@finchip.ai/foga 0.0.0-stage → 0.6.0-alpha.4

package/prover/README.md

@@ -0,0 +1,26 @@
+# foga-prover
+
+The proving side of the two ERC-8419 ZK paths, kept as a sub-package so that the kernel's dependency tree stays
+free of the proving libraries. `npm run zk:install` installs them here (`npm --prefix prover ci`).
+
+`run.cjs` is a stdin/stdout bridge with one JSON job per process:
+
+- the credential pattern (`kya-public-v1`) over the upstream prover (`vendor/kya-standard/companions/zk-kya-groth16/prover.js`,
+  materialized by `foga vendor sync`, which also holds that circuit's wasm, proving key and verification key; nothing of
+  it is copied here): `root`, `commit`, `attest`, `prove`;
+- the predicate pattern (`kya-predicate-count-v1`, FOGA's own circuit in `../zk/circuits`) over the material built by
+  `build-predicate.mjs` into `../zk/build` (`npm run zk:predicate`; `FOGA_ZK_PREDICATE_DIR` overrides): `record.sign`,
+  `predicate.prove` (and `root` again, for the source set).
+
+The bridge separates the roles the protocol separates. Credential: the prover (a cell) computes `Poseidon(secret)` and
+hands the commitment to the attestor; the attestor signs the scheme-bound credential without seeing the secret; the
+prover alone turns the credential into a proof for the admitting registry's domain and the current epoch. Predicate: a
+source signs task-completion records about a subject; the prover shows that at least K of them are Accepted inside a
+window, with the records, their signatures and its own secret as private input and the rule's parameters as public
+input; the result is verified locally against the committed verification key before it leaves the bridge.
+
+`build-predicate.mjs` compiles the predicate circuit with the WASM build of circom and runs a deterministic
+**development** ceremony (public beacon, 2^17 powers of tau, Groth16 setup, phase-2 beacon); it exports the
+verification key (`../zk/build/verification_key.json`, committed) and the Solidity verifier
+(`../contracts/src/zk/Groth16PredicateVerifier.sol`, committed). Public randomness means a forgeable proving key: fit
+for the genesis and tests, to be replaced by a real multi-party ceremony before any other use. See `../docs/zk.md`.

package/prover/build-predicate.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// Builds FOGA's predicate-pattern circuit (zk/circuits/kya_predicate_count_v1.circom) and runs its DEVELOPMENT
+// trusted setup: compile with circom (the WASM build of the compiler shipped in this sub-package), a powers-of-tau
+// of 2^17 created here with a public, fixed beacon, phase 2 with the same beacon, the verification key and the
+// Solidity verifier. Everything is deterministic, so anyone can rebuild the same keys bit for bit — which is
+// exactly why this is a development ceremony and not a trusted one: the randomness is public, the proving key
+// is forgeable in principle, and it must be replaced by a real multi-party ceremony before any non-test use.
+//
+//   node prover/build-predicate.mjs            # full build into zk/build (10-20 minutes; the phase-2 preparation dominates)
+//   node prover/build-predicate.mjs --verifier # only re-export the verification key and the Solidity verifier from the final zkey
+//
+// Outputs (zk/build, gitignored except the small files):
+//   kya_predicate_count_v1.r1cs / .sym / _js/kya_predicate_count_v1.wasm
+//   pot17_final.ptau, kya_predicate_count_v1_0000.zkey, kya_predicate_count_v1_final.zkey
+//   verification_key.json                               (committed)
+//   ../../contracts/src/zk/Groth16PredicateVerifier.sol (committed; the generated verifier, contract renamed)
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const root = join(here, "..");
+const require = createRequire(import.meta.url);
+const circuit = join(root, "zk", "circuits", "kya_predicate_count_v1.circom");
+const build = join(root, "zk", "build");
+const name = "kya_predicate_count_v1";
+const POWER = 17;
+// keccak256("foga.kya-predicate-count-v1.development-ceremony"), fixed and public on purpose
+const BEACON = "7c1f6c2e0f4a4f0a9d6a2b8e1c5d3f7a9b0c2d4e6f8a1b3c5d7e9f0a2b4c6d8e";
+const ITERATIONS = 10;
+
+function sh(cmd, args, opts = {}) {
+  console.log(`+ ${cmd} ${args.join(" ")}`);
+  execFileSync(cmd, args, { stdio: "inherit", ...opts });
+}
+
+const snarkjs = join(here, "node_modules", ".bin", "snarkjs");
+const circom = join(here, "node_modules", ".bin", "circom2");
+const onlyVerifier = process.argv.includes("--verifier");
+mkdirSync(build, { recursive: true });
+
+if (!onlyVerifier) {
+  // 1. compile
+  sh(circom, [circuit, "-l", join(here, "node_modules"), "--r1cs", "--wasm", "--sym", "-o", build]);
+  sh(snarkjs, ["r1cs", "info", join(build, `${name}.r1cs`)]);
+  // 2. powers of tau: new -> beacon -> prepare phase 2 (deterministic)
+  const pot0 = join(build, `pot${POWER}_0000.ptau`);
+  const potB = join(build, `pot${POWER}_beacon.ptau`);
+  const potF = join(build, `pot${POWER}_final.ptau`);
+  if (!existsSync(potF)) {
+    sh(snarkjs, ["powersoftau", "new", "bn128", String(POWER), pot0]);
+    sh(snarkjs, ["powersoftau", "beacon", pot0, potB, BEACON, String(ITERATIONS), "-n=FOGA development beacon (phase 1)"]);
+    sh(snarkjs, ["powersoftau", "prepare", "phase2", potB, potF]);
+  }
+  // 3. phase 2 (deterministic beacon)
+  const z0 = join(build, `${name}_0000.zkey`);
+  const zF = join(build, `${name}_final.zkey`);
+  sh(snarkjs, ["groth16", "setup", join(build, `${name}.r1cs`), potF, z0]);
+  sh(snarkjs, ["zkey", "beacon", z0, zF, BEACON, String(ITERATIONS), "-n=FOGA development beacon (phase 2)"]);
+}
+
+// 4. verification key and the Solidity verifier
+const zF = join(build, `${name}_final.zkey`);
+sh(snarkjs, ["zkey", "export", "verificationkey", zF, join(build, "verification_key.json")]);
+const solTmp = join(build, "Groth16PredicateVerifier.sol");
+sh(snarkjs, ["zkey", "export", "solidityverifier", zF, solTmp]);
+let sol = readFileSync(solTmp, "utf8");
+sol = sol.replace(/contract Groth16Verifier\b/, "contract Groth16PredicateVerifier");
+sol = sol.replace(/^\/\/ SPDX-License-Identifier: GPL-3.0$/m, "// SPDX-License-Identifier: GPL-3.0\n// Generated by snarkjs from zk/circuits/kya_predicate_count_v1.circom with the development ceremony of\n// prover/build-predicate.mjs. Do not edit; rebuild.");
+const outDir = join(root, "contracts", "src", "zk");
+mkdirSync(outDir, { recursive: true });
+writeFileSync(join(outDir, "Groth16PredicateVerifier.sol"), sol);
+const vk = JSON.parse(readFileSync(join(build, "verification_key.json"), "utf8"));
+console.log(`verification key: ${vk.nPublic} public signals, protocol ${vk.protocol}, curve ${vk.curve}`);
+console.log(`wrote ${join(outDir, "Groth16PredicateVerifier.sol")}`);