security(frontend): verify WASM and circuit artifact integrity at runtime

[enliven17]

Summary

Refuse to generate proofs with tampered or mismatched Noir/WASM artifacts.

Motivation

Harpocrates handles privacy-sensitive media, proof material, Stellar transactions, and on-chain verification. This change must be production grade: secure by default, bounded under hostile inputs, observable without leaking evidence or witnesses, and recoverable across partial failures.

Scope

• Design and implement: signed manifest, digest verification, version/network binding, cache validation, failure UX, CSP interaction, and deterministic fixtures
• Integrate with the existing area/frontend modules while preserving current API, proof, and contract compatibility unless a versioned migration is included.
• Define typed boundaries, configuration, persistence or artifact changes, rollout/migration behavior, and rollback constraints.
• Add privacy-safe operational signals for progress, failures, saturation, and recovery.
• Document the threat assumptions, local verification workflow, deployment impact, and troubleshooting steps.

Acceptance criteria

• The feature works end to end with explicit compatibility and rollout behavior.
• Invalid, oversized, duplicated, concurrent, timed-out, cancelled, and partially completed operations are handled deterministically.
• Unit tests cover core logic and negative paths; integration/conformance tests exercise the real subsystem boundary.
• Secret witness data, uploaded media, credentials, and proof metadata never appear in logs or durable storage unintentionally.
• Resource limits and authorization checks fail safely with stable error semantics.
• Existing formatting, lint, type checks, unit tests, circuit checks, contract tests, and builds remain green.
• Documentation includes configuration, migration/rollback, operational signals, and limitations.

Engineering expectations

Use explicit state machines, bounded work, idempotent transitions, stable encodings, and versioned cryptographic domains. Avoid correctness that depends on a single process or browser session. Cryptographic changes require deterministic vectors shared across circuit, backend, frontend, and contract layers.

Out of scope

Real user evidence, production secrets, live mainnet deployment, unrelated visual redesign, or dependency upgrades unrelated to the objective.

Definition of done

A maintainer can reproduce positive and adversarial paths locally, confirm privacy properties, operate the feature, and roll it back without undocumented data repair.

[drips-wave]

Congratulations, @habibs-techhub! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @habibs-techhub: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊