recursion in Ragu.
Vanishing polynomial: the polynomial that is zero on every point of a domain. See QAP and Polynomial Encoding.
Verification key: circuit-specific data that many systems require and Ragu avoids. See Wiring and the Registry.
Witness: the secret values that satisfy a circuit, also called the trace. See Arithmetization.