@tangle-network/starter-foundry 0.5.3 → 0.7.0

package/registry/families/soc2-compliance-pack/manifest.json

@@ -0,0 +1,60 @@
+{
+  "id": "soc2-compliance-pack",
+  "description": "SOC2 Type II compliance overlay — append-only audit log, change-management surface, vendor attestation registry, incident response playbook. Composes onto fintech-ledger-backend / api-service / fullstack-ts.",
+  "tags": ["compliance", "soc2", "overlay"],
+  "taxonomy": { "language": "typescript", "runtime": "node", "surface": "api" },
+  "defaults": {
+    "projectType": "compliance-pack",
+    "serviceName": "starter-foundry-soc2-pack"
+  },
+  "files": [
+    { "source": "files/package.json", "target": "package.json" },
+    { "source": "files/tsconfig.json", "target": "tsconfig.json" },
+    { "source": "files/src/audit.ts", "target": "src/audit.ts" },
+    { "source": "files/src/change-mgmt.ts", "target": "src/change-mgmt.ts" },
+    { "source": "files/docs/SOC2-controls.md", "target": "docs/SOC2-controls.md" },
+    { "source": "files/docs/incident-response.md", "target": "docs/incident-response.md" },
+    { "source": "files/docs/vendor-attestations.md", "target": "docs/vendor-attestations.md" },
+    { "source": "files/validate-soc2-pack.mjs", "target": "validate-soc2-pack.mjs" }
+  ],
+  "validationChecks": [
+    { "type": "file-exists", "path": "src/audit.ts" },
+    { "type": "file-exists", "path": "docs/SOC2-controls.md" },
+    { "type": "command-success", "command": ["node", "validate-soc2-pack.mjs"], "expect": "soc2-pack ok" }
+  ],
+  "contextHints": {
+    "commands": ["pnpm install", "pnpm build"],
+    "entrypoints": ["src/audit.ts", "docs/SOC2-controls.md"],
+    "preview": null,
+    "extensionPoints": ["docs/SOC2-controls.md", "docs/vendor-attestations.md"]
+  },
+  "keywords": ["soc2", "soc 2", "soc2 compliance", "soc 2 type ii", "trust services criteria"],
+  "scoring": { "boost": { "soc2 compliance": 5, "soc 2 type ii": 4 } },
+  "tieredKeywords": {
+    "tier1": ["soc2 compliance", "soc2 compliant", "soc 2 type ii"],
+    "tier2": ["trust services criteria", "cc7.2", "security compliance"]
+  },
+  "buildHints": {
+    "whenToUse": "Bolt SOC2 Type II primitives (audit trail, change-management approvals, vendor registry) onto an existing backend before a Type II audit window opens.",
+    "firstSteps": [
+      "Read `docs/SOC2-controls.md` — Trust Services Criteria CC1-CC9 mapped to files.",
+      "Wire `recordChange()` from `src/change-mgmt.ts` onto every deploy + config change — CC8.1 requires change approvals be logged.",
+      "Enforce CODEOWNERS + branch protection on main (CC7.2). The pack ships a reference `.github/CODEOWNERS` pattern.",
+      "Log into `docs/vendor-attestations.md` every sub-processor with a SOC2 attestation (Stripe, AWS, Vercel, etc.) — auditors check this.",
+      "Set up Uptime + response-time SLI dashboards — CC7.1 availability evidence."
+    ],
+    "gotchas": [
+      "Audit log retention for SOC2 is commonly 12 months minimum; some auditors require 7 years. Confirm with your auditor before TTL'ing old rows.",
+      "Change management (CC8.1) requires ≥1 approver per change — self-merges are flagged. Enforce via branch protection, not honor system.",
+      "Vendor attestations must be CURRENT (within the audit window). A 2-year-old vendor SOC2 report is an exception finding.",
+      "Incident response (CC7.3) needs a tested playbook. Run at least one tabletop exercise before the audit."
+    ],
+    "architectureNotes": [
+      "SOC2 audits are about process evidence, not code. This pack produces the artifacts (audit rows, CODEOWNERS, playbooks) auditors want to see. The controls themselves are operational."
+    ],
+    "placeholders": [
+      { "path": "docs/SOC2-controls.md", "description": "Trust Services Criteria doc. Customize per your audit scope." },
+      { "path": "docs/vendor-attestations.md", "description": "Live vendor registry. Update quarterly." }
+    ]
+  }
+}

package/registry/families/sp1-zkvm/files/Cargo.toml

@@ -0,0 +1,18 @@
+[workspace]
+resolver = "2"
+# Program and script are separate workspace members. The program compiles to
+# a RISC-V zkVM target (via `cargo prove build`); the script compiles for
+# the host.
+members = ["script"]
+# Program is built by sp1-build, not as a workspace member — keeps its
+# RISC-V target-triple from leaking into the script's build profile.
+exclude = ["program"]
+
+[workspace.package]
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+
+[profile.release]
+lto = true
+codegen-units = 1

package/registry/families/sp1-zkvm/files/README.md

@@ -0,0 +1,68 @@
+# Succinct SP1 zkVM starter
+
+Modern general-purpose Rust zkVM. Prove arbitrary Rust; verify locally,
+on the Succinct prover network, or on-chain via Gnark/Plonk.
+
+## Layout
+
+```
+Cargo.toml               # workspace root — script is a member; program is excluded (separate build)
+rust-toolchain.toml      # pinned stable
+program/
+  Cargo.toml             # sp1-zkvm dep
+  src/main.rs            # runs INSIDE the SP1 zkVM (RISC-V target)
+script/
+  Cargo.toml             # sp1-sdk + sp1-build
+  src/main.rs            # entry point
+  src/prover.rs          # ProverClient + SP1Stdin wiring
+```
+
+## Run
+
+```bash
+# Install the SP1 toolchain (one-time).
+curl -L https://sp1.succinct.xyz | bash
+sp1up
+
+# Build the program (generates program/elf/riscv32im-succinct-zkvm-elf).
+cd program && cargo prove build && cd ..
+
+# Prove + verify.
+#   Fast dev: SP1_PROVER=mock cargo run --release -p script
+#   Local real: SP1_PROVER=cpu cargo run --release -p script
+#   Cloud: SP1_PROVER=network SP1_PRIVATE_KEY=<network-key> cargo run --release -p script
+cargo run --release -p script
+```
+
+## Proof variants
+
+| Variant | How | Use case |
+|---|---|---|
+| compressed STARK | `.prove().run()` | off-chain verification, smallest & fastest |
+| Plonk (Gnark) | `.prove().plonk().run()` | on-chain EVM via `SP1Verifier.sol`, ~5 KB proof |
+| Groth16 | `.prove().groth16().run()` | on-chain, ~200 byte proof, slower prove |
+
+Pick plonk/groth16 only when you need on-chain verification. Compressed is
+cheaper everywhere else.
+
+## On-chain verification
+
+Succinct ships `SP1Verifier.sol` + a trusted setup per proof variant:
+
+```solidity
+// In your Solidity consumer:
+ISP1Verifier(verifier).verifyProof(vkey, publicValues, proofBytes) returns (bool)
+```
+
+See `github.com/succinctlabs/sp1-contracts` for the verifier + a rollup
+example.
+
+## Gotchas
+
+- **RISC-V constraints**: no net, no fs, no system clock. Pure compute.
+- **Public values order matters**: program commits in order → verifier reads
+  in same order. Mismatching the order silently decodes garbage.
+- **include_elf! requires sp1-build in `[build-dependencies]`**; without it
+  you get a compile error on the ELF constant.
+- **SP1_PRIVATE_KEY is a prover-network credential**, not an Ethereum key.
+  Get it from the Succinct dashboard; belongs in secret storage.

package/registry/families/sp1-zkvm/files/program/main.rs

@@ -0,0 +1,21 @@
+//! SP1 program — runs INSIDE the Succinct zkVM on a RISC-V target.
+//! Reads inputs via `sp1_zkvm::io::read`, commits outputs via
+//! `sp1_zkvm::io::commit`. Build with `cd program && cargo prove build`.
+
+#![no_main]
+sp1_zkvm::entrypoint!(main);
+
+pub fn main() {
+    let a = sp1_zkvm::io::read::<u64>();
+    let b = sp1_zkvm::io::read::<u64>();
+
+    // Your provable logic here. For real uses, replace with a signature
+    // verifier, a state-transition validator, or whatever your protocol
+    // needs proven.
+    let sum = a.saturating_add(b);
+    let product = a.saturating_mul(b);
+
+    // Public values — read back out of the proof in the same order.
+    sp1_zkvm::io::commit(&sum);
+    sp1_zkvm::io::commit(&product);
+}

package/registry/families/sp1-zkvm/files/program-Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "program"
+version = "0.1.0"
+edition = "2021"
+
+[[bin]]
+name = "program"
+path = "src/main.rs"
+
+[dependencies]
+sp1-zkvm = "4.0"

package/registry/families/sp1-zkvm/files/rust-toolchain.toml

@@ -0,0 +1,3 @@
+[toolchain]
+channel = "stable"
+components = ["rustfmt", "clippy"]

package/registry/families/sp1-zkvm/files/script/main.rs

@@ -0,0 +1,13 @@
+//! SP1 script entry point. Invokes the prover, verifies the proof, decodes
+//! public values.
+
+mod prover;
+
+use anyhow::Result;
+
+fn main() -> Result<()> {
+    let (sum, product, proof) = prover::prove_sum_and_product(3, 4)?;
+    println!("Proved: 3 + 4 = {sum}, product = {product}");
+    println!("Proof size: {} bytes", proof.bytes().len());
+    Ok(())
+}

package/registry/families/sp1-zkvm/files/script/prover.rs

@@ -0,0 +1,36 @@
+//! SP1 driver. Builds the prover client, feeds inputs into the program,
+//! proves, verifies, returns public values + the proof.
+
+use anyhow::{Context, Result};
+use sp1_sdk::{include_elf, ProverClient, SP1ProofWithPublicValues, SP1Stdin};
+
+// Embeds the compiled program ELF at build time (requires sp1-build in
+// script's [build-dependencies]). The string name matches the program
+// crate's [package] name in program/Cargo.toml.
+const PROGRAM_ELF: &[u8] = include_elf!("program");
+
+pub fn prove_sum_and_product(
+    a: u64,
+    b: u64,
+) -> Result<(u64, u64, SP1ProofWithPublicValues)> {
+    let mut stdin = SP1Stdin::new();
+    stdin.write(&a);
+    stdin.write(&b);
+
+    // SP1_PROVER env picks the mode:
+    //   mock    → no real proof, returns instantly (tight dev loop)
+    //   cpu     → local CPU prove (seconds-to-minutes)
+    //   network → Succinct prover network (needs SP1_PRIVATE_KEY)
+    let client = ProverClient::from_env();
+    let (pk, vk) = client.setup(PROGRAM_ELF);
+
+    let proof = client.prove(&pk, &stdin).run().context("prove")?;
+    client.verify(&proof, &vk).context("verify")?;
+
+    // Decode public values in the same order the program committed.
+    let mut pv = proof.public_values.clone();
+    let sum = pv.read::<u64>();
+    let product = pv.read::<u64>();
+
+    Ok((sum, product, proof))
+}

package/registry/families/sp1-zkvm/files/script-Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "script"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[[bin]]
+name = "prove"
+path = "src/main.rs"
+
+[dependencies]
+sp1-sdk = "4.0"
+serde = { version = "1", features = ["derive"] }
+anyhow = "1"
+
+[build-dependencies]
+sp1-build = "4.0"

package/registry/families/sp1-zkvm/files/validate-sp1.mjs

@@ -0,0 +1,30 @@
+import fs from "node:fs/promises";
+
+const required = [
+  "Cargo.toml",
+  "program/Cargo.toml",
+  "program/src/main.rs",
+  "script/Cargo.toml",
+  "script/src/main.rs",
+  "script/src/prover.rs",
+];
+
+for (const path of required) {
+  try {
+    await fs.access(path);
+  } catch {
+    throw new Error(`sp1-zkvm scaffold missing required file: ${path}`);
+  }
+}
+
+const programCargo = await fs.readFile("program/Cargo.toml", "utf8");
+if (!programCargo.includes("sp1-zkvm")) {
+  throw new Error("program/Cargo.toml missing sp1-zkvm dep");
+}
+
+const scriptCargo = await fs.readFile("script/Cargo.toml", "utf8");
+if (!scriptCargo.includes("sp1-sdk") || !scriptCargo.includes("sp1-build")) {
+  throw new Error("script/Cargo.toml missing sp1-sdk or sp1-build dep");
+}
+
+console.log("sp1-zkvm starter ok");

package/registry/families/sp1-zkvm/manifest.json

@@ -0,0 +1,92 @@
+{
+  "id": "sp1-zkvm",
+  "description": "Succinct SP1 zkVM workspace — modern general-purpose Rust zkVM with program + script split. Prove arbitrary Rust programs locally or via the Succinct prover network; verify on-chain through the SP1 Gnark/Plonk Solidity verifier.",
+  "tags": [
+    "zk",
+    "zkvm",
+    "rust",
+    "sp1",
+    "succinct",
+    "proofs"
+  ],
+  "taxonomy": {
+    "language": "rust",
+    "runtime": "native",
+    "surface": "zkvm"
+  },
+  "slots": {},
+  "defaults": {
+    "projectType": "zkvm",
+    "programName": "program"
+  },
+  "files": [
+    {
+      "source": "files/Cargo.toml",
+      "target": "Cargo.toml"
+    },
+    {
+      "source": "files/rust-toolchain.toml",
+      "target": "rust-toolchain.toml"
+    },
+    {
+      "source": "files/program-Cargo.toml",
+      "target": "program/Cargo.toml"
+    },
+    {
+      "source": "files/program/main.rs",
+      "target": "program/src/main.rs"
+    },
+    {
+      "source": "files/script-Cargo.toml",
+      "target": "script/Cargo.toml"
+    },
+    {
+      "source": "files/script/main.rs",
+      "target": "script/src/main.rs"
+    },
+    {
+      "source": "files/script/prover.rs",
+      "target": "script/src/prover.rs"
+    },
+    {
+      "source": "files/README.md",
+      "target": "README.md"
+    },
+    {
+      "source": "files/validate-sp1.mjs",
+      "target": "validate-sp1.mjs"
+    }
+  ],
+  "tieredKeywords": {
+    "tier1": [
+      "sp1",
+      "succinct",
+      "succinct labs",
+      "succinct sp1",
+      "succinct zkvm"
+    ],
+    "tier2": [
+      "succinct prover",
+      "succinct network",
+      "sp1 prover",
+      "sp1 zkvm",
+      "sp1-verifier",
+      "sp1 gnark",
+      "sp1 on-chain verifier",
+      "prove rust in sp1"
+    ],
+    "archetypes": [
+      "prove rust programs with sp1",
+      "succinct prover network service",
+      "sp1 rollup",
+      "sp1 on-chain verifier"
+    ]
+  },
+  "validationChecks": [
+    { "type": "file-exists", "path": "Cargo.toml" },
+    { "type": "file-exists", "path": "program/Cargo.toml" },
+    { "type": "file-exists", "path": "program/src/main.rs" },
+    { "type": "file-exists", "path": "script/Cargo.toml" },
+    { "type": "file-exists", "path": "script/src/main.rs" }
+  ]
+}

package/registry/families/stm32-rust/files/Cargo.toml

@@ -0,0 +1,69 @@
+[package]
+name = "{{crateName}}"
+version = "0.1.0"
+edition = "2021"
+rust-version = "1.77"
+
+[[bin]]
+name = "{{crateName}}"
+path = "src/main.rs"
+test = false
+bench = false
+
+[profile.release]
+codegen-units = 1
+debug = 2       # keep debug symbols — they live in the ELF, never on-chip
+lto = "fat"
+opt-level = "z"
+overflow-checks = false
+
+[profile.dev]
+codegen-units = 1
+debug = 2
+opt-level = 1
+overflow-checks = true
+
+[dependencies]
+# Embassy async framework. Chip feature selects which HAL backend + time
+# driver gets compiled in. Swap the `stm32f411re` feature for a different
+# chip (e.g. `stm32l475vg`) — exactly one chip feature must be enabled.
+embassy-stm32 = { version = "0.1", features = [
+    "defmt",
+    "stm32f411re",
+    "unstable-pac",
+    "memory-x",
+    "time-driver-any",
+    "exti",
+] }
+embassy-executor = { version = "0.6", features = [
+    "task-arena-size-32768",
+    "arch-cortex-m",
+    "executor-thread",
+    "executor-interrupt",
+    "defmt",
+    "integrated-timers",
+] }
+embassy-time = { version = "0.3", features = ["defmt", "defmt-timestamp-uptime", "tick-hz-32_768"] }
+embassy-sync = { version = "0.6", features = ["defmt"] }
+embassy-futures = "0.1"
+
+# Cortex-M runtime + panic handling. cortex-m-rt provides the reset vector
+# and linker glue; panic-probe hooks panics into defmt so probe-rs prints
+# the stack trace over RTT on crash.
+cortex-m = { version = "0.7.7", features = ["inline-asm", "critical-section-single-core"] }
+cortex-m-rt = "0.7"
+panic-probe = { version = "0.3", features = ["print-defmt"] }
+
+# Logging over RTT (Real-Time Transfer). defmt-rtt is the transport,
+# defmt is the framing. probe-rs decodes both.
+defmt = "0.3"
+defmt-rtt = "0.4"
+
+# Heapless collections — no alloc in no_std firmware.
+heapless = "0.8"
+
+[patch.crates-io]
+# Embassy uses semver-incompatible pins across its sub-crates; upstream
+# recommends a single git rev pin for reproducibility. Swap to a stable
+# release tag once embassy-stm32 cuts one.
+# embassy-stm32 = { git = "https://github.com/embassy-rs/embassy", rev = "pinned" }

package/registry/families/stm32-rust/files/Embed.toml

@@ -0,0 +1,26 @@
+# probe-rs configuration. `cargo embed` reads this for target + RTT config.
+[default.probe]
+# Auto-select the first attached probe. Pin a `usb_vid = "xxxx"` /
+# `usb_pid = "yyyy"` here if the board has a specific ST-Link / CMSIS-DAP.
+protocol = "Swd"
+speed = 4000
+
+[default.general]
+chip = "STM32F401RETx"
+# Override per-board:
+# - Nucleo-F401RE: STM32F401RETx
+# - STM32F4-Discovery: STM32F407VGTx
+# - Black Pill: STM32F411CEUx
+
+[default.rtt]
+enabled = true
+up_mode = "NoBlockSkip"
+channels = [{ up = 0, down = 0, name = "defmt" }]
+
+[default.gdb]
+enabled = false
+
+[default.flashing]
+enabled = true
+restore_unwritten_bytes = false
+halt_afterwards = false

package/registry/families/stm32-rust/files/build.rs

@@ -0,0 +1,24 @@
+// Build script for Embassy STM32 starter. Copies memory.x into the target
+// directory so rustc's linker sees it, and re-runs the build when the layout
+// file changes.
+//
+// Reference: https://docs.embassy.dev/embassy-stm32/git/stm32f401re/_index.html
+
+use std::env;
+use std::fs::File;
+use std::io::Write;
+use std::path::PathBuf;
+
+fn main() {
+    let out = &PathBuf::from(env::var_os("OUT_DIR").unwrap());
+    File::create(out.join("memory.x"))
+        .unwrap()
+        .write_all(include_bytes!("memory.x"))
+        .unwrap();
+    println!("cargo:rustc-link-search={}", out.display());
+    println!("cargo:rerun-if-changed=memory.x");
+    // Pass the link-arg so the linker picks up memory.x.
+    println!("cargo:rustc-link-arg-bins=--nmagic");
+    println!("cargo:rustc-link-arg-bins=-Tlink.x");
+    println!("cargo:rustc-link-arg-bins=-Tdefmt.x");
+}

package/registry/families/stm32-rust/files/cargo-config.toml

@@ -0,0 +1,20 @@
+# Cortex-M4F with hardware FPU — thumbv7em-none-eabihf.
+# The -T link args pull in cortex-m-rt's link.x (which in turn includes
+# memory.x from the crate root) plus defmt.x for the RTT log format.
+
+[build]
+target = "thumbv7em-none-eabihf"
+
+[target.thumbv7em-none-eabihf]
+# `probe-rs run` flashes the binary and streams RTT back to stdout.
+# Swap the chip name for the exact STM32 MCU on your board.
+runner = "probe-rs run --chip STM32F411RETx"
+rustflags = [
+    "-C", "link-arg=--nmagic",
+    "-C", "link-arg=-Tlink.x",
+    "-C", "link-arg=-Tdefmt.x",
+    "-C", "target-cpu=cortex-m4",
+]
+
+[env]
+DEFMT_LOG = "info"

package/registry/families/stm32-rust/files/memory.x

@@ -0,0 +1,25 @@
+/* Linker memory layout for STM32F411RE (512K flash, 128K SRAM).
+ *
+ * If your chip is different, ADJUST these sizes. Wrong values silently
+ * link but crash at first read/write past the actual end of RAM or first
+ * flash write past the actual end of flash.
+ *
+ * Common STM32F4 layouts:
+ *   STM32F401xE   512K flash  96K SRAM
+ *   STM32F411xE   512K flash 128K SRAM
+ *   STM32F429xI  2048K flash 256K SRAM
+ *
+ * After editing this file, run `cargo clean` — cargo does not track
+ * memory.x as a build input so the linker will reuse a stale cache.
+ */
+
+MEMORY
+{
+  FLASH : ORIGIN = 0x08000000, LENGTH = 512K
+  RAM   : ORIGIN = 0x20000000, LENGTH = 128K
+}
+
+/* _stack_start is optional but recommended — put the stack at the top
+ * of RAM so stack overflow traps into the MPU (or just wraps if no MPU).
+ */
+_stack_start = ORIGIN(RAM) + LENGTH(RAM);

package/registry/families/stm32-rust/files/validate-stm32.mjs

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { readFileSync, existsSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+
+for (const rel of ['Cargo.toml', 'memory.x', 'build.rs', 'Embed.toml', 'src/main.rs']) {
+  if (!existsSync(join(here, rel))) throw new Error(`missing ${rel}`)
+}
+const cargo = readFileSync(join(here, 'Cargo.toml'), 'utf8')
+if (!/embassy-stm32/.test(cargo)) throw new Error('Cargo.toml missing embassy-stm32 dependency')
+if (!/embassy-executor/.test(cargo)) throw new Error('Cargo.toml missing embassy-executor dependency')
+const embed = readFileSync(join(here, 'Embed.toml'), 'utf8')
+if (!/chip\s*=\s*"STM32/.test(embed)) throw new Error('Embed.toml missing chip = "STM32..."')
+const memory = readFileSync(join(here, 'memory.x'), 'utf8')
+if (!/FLASH\s+:\s+ORIGIN/.test(memory)) throw new Error('memory.x missing FLASH region')
+if (!/RAM\s+:\s+ORIGIN/.test(memory)) throw new Error('memory.x missing RAM region')
+console.log('stm32-rust starter ok')