roadmap: sequence interoperability, advanced privacy, and verification work

[enliven17]

Purpose

This tracking issue preserves the implementation order for the next Harpocrates development wave. It is a planning index, not an implementation task. Child issues and pull requests remain independently reviewable and must not be combined into one oversized change.

Open pull requests at tracker creation

• refactor(frontend): split monolithic App component #53 — frontend App decomposition
• security(backend): authenticate /api/proofs/register with Bearer token #55 — proof-registration authentication
• security(backend): rate-limit upload and proof endpoints #56 — backend rate limiting
• chore: add structured issue templates and security policy #113 — issue templates and security policy
• security(contracts): implement scoped emergency pause controls #116 — scoped emergency pause controls
• feat(release): coordinate versioned component releases #117 — coordinated releases
• feat(contracts): record an auditable proof lifecycle history #118 — proof lifecycle history

Before starting overlapping work, contributors must check whether these PRs have merged or changed the relevant files. This snapshot was recorded on 2026-07-24 and should be refreshed as reviews complete.

Current feature wave

• feat(interoperability): import and export C2PA-compatible authenticity manifests #119 C2PA-compatible authenticity manifests
• feat(protocol): represent verifiable parent-child lineage for transformed evidence #120 transformed-evidence lineage
• feat(zk): prove that a redacted derivative originates from registered evidence #121 privacy-preserving redaction-origin proofs
• privacy(zk): introduce verifier-scoped and epoch-scoped nullifiers #122 verifier/epoch-scoped nullifiers
• feat(zk): support selective disclosure of issuer-certified attributes #123 selective-disclosure attributes
• security(contracts): require threshold institutional approval for high-assurance seals #124 threshold institutional seals
• security(protocol): add issuer key transparency and rotation history #125 issuer key transparency
• security(contracts): support verifier sets and quorum-based proof acceptance #126 verifier sets and quorum acceptance
• feat(protocol): export signed verification receipts for offline audit #127 signed verification receipts
• feat(protocol): anchor evidence capture time with independently verifiable timestamps #128 independently verifiable timestamps
• feat(protocol): add governed disputes, corrections, and superseding attestations #129 disputes, corrections, and superseding attestations
• feat(devx): publish a headless verification CLI and reusable SDK #130 headless verification CLI and SDK
• feat(protocol): define a privacy-preserving capture-device attestation profile #131 privacy-preserving capture attestation profile
• feat(frontend): add bounded batch evidence verification and export #132 bounded batch verification
• test(protocol): publish a black-box conformance suite for independent implementations #133 black-box protocol conformance suite

Recommended dependency order

1. Protocol formats and specifications: feat(interoperability): import and export C2PA-compatible authenticity manifests #119, feat(protocol): represent verifiable parent-child lineage for transformed evidence #120, privacy(zk): introduce verifier-scoped and epoch-scoped nullifiers #122, security(protocol): add issuer key transparency and rotation history #125, feat(protocol): export signed verification receipts for offline audit #127, feat(protocol): anchor evidence capture time with independently verifiable timestamps #128, feat(protocol): define a privacy-preserving capture-device attestation profile #131.
2. Reusable verification tooling: feat(devx): publish a headless verification CLI and reusable SDK #130 and test(protocol): publish a black-box conformance suite for independent implementations #133.
3. Contract/governance primitives: security(contracts): require threshold institutional approval for high-assurance seals #124, security(contracts): support verifier sets and quorum-based proof acceptance #126, feat(protocol): add governed disputes, corrections, and superseding attestations #129.
4. Advanced circuits: feat(zk): prove that a redacted derivative originates from registered evidence #121 and feat(zk): support selective disclosure of issuer-certified attributes #123.
5. Product workflows: feat(frontend): add bounded batch evidence verification and export #132 and UI integrations from the preceding issues.

Follow-up pull-request packages to open after the issue designs stabilize

These are intentionally recorded now so they are not lost. They should become separate PRs only when their parent issue prerequisites are ready.

Interoperability and lineage

• C2PA bounded parser and adversarial fixture corpus.
• C2PA export adapter and canonical Harpocrates assertion mapping.
• C2PA trust-state UI and integration tests.
• Lineage canonical schema and cycle-validation library.
• Lineage contract storage/events plus migration.
• Lineage indexer/API and accessible graph UI.

Advanced privacy and ZK

• Redaction-proof statement/specification and synthetic vectors.
• Redaction Noir circuit with negative/adversarial tests.
• Redaction browser prover, artifact integrity, and cancellation.
• Redaction Soroban verifier integration and cross-layer vectors.
• Scoped-nullifier specification and canonical encoding.
• Scoped-nullifier circuit/public-input update.
• Scoped-nullifier registry migration and frontend rollout.
• Selective-disclosure credential schema and issuer tooling.
• Selective-disclosure predicates/circuit test corpus.
• Selective-disclosure browser and verifier integration.

Institutional trust

• Threshold-seal policy types, storage, and authorization tests.
• Partial approval/finalization state machine and events.
• Threshold-seal frontend/backend workflow.
• Issuer transparency manifest and rotation-chain validator.
• Signed directory checkpoints and equivocation detection.
• Issuer-history client cache and stale-state UX.
• Verifier-set registry and bounded quorum state machine.
• Divergence monitoring, emergency disable, and resource benchmarks.

Receipts, time, disputes, and capture

• Canonical receipt library and stable vectors.
• Receipt signing/key rotation and offline verifier.
• Receipt file/QR export and accessibility.
• Time-attestation envelope and Stellar ledger anchoring.
• RFC 3161 validation and bounded certificate processing.
• Dispute/supersession contract state machine.
• Dispute indexer/API and moderation workflow.
• Capture-attestation specification and synthetic vectors.
• Capture-attestation verifier profile and trust-level UI.

Developer tooling and batch operation

• Shared verification core extraction.
• Headless CLI with stable JSON and exit codes.
• SDK packaging, examples, compatibility CI, and provenance.
• Bounded browser worker pool for batch verification.
• Batch result/receipt export.
• Implementation-neutral fixture repository layout.
• Black-box conformance runner and CI compatibility report.

Coordination rules

• One PR should implement one coherent layer and include its own tests.
• Circuit, contract, and encoding changes require stable vectors before UI integration.
• Do not merge dependent UI work before the canonical format or state machine is stable.
• Refresh the open-PR snapshot whenever this tracker is reviewed.
• Close checklist items only after the parent issue is fully complete, not merely when a PR is opened.