feat(contract): secure execution and zk replay protections - #1124

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; & $git --version; & $git status --short --branch; & $git remote -v; & $git branch --show-current

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; $gh = Get-Command gh -ErrorAction SilentlyContinue; if ($gh) { Write-Output 'GH_FOUND'; & $gh --version; & $gh auth status; } else { Write-Output 'GH_MISSING'; }; & $git status --short --branch; & $git --no-pager diff --stat

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; & $git rev-parse --show-toplevel; & $git status --short --branch; $gh = Get-Command gh -ErrorAction SilentlyContinue; if ($gh) { Write-Output 'GH_FOUND'; & $gh --version; & $gh auth status; } else { Write-Output 'GH_MISSING'; }

Ran terminal command: $paths = @(
'C:\Program Files\GitHub CLI\gh.exe',
'C:\Program Files (x86)\GitHub CLI\gh.exe',
'C:\Program Files\GitHub CLI\bin\gh.exe',
'C:\Users\QwinDivy\AppData\Local\Microsoft\WinGet\Links\gh.exe',
'C:\Users\QwinDivy\scoop\apps\gh\current\gh.exe'
)
foreach ($p in $paths) { if (Test-Path $p) { Write-Output "FOUND:$p"; & $p --version } }
Write-Output 'WHERE:'
where.exe gh 2>$null
Get-Command gh -All 2>$null | Select-Object -ExpandProperty Source

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; $gh = Get-Command gh -ErrorAction SilentlyContinue; if ($gh) { Write-Output 'GH_FOUND'; $gh.Source; & $gh --version; & $gh auth status } else { Write-Output 'GH_MISSING' }; & $git status --short --branch

I’ve confirmed the repo and remote are valid; I’m creating the combined issue branch and staging the completed contract changes, then I’ll push and open the PR through the available GitHub path.

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; & $git checkout -b fix/completed-issue-security-hardening; & $git status --short --branch

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; & $git checkout -b fix/completed-issue-security-hardening; & $git status --short --branch; & $git add .; & $git commit -m "feat(contract): secure execution and zk replay protections"

Ran terminal command: $git = 'C:\Program Files\Git\bin\git.exe'; & $git push -u origin fix/completed-issue-security-hardening

Opened Browser

Branch, commit, and push

This is complete and verified from the terminal:

• Branch created: fix/completed-issue-security-hardening
• Commit created: 47aa811 — feat(contract): secure execution and zk replay protections
• Branch pushed to origin successfully:
  • output included: “new branch … -> fix/completed-issue-security-hardening”

Pull request status

I could not create the GitHub PR from this environment because GitHub is currently prompting for sign-in in the browser, and no authenticated GitHub CLI session is available.

The PR page opened at the GitHub sign-in screen, which is the blocker.

Suggested PR title

fix(contract): secure optimistic execution and ZK proof replay protections

Suggested PR description

Summary

This PR hardens the contract against replay and optimistic-execution abuse by enforcing execution windows and binding ZK public inputs to the task context.

Changes

• Added challenge-window enforcement for optimistic execution claims so claims remain pending until the dispute window expires.
• Enforced replay protection on execution nonces so stale or replayed execution proofs are rejected.
• Bound ZK public inputs to the task id, caller, and execution payload to prevent cross-task or cross-caller replay.
• Rejected invalid proof commitments before verification is accepted.

Resolved issues

• Closes 🦀 [CONTRACT] Optimistic Execution Challenge Window & State Transition Fraud Proofs #1044
• Closes 🦀 [CONTRACT] Bind Public Inputs to Task Identity in Zero-Knowledge Verifier #1046
• Close 🦀 [CONTRACT] Task Execution Nonce & Monotonic Cryptographic Replay Prevention #1033
• Close 🦀 [CONTRACT] Refactor Monolithic lib.rs (10k+ LOC) into Modular Domain Subsystems #1030

Notes

• The branch is already pushed and ready for PR creation once GitHub auth is available in this session.
• The exact branch is: fix/completed-issue-security-hardening

If you sign in to GitHub in the browser and open the PR page, this text is ready to paste in.

Summary

Related Issue

Type of Change

• Feature
• Bug fix
• Refactor
• Documentation

Changes Made

Validation

• cargo fmt --all (if contract changed)
• npm run lint in frontend (if frontend changed)
• Manual verification completed

Screenshots (if UI changes)

Checklist

• Scope is focused and avoids unrelated changes
• Commit messages are clear
• Documentation updated when needed
• ETA was provided when requesting assignment for the linked issue