OpenVM aggregates proofs recursively: each aggregation circuit checks that its child proofs are accepted by the SWIRL verifier. We prove that every satisfying aggregation witness yields child proofs the verifier accepts, so soundness carries through every layer.
We start from the canonical app and aggregation key constraints and prove that a satisfying verifier sub-circuit witness yields child proofs accepted by the reference verifier. Layer-specific aggregation constraints ensure that the child proofs’ public values describe the same VM execution and child-key commitments as the parent’s.
