fix: partial_sha256_var_end constrained/unconstrained divergence on non-block-aligned messages

[asterite]

Summary

Fixes the partial-hash soundness/correctness bug reported in noir-lang/noir-library-claude#16, and closes two further defects in the same API surface that were uncovered while writing tests for it.

partial_sha256_var_end (and, by delegation, partial_sha224_var_end) computes SHA-256 differently in the constrained (proving) path than in the unconstrained (witness-gen) oracle whenever a message is not a whole number of 64-byte blocks. This PR makes the two runtimes agree, hardens the input contract, and adds broad dual-mode test coverage that the previous 192-byte-only tests were missing.

The bugs fixed

1. Constrained path dropped the trailing bytes (issue #16)

The constrained branch called process_full_blocks(msg, message_size, h) with the block-aligned message_size, so the trailing real_message_size % 64 bytes were never absorbed — the final block was empty and those bytes were left as free, unconstrained witness. Result: constrained ≠ unconstrained ≠ sha256_var, and a prover could set the dropped bytes to anything while satisfying the circuit (preimage-binding break).

Fix: process the full final chunk — the block-aligned prefix plus the trailing partial block — so the tail is bound, and finalize with the real length.

2. Unconstrained oracle read the tail at the wrong offset

The unconstrained helper finalize_last_sha256_block located the trailing block using the global offset (real_message_size / 64) * 64. For a composed hash (one or more interstitial calls followed by end) of a non-block-aligned message, the final chunk is re-based to offset 0, so the global offset points past it — the oracle read out of bounds. Witness generation would crash or diverge (a liveness failure) for a legitimate multi-chunk hash.

Fix: pass the chunk's local block-aligned offset (message_size) separately from the length (real_message_size), so the tail is read from the correct place in the re-based chunk.

3. No bounds check against the array capacity

Neither partial_sha256_var_end nor partial_sha256_var_interstitial validated their size arguments against the message array capacity N (unlike sha256_var, which asserts message_size <= N). When the accessed region exceeded N, the constrained end path silently hashed the missing bytes as zeros while the unconstrained and interstitial paths read out of bounds — another constrained/unconstrained divergence, this time on malformed input.

Fix: assert that the locally-accessed region fits within N — message_size + real_message_size % BLOCK_SIZE <= N for end, and message_size <= N for interstitial. Note real_message_size itself may legitimately exceed N (it counts bytes absorbed by earlier interstitial calls that are not present in this chunk), so only the locally-read region is bounded.

Also added assert(real_message_size >= message_size, ...) to end, the missing size relationship noted in the audit.

Why the old tests missed all this

Every fuzz_test_partial_hash* test used data: [u8; 192], and 192 % 64 == 0. With a block-aligned total the dropped block is legitimately empty and the tail offsets coincide, so none of the three defects could manifest.

Tests added

• Regression test for the exact feat: added partial hash computation #16 scenario (non-block-aligned standalone total).
• Dual-mode agreement tests (constrained vs unconstrained) and reference tests (vs sha256_var / sha224_var) for partial_sha256_var_end, across many non-block-aligned sizes, for both SHA-256 and SHA-224.
• Composed (interstitial + end) tests for non-block-aligned messages — a tail-only final chunk and a block-plus-tail final chunk — asserting constrained == unconstrained == reference.
• should_fail_with regression tests for out-of-capacity inputs (SHA-256 and SHA-224).
• An interstitial agreement test.

The full suite (67 tests) passes under both nargo test (ACIR / constrained) and nargo test --force-brillig (unconstrained), via ./scripts/run.sh.

Notes

• The unconstrained/constrained split in partial_sha256_var_end is preserved: witness generation keeps its cheaper path rather than going through the constrained lookup-table construction. The oracle bug was fixed in place.
• Also removes some unnecessary mut keywords.

Fixes noir-lang/noir-library-claude#16

[asterite]

This PR also fixes two adjacent partial-hash defects found while writing tests for #16, now tracked as separate findings in the audit repo:

• noir-lang/noir-library-claude#23 — unconstrained path reads the final block at a global offset (composed non-block-aligned hashes crash/diverge)
• noir-lang/noir-library-claude#24 — partial-hash API does not bound message size by array capacity N (constrained silently hashes missing bytes as zeros; unconstrained reads out of bounds)