Encode the witness with the rules that apply to the verification key, and test the bit that carries the sign. A witness that drops the sign bit verifies for some inputs and fails for others, which is the worst kind of defect to find in production.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.