refactor(token): scope witness names to the module

Compact merges witnesses by name across imported modules. A contract
composing this module with any other that also declares wit_SecretKey
gets one witness serving both, so a single implementation would answer
for two unrelated secrets and the composer has no way to keep them
apart. The clash is silent: it type-checks and compiles.

Prefixing each name with the module removes the collision by
construction. Witness names are compile-time identifiers, so the
measured rows are unchanged.

The wit_Path error string reaches assertions in the functional suite and
is borrowed as a fixture by the shared rejection test-util, so both move
with it.

Refs: #743 (comment)

Author: 0xisk

contracts/src/token/ConfidentialNoteFungibleToken.compact

@@ -63,12 +63,13 @@ pragma language_version >= 0.23.0;
  *   knows a nonce derives the same nullifier and can race the owner for the
  *   single spend. This is also what lets a composer offer escrow-free
  *   clawback: two spends race for one `nf`, first to land wins.
- * - Freshness: `wit_NonceRandomness` MUST return a fresh secret seed per call.
- *   Outputs also bind their context (the spent `nf`, or the recipient for
+ * - Freshness: `wit_ConfidentialNoteNonceRandomness` MUST return a fresh
+ *   secret seed per call. Outputs bind their context (the spent `nf`, or the
+ *   recipient for
  *   `_mint`), and `_mintNote` rejects an already-issued nonce, so a repeated
  *   seed fails loudly instead of producing a dead note.
- * - Ownership: a spend proves `cm` binds `Hf(wit_SecretKey())`; no secret, no
- *   spend.
+ * - Ownership: a spend proves `cm` binds `Hf(wit_ConfidentialNoteSK())`; no
+ *   secret, no spend.
  * - No authorization on `_` circuits: `_mint`, `_mintNote`, `_transfer`,
  *   `_burn`, `_consumeNote` are ungated. Re-exporting one from a deployed
  *   contract is a permissionless mint or spend. The composer gates them.
@@ -88,16 +89,17 @@ pragma language_version >= 0.23.0;
  *
  * @notice Scope:
  * Note machinery only: no roles, no initialization. `transfer` and `burn` are
- * self-gated by `wit_SecretKey` and the caller's randomness witness. Created
- * notes return to the caller as a private result and reach recipients out of
- * band.
+ * self-gated by `wit_ConfidentialNoteSK` and the caller's randomness witness.
+ * Created notes return to the caller as a private result and reach recipients
+ * out of band.
  *
  * @notice Client-side duties:
  * - Identity: `pk = Hf(sk)` is this token's address, unrelated to the Zswap
  *   coin key. Derive `sk` from the wallet seed under a module-specific domain
  *   so one seed backup covers it, and share `pk` out of band.
- * - Implement the four witnesses: `wit_SecretKey`, `wit_InputNote`,
- *   `wit_Path`, `wit_NonceRandomness`.
+ * - Implement the four witnesses: `wit_ConfidentialNoteSK`,
+ *   `wit_ConfidentialNoteInputNote`, `wit_ConfidentialNotePath`,
+ *   `wit_ConfidentialNoteNonceRandomness`.
  * - Keep every note and its leaf position. There is no memo and no viewing
  *   key, so a chain rescan finds nothing: the seed restores identity, not
  *   balance. Notes need their own backup.
@@ -210,37 +212,37 @@ module ConfidentialNoteFungibleToken<#depth> {
   export ledger _issuedNonces: Set<Bytes<32>>;
 
   /**
-   * @witness wit_SecretKey
+   * @witness wit_ConfidentialNoteSK
    * @description Returns the caller's spend secret, from which the circuits
    * derive the identity `pk = Hf(sk)` that owns notes.
    *
    * @returns {Bytes<32>} secretKey - A 32-byte cryptographically secure random
    * value.
    */
-  witness wit_SecretKey(): Bytes<32>;
+  witness wit_ConfidentialNoteSK(): Bytes<32>;
 
   /**
-   * @witness wit_InputNote
+   * @witness wit_ConfidentialNoteInputNote
    * @description Returns the note the next spend consumes. The wallet chooses
    * it; the circuit proves it exists and is unspent.
    *
    * @returns {Note} inputNote - The note to consume.
    */
-  witness wit_InputNote(): Note;
+  witness wit_ConfidentialNoteInputNote(): Note;
 
   /**
-   * @witness wit_Path
+   * @witness wit_ConfidentialNotePath
    * @description Returns the Merkle path proving `cm` is a leaf of the
    * commitment tree. The path stays witness, so only membership is proved.
    *
    * @param {Bytes<32>} cm - The input note's commitment.
    * @returns {MerkleTreePath<depth, Bytes<32>>} path - The `depth`-entry path
    * from `cm` to a root the tree recognizes, current or historical.
    */
-  witness wit_Path(cm: Bytes<32>): MerkleTreePath<depth, Bytes<32>>;
+  witness wit_ConfidentialNotePath(cm: Bytes<32>): MerkleTreePath<depth, Bytes<32>>;
 
   /**
-   * @witness wit_NonceRandomness
+   * @witness wit_ConfidentialNoteNonceRandomness
    * @description Returns the seed the core derives its default output nonces
    * from.
    *
@@ -251,7 +253,7 @@ module ConfidentialNoteFungibleToken<#depth> {
    * @returns {Bytes<32>} seed - A 32-byte cryptographically secure random
    * value.
    */
-  witness wit_NonceRandomness(): Bytes<32>;
+  witness wit_ConfidentialNoteNonceRandomness(): Bytes<32>;
 
   /**
    * @description Mints a note of `value` to `recipientPk` with a core-derived
@@ -299,7 +301,7 @@ module ConfidentialNoteFungibleToken<#depth> {
    */
   circuit freshNonce(slot: Bytes<32>, binder: Field): Field {
     return degradeToTransient(persistentHash<NoncePreimage>(NoncePreimage {
-      seed: wit_NonceRandomness(),
+      seed: wit_ConfidentialNoteNonceRandomness(),
       domain: pad(32, "OZ:note:nonce:core"),
       slot: slot,
       binder: binder
@@ -425,13 +427,14 @@ module ConfidentialNoteFungibleToken<#depth> {
   }
 
   /**
-   * @description The caller's spend identity, `Hf(wit_SecretKey())`. Exposed
-   * so a composer authorizes spends the way the core does.
+   * @description The caller's spend identity,
+   * `Hf(wit_ConfidentialNoteSK())`. Exposed so a composer authorizes spends
+   * the way the core does.
    *
    * @return {Field} - The caller's spend identity.
    */
   export circuit _spenderPk(): Field {
-    return derivePk(wit_SecretKey());
+    return derivePk(wit_ConfidentialNoteSK());
   }
 
   /**
@@ -456,7 +459,7 @@ module ConfidentialNoteFungibleToken<#depth> {
    * @return {Note} - The note the next spend will consume.
    */
   export circuit _inputNote(): Note {
-    return wit_InputNote();
+    return wit_ConfidentialNoteInputNote();
   }
 
   /**
@@ -509,12 +512,12 @@ module ConfidentialNoteFungibleToken<#depth> {
    * @return {Note} - The consumed note, for the caller's value accounting.
    */
   export circuit _consumeNote(ownerPk: Field): Note {
-    const input = wit_InputNote();
+    const input = wit_ConfidentialNoteInputNote();
 
     // The root is public, but the path stays witness, so disclosing the root
     // does not say which leaf was consumed.
     const cm = commitOf(input, ownerPk);
-    const path = wit_Path(cm);
+    const path = wit_ConfidentialNotePath(cm);
     const root = disclose(merkleTreePathRoot<depth, Bytes<32>>(path));
     assert(_commitments.checkRoot(root),
            "ConfidentialNoteFungibleToken: input root not recognized");
@@ -561,7 +564,8 @@ module ConfidentialNoteFungibleToken<#depth> {
    * Requirements:
    *
    * - The input note is committed in the tree and unspent.
-   * - The caller owns the input note (its commitment binds `Hf(wit_SecretKey())`).
+   * - The caller owns the input note (its commitment binds
+   *   `Hf(wit_ConfidentialNoteSK())`).
    * - `value <= input.value`.
    *
    * @param {Field} recipientPk - The identity receiving the output note.

contracts/src/token/test/ConfidentialNoteFungibleToken.test.ts

@@ -373,7 +373,7 @@ describe('ConfidentialNoteFungibleToken: burn', () => {
 
     await expectRejection(
       token.burn(30n),
-      'wit_Path: commitment not found in tree',
+      'wit_ConfidentialNotePath: commitment not found in tree',
     );
   });
 });
@@ -530,14 +530,14 @@ describe('ConfidentialNoteFungibleToken: _consumeNote', () => {
 
     await expectRejection(
       token._consumeNote(ALICE),
-      'wit_Path: commitment not found in tree',
+      'wit_ConfidentialNotePath: commitment not found in tree',
     );
   });
 
   it('should not consume a note under an owner pk it was not committed to', async () => {
     await expectRejection(
       token._consumeNote(BOB),
-      'wit_Path: commitment not found in tree',
+      'wit_ConfidentialNotePath: commitment not found in tree',
     );
   });
 
@@ -725,7 +725,7 @@ describe('ConfidentialNoteFungibleToken: transfer', () => {
 
     await expectRejection(
       token.transfer(BOB, 30n),
-      'wit_Path: commitment not found in tree',
+      'wit_ConfidentialNotePath: commitment not found in tree',
     );
   });
 
@@ -736,7 +736,7 @@ describe('ConfidentialNoteFungibleToken: transfer', () => {
 
     await expectRejection(
       token.transfer(CAROL, 30n),
-      'wit_Path: commitment not found in tree',
+      'wit_ConfidentialNotePath: commitment not found in tree',
     );
     expect(await isSpent(input)).toBe(false);
   });

contracts/src/token/test/simulators/ConfidentialNoteFungibleTokenSimulator.ts

@@ -88,7 +88,7 @@ export class ConfidentialNoteFungibleTokenSimulator extends ConfidentialNoteFung
     return this.circuits.impure.burn(value);
   }
 
-  /** The caller's spend identity, `Hf(wit_SecretKey())`. */
+  /** The caller's spend identity, `Hf(wit_ConfidentialNoteSK())`. */
   public _spenderPk(): Promise<bigint> {
     return this.circuits.impure._spenderPk();
   }

contracts/src/token/test/witnesses/ConfidentialNoteFungibleTokenWitnesses.ts

@@ -51,40 +51,42 @@ export const ConfidentialNoteFungibleTokenPrivateState = {
 };
 
 export interface IConfidentialNoteFungibleTokenWitnesses<P> {
-  wit_SecretKey(context: WitnessContext<Ledger, P>): [P, Uint8Array];
-  wit_InputNote(context: WitnessContext<Ledger, P>): [P, Note];
-  wit_Path(
+  wit_ConfidentialNoteSK(context: WitnessContext<Ledger, P>): [P, Uint8Array];
+  wit_ConfidentialNoteInputNote(context: WitnessContext<Ledger, P>): [P, Note];
+  wit_ConfidentialNotePath(
     context: WitnessContext<Ledger, P>,
     cm: Uint8Array,
   ): [P, MerkleTreePath<Uint8Array>];
-  wit_NonceRandomness(context: WitnessContext<Ledger, P>): [P, Uint8Array];
+  wit_ConfidentialNoteNonceRandomness(
+    context: WitnessContext<Ledger, P>,
+  ): [P, Uint8Array];
 }
 
 export const ConfidentialNoteFungibleTokenWitnesses = (
   wallet: NoteWallet,
 ): IConfidentialNoteFungibleTokenWitnesses<ConfidentialNoteFungibleTokenPrivateState> => ({
-  wit_SecretKey(context) {
+  wit_ConfidentialNoteSK(context) {
     return [context.privateState, wallet.secretKey];
   },
-  wit_InputNote(context) {
+  wit_ConfidentialNoteInputNote(context) {
     return [context.privateState, wallet.inputNote];
   },
   // The circuit passes the input commitment; the wallet answers with its
   // Merkle path, read here from the live commitment tree.
-  wit_Path(context, cm) {
+  wit_ConfidentialNotePath(context, cm) {
     const planted = wallet.pathOverride;
     if (planted !== undefined) {
       return [context.privateState, planted];
     }
     const path = context.ledger.Core__commitments.findPathForLeaf(cm);
     if (path === undefined) {
-      throw new Error('wit_Path: commitment not found in tree');
+      throw new Error('wit_ConfidentialNotePath: commitment not found in tree');
     }
     return [context.privateState, path];
   },
   // Fresh and secret per call, as the module requires; a fixed seed is only
   // honored when a spec explicitly plants one.
-  wit_NonceRandomness(context) {
+  wit_ConfidentialNoteNonceRandomness(context) {
     return [
       context.privateState,
       wallet.nonceSeed ?? new Uint8Array(getRandomValues(Buffer.alloc(32))),

contracts/test-utils/assertions/test/rejection.test.ts

@@ -5,7 +5,7 @@ import {
   rejectionIncludes,
 } from '../rejection.js';
 
-const WITNESS_REASON = 'wit_Path: commitment not found in tree';
+const WITNESS_REASON = 'wit_ConfidentialNotePath: commitment not found in tree';
 
 /** The shape the live backend produces: the reason two `cause` levels down. */
 const liveWrapped = () => {