EIP-7951: Precompile for secp256r1 Curve Support

[lorenzogentile404]

Note

Introduce P256_VERIFY (secp256r1) precompile end-to-end, with constants, phases, OOB opcode, ECData/OOB/Hub constraints, and scenario/plumbing; also refactor/adjust related selectors and ECRECOVER checks.

• Precompile support (Osaka/Global):
  • Add P256_VERIFY precompile: gas cost (GAS_CONST_P256_VERIFY), call/return sizes, phases (PHASE_P256_VERIFY_*), and OOB opcode (OOB_INST_P256_VERIFY).
• ECData (Osaka):
  • Extend columns with IS_P256_VERIFY_* and circuit selector CIRCUIT_SELECTOR_P256_VERIFY.
  • Implement P-256 verification constraints (range checks, R1 curve membership, result wiring) and utilities (R1 field params, membership helpers).
  • Update index/size/phase sums to include P256; allow transitions/ICPs with P256.
• Hub (Osaka):
  • Add scenario flag PRC_P256_VERIFY and integrate into NSR/flag sums, GAS/NSR, success/failure justifications, and MMU transfers.
  • New success path shared with ECRECOVER for full/partial return handling; extend common generalities and sanity checks to Osaka.
• OOB (Osaka):
  • Add IS_P256_VERIFY, CT_MAX_P256_VERIFY; integrate into weighted sums, phases, and ct-max.
  • Introduce unified fixed-size/cost handler for Cancun/Prague/Osaka precompiles (incl. P256); replace/remove older BLS fixed-size file; split shorthands into flag_sums, inst_sums, ctmax_sums, lookup_sums.
  • Heartbeat uses ct-max-sum (rename from maxct-sum).
• ECData (London/Osaka) tweaks:
  • Switch positivity checks in ECRECOVER to ISZERO and adjust success-bit logic.
  • Convert circuit selectors to defcomputedcolumn and tighten selector binarity property.
• Build/Constants:
  • Wire Osaka modules and constants; add P-256 sizes/constants to constants/constants.lisp.

^{Written by Cursor Bugbot for commit 3c4fc31. This will update automatically on new commits. Configure here.}

[cursor]

Bug: R1 membership incorrectly rejects point at infinity

The R1_membership calculation uses (* P_is_in_range (- 1 P_is_point_at_infinity) P_satisfies_cubic) which incorrectly rejects the point at infinity. This differs from C1_membership which correctly uses (* P_is_in_range (+ P_is_point_at_infinity P_satisfies_cubic)) to accept either the point at infinity or points satisfying the curve equation. The secp256r1 curve should accept the point at infinity as valid, so the formula needs (+ P_is_point_at_infinity P_satisfies_cubic) instead of (- 1 P_is_point_at_infinity) P_satisfies_cubic.