orchard 0.15.4 release: Accelerate batched trial decryption with GLV endomorphism windows

[nuttycom]

Supersedes #530: rebased onto main (0.15.3) and reworked to consume the GLV primitive from zcash/pasta_curves#93 (pasta_curves::glv) instead of a self-contained inline endo module. Same feature and the same byte-exact results — cleaner layering, with GLV living in pasta_curves and orchard as a thin consumer.

What changes

The GLV primitive — batched odd-multiples windows built with a single shared inversion, per-scalar decomposition + wNAF recoding, and the shared-doubling Straus ladder — now lives in pasta_curves::glv (Table / Decomposed / Table::mul_decomposed). orchard consumes it in the batched pipeline:

• PreparedEphemeralPublicKey::batch_tabled builds every ephemeral key's window via Table::batch (one shared normalization across the whole batch).
• batch_ka_agree_dec decomposes each viewing key once via Decomposed::new and reuses it against every ephemeral key's window, through the BatchDomain::batch_ka_agree_dec hook added in zcash_note_encryption 0.4.2.

The per-output entry points (try_note_decryption etc.) are untouched. There are no public API changes; src/endo.rs is removed (its GLV moved to pasta_curves).

Correctness

Shared secrets are byte-identical to the per-item path. note_encryption's batched_agreement_matches_per_item and batched_compact_decryption_matches_per_item_{orchard,ironwood} pin this for both OrchardDomain and IronwoodDomain over hit / miss / undecodable lanes; the full existing suite passes. The GLV KATs and proptests now live in pasta_curves::glv.

Stack

• pasta_curves 0.5.2 (the glv module)
• zcash_note_encryption 0.4.2 — batch_ka_agree_dec

Original work by @LukasKorba (#530).

---

Filed with Claude Code assistance.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 93.33333% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.92%. Comparing base (7e90bf2) to head (c28e811).
⚠️ Report is 154 commits behind head on main.

Files with missing lines	Patch %	Lines
src/keys.rs	90.47%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #539      +/-   ##
==========================================
+ Coverage   77.74%   82.92%   +5.18%     
==========================================
  Files          39       24      -15     
  Lines        3509     3046     -463     
==========================================
- Hits         2728     2526     -202     
+ Misses        781      520     -261     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ebfull]

Details of the underlying mechanism and pasta_curves APIs don't really need to be exposed in the documentation, but I don't see anything wrong here!

[ebfull]

Could crosslink to the module here (and in some other places) instead of just mentioning it, especially to avoid bitrot. Alternatively, don't even discuss GLV in user-facing docs.

[ebfull]

Perhaps another opportunity to crosslink, which helps prevent bitrot.

[ebfull]

This PR title ideally wouldn't contain the version number of Orchard that we might speculate it would be merged into. Nevermind, we're releasing from this branch.