feat(zk): prove that a redacted derivative originates from registered evidence

[enliven17]

Summary

Enable publication of a privacy-preserving proof that a redacted derivative was produced from registered source evidence under an allowed transformation policy.

Motivation

Harpocrates needs this capability to become a production-grade, interoperable evidence protocol while preserving privacy, deterministic verification, and safe failure behavior. The implementation must reuse existing metadata, manifest, ZK, backend, frontend, and Soroban boundaries instead of creating parallel truth sources.

Scope

• Specify the private witness, public inputs, transformation commitment, parent proof binding, and allowed redaction operations.
• Implement a Noir prototype with versioned domain separation and bounded media/chunk commitments.
• Ensure removed regions, original frames, secrets, and transformation parameters marked private never enter public inputs or logs.
• Integrate browser proving, local verification, artifact versioning, and Soroban verification planning.
• Publish benchmark and feasibility limits before enabling the feature by default.

Acceptance criteria

• Positive and adversarial vectors cover crop substitution, reordered chunks, altered visible regions, wrong parent, replay, and malformed proofs.
• Witness zeroization and cancellation paths are tested.
• Cross-layer vectors agree across Noir, JS, backend tooling, and verifier encoding.
• Security documentation states cryptographic assumptions and unsupported transformations.
• Existing lint, type checks, tests, builds, contract checks, and privacy guarantees remain green.

Engineering expectations

Use versioned canonical encodings, explicit error/status types, bounded resource consumption, idempotent operations, and privacy-safe observability. Schema, contract, circuit, or artifact changes require migration and compatibility analysis. Cryptographic changes require stable vectors and a written threat model.

Out of scope

Live production deployment, real credentials or sensitive media, unrelated visual redesigns, and broad dependency upgrades not required by this objective.

Definition of done

A maintainer can reproduce success and adversarial failure paths locally, understand the trust and privacy boundaries, operate the feature safely, and roll it back without undocumented state repair.

[drips-wave]

Congratulations, @SHEROSE0! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @SHEROSE0: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[TheShnider]

@TheShnider has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi.i would like to work on this

ℹ️ Repo Maintainers: To accept this application, review their application or assign @TheShnider to this issue.

[abdullahi503-lab]

@abdullahi503-lab has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

I would like to work on this issue because

ℹ️ Repo Maintainers: To accept this application, review their application or assign @abdullahi503-lab to this issue.

[ValJnr-dev1]

@ValJnr-dev1 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hi Maintainer,

I’m a smart contract and full-stack developer and would love to contribute to this issue. I’m an experienced contributor with hands-on expertise in Rust, Soroban, Cairo, and TypeScript.

I’m passionate about building secure, scalable blockchain solutions, with a strong emphasis on writing clean and maintainable code. Based on the scope of this issue, I’m confident I can deliver a complete solution within 24 hours of assignment.

I’d greatly appreciate the opportunity to contribute and help move this forward.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ValJnr-dev1 to this issue.

[drips-wave]

Congratulations, @Cent-Dave! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Cent-Dave: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊