Field note
Mangrove: Folding Many Private Actions Into One Public Settlement
One private action can touch several kinds. A PayMoney Solve involves the offer, the selected escrow asset, account authority, a fee output, and private attestation checks. An epoch contains many actions. The Ethereum contract should not verify every leaf separately.
Proof-carrying data, or PCD, makes proofs compositional. A node proves that its inputs were valid proof-carrying objects and that their public summaries combine according to a rule. Repeating that operation forms a tree whose root certifies the whole batch.
The binary-tree shape
The target uses a Mangrove-style binary PCD construction. Leaves contain account-validation and kind-execution proofs. Internal nodes recursively combine two children. A root summarizes the complete action; action roots then fold toward the epoch proof.
Binary composition gives a fixed local interface even when the batch contains many leaves. Parallel workers can build independent subtrees, and the final verifier receives one root proof rather than an unbounded list.
Composition needs a shared statement
Recursion is unsound if two individually valid proofs refer to different actions or vault states. Every leaf therefore binds to a shared action_digest, shared transcript, and archive root. The archive root is absorbed first for freshness. The completeness commitment connects the universal resource partition to each kind's execution and each account's validation.
That binding is the difference between “these proofs are valid” and “these proofs jointly certify this one transition.”
Identity padding and function privacy
A binary tree wants a power-of-two number of leaves. Missing leaves are filled with an Identity kind—the monoidal unit whose net contribution is zero. This changes the tree's shape without changing its meaning.
The target goes further and pads every logic leaf to the global maximum trace shape. Otherwise the size of a leaf could reveal which kind ran. For PayMoney, that means Solve, Cancel, and Expire keep the same public trace dimensions even though only Solve uses real bank evidence and ECDSA.
The privacy cost is deliberately severe. FiatOfferV1 contains an expensive foreign-field signature verifier, and unrelated co-tenants inherit that padded budget. Splitting the verifier into another kind would not reduce the global maximum, so the Architecture of Record keeps it inline and accepts the shared cost.
Mangrove is thus the composition layer, not the application rulebook. It lets many independently checked resource meanings collapse into one public settlement statement while preserving the bindings that prevent substitution between them.
Read the completeness bus → · Inspect the public L1 boundary →