feat(attest-zk-groth16): contains_no_pii Groth16 attestation e2e (VOKF-7 / M1) - #5
Merged
Conversation
…F-7 / M1) Wires a real Groth16 proof into the §10 attestation path, exercising the verified and attestation_failed branches (not just unsupported_scheme). - circuits/contains_no_pii/: a minimal Circom 2 demo circuit proving a private field is 0 (PII absent), plus gen.sh and the committed verification key + a sample proof (heavy ptau/zkey/wasm gitignored). - @verifiable-okf/attest-zk-groth16: an AttestationVerifier for the zk-groth16 scheme — decodes the base64 proof and runs snarkjs.groth16.verify offline (verification key only; no proving key, no circom, no network). Bundles the contains_no_pii vkey. - fixtures/signed/with-zk-attestation.md (valid proof → verified) and with-bad-zk-attestation.md (validly signed, wrong public signal → attestation_failed). Tests (5): real proof → verified via the verifier policy; validly-signed but failing proof → attestation_failed; carrier-only (not required) → verified; verifier fn valid→true / unknown-circuit→false / wrong-signal →false. Clean build orders all 5 packages; dist bundles the vkey. Full suite green (canon 28 + signer 7 + verifier 22 + visualizer 5 + attest 5 = 67). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
M1 —
@verifiable-okf/attest-zk-groth16(VOKF-7)Wires a real Groth16 proof into the §10 attestation path, exercising both the
verifiedandattestation_failedbranches (M0 only hadunsupported_scheme).Implements
circuits/contains_no_pii/— minimal Circom 2 demo: a private field must equal 0 (PII absent).gen.shregenerates artifacts; the verification key + a sample proof are committed, heavyptau/zkey/wasmare gitignored.@verifiable-okf/attest-zk-groth16— anAttestationVerifierforzk-groth16: base64-decode the proof, runsnarkjs.groth16.verifyoffline (verification key only — no proving key, no circom, no network). Bundles thecontains_no_piivkey.signed/with-zk-attestation.md(valid proof → verified),signed/with-bad-zk-attestation.md(validly signed but wrong public signal → attestation_failed).DoD（VOKF-7）
verified）attestation_failed（正当署名・ZK失敗）＋verified（成功）＋ carrier-only（非必須→通す）境界（既出の確認）
これは OSS の検証エンジンのみ。proof の発行・メータリング・課金は Trust402 側（このrepoには持ち込まない）。
M1 残り
VOKF-9（実 OKF バンドルの worked example）。これでM1の主要2本（visualizer＋attestation e2e）が揃います。
🤖 Generated with Claude Code